Tool use, agents and MCP

In short: A language model can only output text. With tool use (function calling) it can instead output a structured call that a program executes, and read the result again. An agent repeats this in a loop until the task is done.

In more detail: The model executes nothing itself. The surrounding program (“harness”) offers tools (search, read file, run code, database), carries out the calls the model asks for and returns the results.

In detail

• Flow: tool descriptions (name, parameters as JSON schema) → model writes { "tool": "search", "args": {…} } → program executes → result back as a message → model answers or calls the next tool.
• Agent loop: plan → call tool → read result → continue until done or a limit is reached.
• MCP (Model Context Protocol): open standard through which applications provide tools, data and prompts to models in a uniform way. An MCP server can be used by many programs.
• Typical tools: web search, code execution, file system, browser, calendar, email.
• Memory: additionally notes and files, since the model otherwise has only the context.
• Risks: an agent with permissions can do damage (delete data). Limit permissions, require confirmation for important steps. Prompt injection is the main danger.
• Structured output: enforce the answer format via JSON schema.

See also: Retrieval-augmented generation (RAG), Prompt injection