# What is function calling? Definition and business implications

> Function calling is the ability of an AI model to invoke predefined functions or tools to execute actions in an external system. The model returns a structured object (JSON) rather than text, allowing the application to call the function and reinject the result into the conversation.

## Definition
Function calling (also called *tool use* at Anthropic) was introduced by OpenAI in June 2023. The principle: the developer describes, in the request sent to the model, a list of available functions (name, description, parameters in JSON Schema format). The model, by analysing the user prompt, decides whether to call one of these functions and with which arguments. It does not execute it itself: it returns a structured object indicating the function to call. The application executes the function, captures the result, and reinjects it into the conversation for the model to continue. Function calling is the underlying mechanism that enables an LLM to send an email, create a calendar event, query a database, or orchestrate several tools in cascade. It is the foundation of AI agents. The MCP protocol, introduced at the end of 2024, does not replace it: it standardises how tools are exposed to a model, and it is still the model's function calling that triggers the call.

## Example
Illustrative case. An insurance company deploys an AI assistant to handle reimbursement requests. Three functions are defined in the API: verifier_eligibilite, calculer_remboursement, envoyer_decision. When a customer asks “is my dermatologist consultation reimbursed?”, the assistant identifies the contract, calls verifier_eligibilite, receives the response, calls calculer_remboursement if eligible, then responds to the customer with the amount. Three chained function calls, piloted by the model, executed by the application. Without function calling, this use case would require specific development for each possible scenario.

## For a leader
Function calling transforms the LLM from a text generator into an action coordinator. Three implications for the executive. First, the perimeter of what an AI assistant can do changes radically. It no longer just answers, it acts (modify an order, create a ticket, send an email). This opens very operational use cases but also risks of errors with real consequences. Second, the design of exposed functions is a major governance topic. An overly permissive envoyer_email function can be hijacked by a prompt injection. The principle of least privilege applies: each exposed function must have the narrowest possible scope. Third, MCP does not replace function calling, it builds on it. MCP standardises how tools are exposed; function calling remains the mechanism by which the model decides to call them. For new deployments, exposing your tools through an MCP server avoids rewriting integrations for each assistant or model.

## FAQ

**What is function calling?**
It is the ability of an AI model to invoke predefined functions or tools to carry out actions in an external system. Instead of producing text, the model returns a structured object in JSON format indicating the function to call and its arguments. At Anthropic it is also called tool use; the mechanism was introduced by OpenAI in June 2023.

**Does the model execute the actions itself?**
No. The model merely decides whether to call a function and with which arguments, then returns a structured object. It is the application that actually executes the function, captures the result and reinjects it into the conversation for the model to continue.

**Why is function calling called the foundation of AI agents?**
Because it turns the model from a mere text generator into an action coordinator: sending an email, creating a ticket, querying a database, or chaining several tools in cascade. In the insurance example, three chained functions (check eligibility, calculate reimbursement, send the decision) handle a request end to end, piloted by the model and executed by the application.

**What security risks does this introduce?**
The model can now act, with real consequences if it errs. An overly permissive function, for example an open email-sending function, can be hijacked by a prompt injection. The principle of least privilege applies: each exposed function must have the narrowest possible scope.

**What is the difference between function calling and MCP?**
The two are complementary. MCP standardises how tools are exposed to a model, but it is still function calling that triggers the actual tool call. For a new deployment, exposing your tools through an MCP server avoids rewriting the integrations for each assistant or model.

## See also

- [MCP (Model Context Protocol)](https://wyp.agency/en/glossary/mcp/)
- [LLM (Large Language Model)](https://wyp.agency/en/glossary/llm/)
- [Guardrails](https://wyp.agency/en/glossary/guardrails/)
- [AI API](https://wyp.agency/en/glossary/ai-api/)
- [RAG (Retrieval-Augmented Generation)](https://wyp.agency/en/glossary/rag/)

## Sources

- Tool use overview, Claude documentation (Anthropic) (https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview)
- Function calling, OpenAI documentation (https://developers.openai.com/api/docs/guides/function-calling)
- Function calling and other API updates, OpenAI, 13 June 2023 (https://openai.com/index/function-calling-and-other-api-updates/)
- Model Context Protocol specification (Tools feature), version 2026-07-28 (https://modelcontextprotocol.io/specification)

---
Entry from the WYP.agency AI glossary · https://wyp.agency/en/glossary/function-calling/ · Last updated : 2026-10-14