Function Calling
Also known as: tool use, tool calling, LLM tool use, model function calling
Function calling (also called tool use or tool calling) is a capability of modern large language models that allows them to invoke external functions, APIs, or tools as part of generating a response.
The model does not execute code itself; instead, it outputs a structured request specifying which function to call and with which parameters, the application then executes that function and returns the result, and the model incorporates the result into its response. Function calling is the primary mechanism by which LLMs connect to real-world data sources, services, and the ability to take actions.
Function Calling, explained at three levels
At home
Function calling is what lets an AI connect to the real world. A basic AI can only answer from what it learned during training -- it cannot tell you today's weather or your account balance. With function calling, the AI can say 'I need to call the weather API' and the app runs that function and hands the result back to the AI, which then says 'It is going to rain in Toronto this afternoon.' The AI acts as an intelligent coordinator, deciding which tools to use and interpreting the results.
At work
Function calling is the foundation of practical AI agents. Without it, an AI assistant can only talk about things; with it, it can actually do things -- search the web, look up a customer record, send an email, check inventory, run a calculation. Businesses building AI features use function calling to connect LLMs to their existing APIs and data sources, allowing the AI to retrieve current information and take actions within defined boundaries.
At home
The function calling process has three phases. First, the developer defines the available functions to the model (name, description, parameters with types and descriptions). Second, in response to a user request, the model decides whether to call a function and outputs a structured call (function name + parameter values in JSON). Third, the application executes the function, returns the result to the model, and the model generates a final response incorporating the result. The model may call multiple functions in sequence, using results from earlier calls to decide what to call next.
At work
Function calling and agentic behavior are closely related. A simple function call returns a result and ends. An agentic application might have the model call a sequence of functions, making decisions after each result about what to do next, branching based on intermediate results, and iterating until a goal is achieved. The same function calling API is used in both cases; the difference is in how many tool calls are made and how much autonomy the model has to chain them.
At home
Security is a key concern in function calling implementations. The functions a model has access to define the actions it can take; poorly scoped function access can allow the model (or a prompt injection attack) to take unintended actions. Function calling implementations should follow least-privilege principles: the model should only have access to functions it actually needs for the current task, and functions with irreversible or high-impact effects (sending emails, spending money, deleting data) should require human approval before execution.
At work
From a practitioner standpoint, function definitions are one of the most important elements of LLM application design. Well-written function descriptions (explaining clearly what the function does, what each parameter means, and what the return value represents) produce significantly more reliable function calls than vague descriptions. Treat function documentation with the same care as API documentation -- the model reads function definitions to decide when and how to call them, and ambiguous definitions produce ambiguous calls.
Real-world examples
At home
Ryan asked his AI assistant 'What is the current price of AAPL stock?' The AI cannot know this from its training data. Using function calling, it invoked a stock price API, received the current price, and reported it: 'Apple (AAPL) is currently trading at $192.40.' Without function calling, the AI could only say 'I don't have real-time data.'
At work
A customer support AI built for a telecoms company used function calling to access four backend APIs: the customer account lookup API (to retrieve account details), the billing API (to check payment status), the order API (to track service requests), and the ticketing API (to create or update support tickets). The AI could resolve common queries end-to-end -- like 'Why is my bill higher this month?' -- by calling the billing API, interpreting the results, and responding with a specific explanation from the customer's actual data.
Common confusions
- Function calling does not mean the AI is executing code on your computer. The model outputs a structured request specifying which function to call and with which parameters. The application's code (which the developer wrote and controls) executes the actual function. The model cannot call functions that are not explicitly provided to it in its configuration.
- Function calling is not the same as the AI 'knowing' real-time information. The model does not have inherent access to current data. Function calling gives the model a structured way to request data from external sources. If no function providing current data is defined, the model has no way to retrieve it -- it can only use information from its training data.
- A model with function calling access can still be manipulated to call functions in unintended ways. Prompt injection attacks that embed instructions in content the model processes could direct the model to call functions with attacker-controlled parameters. This is why function access should be minimal and why functions with irreversible effects should have human approval gates.
For analysts
In BA artefacts, function calling requirements define the external integrations available to an AI component and the governance around those integrations. Document: which functions the AI may call (by name and purpose), the approval workflow for functions with irreversible effects (send email, create record, spend money), the logging requirements for all function calls (for audit and debugging), and the rate limiting or cost controls on high-frequency function calls. Useful security requirement: 'All function calls made by the AI must be logged with the triggering user message, the function name, the parameters supplied, the response received, and the timestamp, to support audit and incident investigation.'
History & origin
Function calling as a formal capability was introduced by OpenAI with the GPT-3.5 and GPT-4 API in June 2023, providing a structured interface for model-tool interaction. Anthropic introduced tool use for Claude in 2024. The underlying idea -- providing AI with the ability to call external services -- predates the formal API feature: LangChain (2022) implemented similar functionality through prompt engineering. Function calling formalized and standardized what was previously done informally, making tool-augmented LLMs much more reliable for production applications.