Tool calling, also called function calling, is how a model asks for an action instead of describing one. The host gives the model a list of tools with names, descriptions, and JSON schemas for their arguments. When the model decides a tool is needed, it returns a structured call rather than prose. The host validates the arguments, runs the function, and sends the result back into the conversation.
The model does not execute anything. That distinction is the security boundary: the host decides whether the call is allowed, whether the arguments are valid, and whether the result is safe to pass back. A tool call is a proposal, not an effect.
Tool descriptions are instructions the model will follow, so they are also an injection channel. Validate arguments against a schema and an allowlist, require confirmation for irreversible actions, and log the calls with their arguments. See prompt injection and MCP server.