Tool-Using Agents Explained

Tools are functions that agents can invoke to interact with the world outside the LLM.

Tool components:

• Name: Identifier the agent uses to call it
• Description: What the tool does (helps LLM decide when to use it)
• Parameters: What inputs the tool needs
• Return value: What information comes back

Example tool definition:

• Name: search_orders
• Description: "Search customer orders by customer ID, date range, or status"
• Parameters: customer_id (optional), start_date (optional), end_date (optional), status (optional)
• Returns: List of matching orders with details

How the agent uses it:

1. LLM decides this tool is needed
2. LLM generates the parameters
3. Orchestration layer calls the actual function
4. Results are passed back to LLM
5. LLM reasons about results and continues

Common categories of agent tools:

Information retrieval:

• Database queries
• API calls to external services
• Web search
• Document retrieval (RAG)
• File reading

Actions/Mutations:

• Create/update/delete records
• Send emails or messages
• Trigger workflows
• Make purchases
• Update external systems

Computation:

• Code execution
• Data transformation
• Mathematical calculations
• File processing

Browser/UI:

• Navigate websites
• Fill forms
• Extract page content
• Take screenshots

Communication:

• Send notifications
• Post to Slack/Teams
• Create tickets
• Schedule meetings

The right tool set depends entirely on what your agent needs to accomplish.

Well-designed tools make agents more reliable:

Clear, specific descriptions: Bad: "Gets customer data" Good: "Retrieves customer profile including name, email, subscription status, and last login date. Requires customer_id."

Appropriate granularity:

• Too broad: "do_everything(request)" - LLM can't reason about it
• Too narrow: Hundreds of tiny tools overwhelm the LLM
• Just right: Coherent operations that make sense as units

Structured outputs: Return structured data (JSON) rather than prose. LLMs parse structure better than unstructured text.

Error handling: Return clear error messages that help the LLM recover:

• "Customer not found" vs. silent failure
• "Rate limited, retry in 60 seconds" vs. generic error
• Include what went wrong and what to try next

Idempotency where possible: Tools that can be safely retried if something fails mid-execution.

How agents decide which tools to use:

Tool selection by the LLM: The LLM sees available tools (names + descriptions) and decides:

• Which tool(s) to call
• What parameters to use
• In what order

Function calling: Modern LLMs have native function calling:

• Structured output format for tool calls
• Better than parsing from free-form text
• Reduces tool call errors significantly

Parallel vs. sequential:

• Some tasks benefit from calling multiple tools in parallel
• Others require sequential (result of A needed for B)
• Agent or orchestration layer decides

Tool execution flow:

1. LLM outputs tool call intent
2. Orchestration validates parameters
3. Tool function is executed
4. Results are formatted for LLM
5. LLM receives results and continues

Common failure modes:

• Wrong tool selected (improve descriptions)
• Bad parameters (add validation)
• Tool execution fails (handle errors gracefully)
• Results misinterpreted (structure outputs clearly)

The Model Context Protocol (MCP) and tool standardization:

What is MCP? Anthropic's open protocol for connecting LLMs to external tools and data sources. Standardizes how agents discover and use tools.

MCP benefits:

• Consistent interface across tools
• Tool discovery and documentation
• Reusable tool implementations
• Growing ecosystem of pre-built servers

Building your own tools: When to build custom:

• Internal APIs and databases
• Proprietary business logic
• Specific workflow requirements

When to use existing:

• Common services (Slack, GitHub, Google)
• Standard operations (web search, file handling)
• MCP servers already exist

Tool security:

• Validate all inputs before execution
• Scope permissions appropriately
• Log all tool calls for audit
• Rate limit to prevent abuse
• Sandbox dangerous operations (code execution)