AI Agents and Tool Calling Explained (With a 20-Line Example)

📎 This article includes 1 downloadable practice file ↓

An AI agent is just a language model running in a loop, allowed to use tools. Instead of answering straight away, it can say “call the exchange-rate tool with USD→INR”, read the result, and continue.

How tool calling works

1. You describe your tools to the model: name, what it does, and its inputs (usually as a JSON schema).
2. The model replies either with normal text or with a structured request: {"name": "get_rate", "arguments": {"from": "USD", "to": "INR"}}.
3. Your code runs the tool and sends the result back as a message.
4. Repeat until the model gives a final answer.

The model never runs anything itself — your program decides what actually executes. That is the key safety point.

The loop in Python (illustrative)

def get_rate(frm, to):
    return {"USD->INR": 83.2}.get(f"{frm}->{to}")    # call a real API here

TOOLS = {"get_rate": get_rate}
messages = [{"role": "user", "content": "How much is 250 USD in rupees?"}]

for _ in range(5):                                  # hard limit on steps
    reply = llm_chat(messages, tools=TOOL_SCHEMAS)  # your provider's chat API
    messages.append(reply)
    call = reply.get("tool_call")
    if not call:
        print(reply["content"])
        break
    result = TOOLS[call["name"]](**call["arguments"])
    messages.append({"role": "tool", "name": call["name"], "content": str(result)})

Every major API (OpenAI, Anthropic, Google, and local runners like Ollama) supports this pattern; only the field names differ.

Rules for safe agents

• Least privilege: read-only tools unless writing is truly needed.
• Human approval for anything that sends, pays, deletes or publishes.
• Step limits so a confused agent cannot loop forever.
• Treat tool results as data: a web page saying “ignore your instructions” must not be obeyed. This attack is called prompt injection.