An AI agent is just a language model running in a loop, allowed to use tools. Instead of answering straight away, it can say “call the exchange-rate tool with USD→INR”, read the result, and continue.
How tool calling works
- You describe your tools to the model: name, what it does, and its inputs (usually as a JSON schema).
- The model replies either with normal text or with a structured request:
{"name": "get_rate", "arguments": {"from": "USD", "to": "INR"}}. - Your code runs the tool and sends the result back as a message.
- Repeat until the model gives a final answer.
The model never runs anything itself — your program decides what actually executes. That is the key safety point.
The loop in Python (illustrative)
“`python
def get_rate(frm, to):
return {“USD->INR”: 83.2}.get(f”{frm}->{to}”) # call a real API here
TOOLS = {“get_rate”: get_rate}
messages = [{“role”: “user”, “content”: “How much is 250 USD in rupees?”}]
for _ in range(5): # hard limit on steps
reply = llm_chat(messages, tools=TOOL_SCHEMAS) # your provider’s chat API
messages.append(reply)
call = reply.get(“tool_call”)
if not call:
print(reply[“content”])
break
result = TOOLS[call[“name”]](**call[“arguments”])
messages.append({“role”: “tool”, “name”: call[“name”], “content”: str(result)})
“`
Every major API (OpenAI, Anthropic, Google, and local runners like Ollama) supports this pattern; only the field names differ.
Rules for safe agents
- Least privilege: read-only tools unless writing is truly needed.
- Human approval for anything that sends, pays, deletes or publishes.
- Step limits so a confused agent cannot loop forever.
- Treat tool results as data: a web page saying “ignore your instructions” must not be obeyed. This attack is called prompt injection.