Tools are what make an agent act

An LLM on its own can only produce text. A tool is a function you expose to the model — search the web, run a calculation, query a database, send an email, call an API — that lets it do something and get real information back. Tools are the difference between an agent that talks about booking a flight and one that books it.

How the model "calls" a tool

The model can't actually run code; it requests a call and your program executes it. The flow:

1. You give the model a list of tools, each with a name, a description, and a schema of its inputs.
2. When the model decides a tool is needed, it outputs a structured request — the tool name and arguments, usually as JSON.
3. Your code runs the real function and feeds the result back into the conversation.
4. The model reads that result and continues.

This is called function calling, and it's the backbone of every agent.

Good tool design

Agents live or die on tool quality:

• Describe tools clearly. The description is a prompt — "search_orders(customer_id): returns this customer's recent orders" beats a terse name. The model picks tools based on these words.
• Keep them focused. Many small, single-purpose tools beat one giant do-everything tool.
• Validate inputs and handle errors. Return a clear error message the model can read and recover from, not a crash.
• Return concise results. Dumping a huge payload wastes context; return only what the model needs.

The security catch

Every tool is also an attack surface. A tool that can delete data can be tricked into deleting data. Give each tool the least privilege it needs, and require approval for anything irreversible (more on this in Guardrails).

A tool description is really a prompt, and a tool itself is a permission. Write the description as if explaining to a new hire, and grant the permission as stingily as you'd grant a stranger's.

Try this: Pick a task you'd want an agent to do and list the tools it would need, writing a one-line description for each. You'll quickly notice that the descriptions — not the code — are what determine whether the agent uses them correctly.