Why it shows up in your week
The assistant does not only explain how to book a demo. It offers to create the CRM lead. That create call is tool calling. Without permissions and approval, it is also how you create duplicate junk records at scale.
In plain language
The model proposes a tool name and arguments. Your runtime validates them, executes the API, and returns the result to the model.
Read-only tools (search, fetch) are safer than write tools (email send, CRM update). Many teams start read-only, then add HITL on writes.
Schema validation on arguments catches garbage before it hits production systems.
MCP and similar protocols standardise how tools are exposed. Tool calling is the general pattern either way.
Audit every call. When something wrong lands in the CRM, you need the trail.
Facts worth keeping
- Also called
- Function calling
- Loop
- Model proposes tool → runtime executes → result returns to model
- Safe default
- Read-only tools first; writes behind HITL
- Hardening
- Argument schema validation, least privilege, audit logs
- Related
- MCP as one way to expose tools to models
Not the same as
- MCP (Model Context Protocol)A protocol for exposing tools to models in a standard way. Tool calling is the general pattern; MCP is one connector approach.
- Plain chat completionsText-only responses with no structured tool invocation.
- Zapier without an LLMTraditional automation runs fixed rules. Tool calling lets the model choose which tool to run for a request.
Where it bites
Tool calling hurts when a loosely permissioned agent can send email or edit records because the demo only tested happy-path prompts.
Cleanup then spans CRM, inboxes, and a trust conversation with the team that approved the pilot.
What to check
- Which tools are read-only versus write, and who approved that list?
- Are arguments schema-validated before execution?
- Is there an audit trail of tool calls and outcomes?
- Which write actions require human approval?
- What is the kill switch if a tool starts misbehaving?
Common questions
What is tool calling?
When a language model chooses and invokes a structured function or API as part of answering a request, instead of only generating text.
Is tool calling the same as MCP?
MCP is a protocol for exposing tools to models in a standard way. Tool calling is the general pattern; MCP is one way to connect those tools.
What should you check first for tool calling?
Limit the tool list, validate arguments, require human approval for write actions, and log every call.
Should customers see tool calls?
Often show the outcome, not the raw JSON. Internally, keep full logs.
Can tool calling replace integrations engineering?
It can orchestrate integrations. You still need reliable APIs, auth, error handling, and ownership.