Tool calling How a language model asks other software to do something.
Short answer. Tool calling, also called function calling, is how a language model asks software to act. The model runs nothing itself. It returns a structured request naming a tool and its arguments, the application runs the tool, and the result goes back to the model, which answers or asks for another tool. Example: asked “has invoice 4471 been paid?”, the model returns a request such as get_invoice_status with the number 4471. Your accounts software looks it up and returns “paid on 3 October”, and the model writes the reply. Because the application runs the tool, the application is where permissions, limits and approvals belong.
01
The loop, step by step
OpenAI’s guide describes the flow in five steps, and Anthropic’s documentation describes the same round trip for its models.
Step
What happens
Who does it
1. Offer tools
The application sends the request plus the list of tools the model may call, each with a name, a description and the arguments it takes
Your application
2. Model asks
The model replies with a tool call instead of text: the tool name and the argument values
The model
3. Tool runs
The application checks the request and runs the function, for example a database lookup
Your application
4. Result returned
The application sends the tool’s output back to the model, tied to the call it answers
Your application
5. Answer or repeat
The model writes the final reply, or asks for another tool
The model
02
Who runs the tool
Anthropic separates client tools, which run in your application, from server tools such as web search, which run on the provider’s infrastructure. For a client tool the model returns a tool-use request and your code sends the result back. For a server tool the provider runs it and you see the result directly.
That difference decides where data goes. A client tool that queries your own database keeps the lookup inside your network, while a provider’s web search sends the query to the provider. OpenAI’s platform also offers built-in tools that search the web, run code and reach an MCP server. Local runtimes such as Ollama document the same pattern for models that support tools.
03
Why the application must stay in charge
The model only proposes a call. Whether to run it is the application’s decision, and it cannot be left to the model, which can be wrong or can be steered by text it reads. OWASP’s guidance on excessive agency makes three points. Authorise every request in the downstream system, rather than relying on the model to judge whether an action is allowed. Run tools in the context of the user who asked. Require a person’s approval for high-impact actions.
OWASP’s example of excess permission: a tool meant only to read a database connects with an identity that can also update, insert and delete. If the model is tricked, the tool can do all four.
04
A checklist for each tool you expose
One narrow purpose. “Read a client’s invoice status” is better than “run any query”.
Read-only unless the task needs more.
Arguments checked by code. Treat what the model supplies as untrusted input.
Runs as the person who asked, with that person’s permissions, not as a shared administrator account.
Anything that sends, pays or deletes waits for a person to approve it.
A limit on calls per request and a timeout on each call.
Every call logged with who asked, which tool ran and when.
05
Where ANVE stands
ANVE’s agent loop allows up to seven tool steps per request, and a claim made without a successful tool call is challenged. ANVE’s security page (/security) says the tools an agent can use must be approved by an administrator, a tool that changes is switched off, and every tool call is logged. Zoho and other tools can connect through MCP connectors that an administrator approves, and every model call is logged with the user, the app, the model and whether it ran locally or in the cloud.
06
Questions people ask
Is tool calling the same as function calling?
Yes. OpenAI and Anthropic both use the two terms for the same mechanism.
Does the model run the tool?
No. The model returns a structured request. The application runs the tool, or the provider does for a server tool, and sends the result back.
Can a local model use tools?
Many open models can. Ollama’s documentation describes tool calling for models that support it, so check the model you intend to use and test it on your own tools.
Is tool calling safe?
It is as safe as the permissions behind the tools. Give each tool the least access it needs, keep a person in the approval step for risky actions, and log every call.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
