How Tool Calling Works
In tool calling, the model proposes a structured call to a named function; your application validates the arguments and decides whether to execute it. The model does not automatically run your JavaScript function unless your code implements the execution loop. Tool results are returned to the model, which may then answer or request another tool.
A safe loop has bounded steps, allowed-tool lists, schema validation, authorization, timeouts, idempotency, and clear handling of malformed or repeated calls. Never expose a general-purpose shell, arbitrary SQL, or unrestricted HTTP fetch tool to an untrusted agent without strong isolation and policy controls.
Diagram
Tool execution pattern
const toolRegistry = {
getOrderStatus: async ({ orderId }, context) => {
const order = await orders.findVisibleToUser({
orderId,
userId: context.userId
});
if (!order) return { found: false };
return { found: true, status: order.status };
}
};💡 The registry contains application-owned functions. The function checks ownership in the data query rather than trusting the model or a user-supplied order ID.
Key Takeaways
- Tool calls are requests, not permission grants.
- Validate arguments and user access at execution time.
- Limit the number of tool-loop steps and apply timeouts.
Knowledge Check
Who should execute and authorize a tool call proposed by the model?