Tool use & protocols (MCP)

D1 · StoryFor young children and total beginners

Think first: what can't you do by talking alone?

On its own an AI can only talk. Giving it tools is like giving it a phone and a calculator: now it can check the weather or do exact maths.

It asks in a special format, and a program does the actual work.

The AI asks, a program does the work

1. The AI asks: in a special format
2. A program does it: checks the weather, does exact sums
3. The result: goes back to the AI
4. The AI answers: using the result

Like: Handing someone a phone and a calculator.

D2 · PictureFor curious beginners

Developers describe each tool with a name, a description and a schema for its arguments.

When a tool would help, the model outputs a structured tool call instead of prose; the application runs the tool and returns the result to the model.

Protocols such as the Model Context Protocol (MCP) standardise how tools and data sources are offered to AI applications, so one integration works across many clients.

One tool call

1. Tool list: names + schemas
2. Tool call: structured request
3. Execute: by the application
4. Result: back into context
5. Continue: model answers

Like: Handing someone a phone and a calculator.
Where it breaks: A person decides whether to believe what they hear on the phone. Models tend to treat tool results as trustworthy, so malicious text inside a result can steer them (prompt injection).

D5 · FrontierFor experts

A tool call looks like a function call, but the model picks tools by reading their descriptions in plain language, and those descriptions are an attack surface.

Tool poisoning. Hidden instructions in a tool's description reach the model but not the user, and a server can change a description after it was approved, a "rug pull" (Invariant Labs, 2025).

The protocol can't enforce safety. The MCP specification says tool descriptions should be treated as untrusted and that the protocol itself cannot enforce its security principles; consent and access control are left to each host (MCP spec).

Over-broad permissions. A tool with more access than the task needs turns any successful injection into real damage (OWASP LLM06).

Choosing among many tools. Picking the right tool and arguments, especially over many turns, is still measured on leaderboards rather than solved (BFCL).

Examples as of 2026-10-30

• Model Context Protocol (MCP)
• Function calling in the major model APIs
• Agent2Agent protocol (A2A)
• MCP servers for GitHub, Slack and databases

Sources

1. Toolformer: Language Models Can Teach Themselves to Use Tools (2023)
2. Model Context Protocol specification (2026-07-28)
3. MCP Security Notification: Tool Poisoning Attacks (Invariant Labs) (2025-04-01)
4. OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency (2025)
5. Berkeley Function Calling Leaderboard (BFCL) (ongoing)

How it connects

• Tool use & protocols (MCP) gives actions to The agent loop.
• Model APIs & routers exposes function calling for Tool use & protocols (MCP).
• Tool use & protocols (MCP) returns results into Context engineering.
• Guardrails & evals screens and gates Tool use & protocols (MCP).

More in Layer 7 · Orchestration & Tooling

• Retrieval-augmented generation (RAG)
  Look up relevant documents first, then give them to the model to answer from.
• Memory
  How an AI application remembers beyond one call: short-term memory in the context window, long-term memory in stores it saves to and searches.
• Context engineering
  Choosing what goes into the model's context window, in what order, and what to leave out, because the model sees nothing else.
• Guardrails & evals
  Checks around model calls (input and output filters, permission gates, prompt-injection defences) plus automated tests that measure whether the system still behaves.