# Tool use & protocols (MCP)

URL: https://justuju.org/concept/tool-use/
Layer 7 · Orchestration & Tooling

Letting a model call functions and services through structured requests, standardised by protocols such as MCP.

## D1 · Story

On its own an AI can only talk. Giving it tools is like giving it a phone and a calculator: now it can check the weather or do exact maths.
It asks in a special format, and a program does the actual work.
1. The AI asks: in a special format
2. A program does it: checks the weather, does exact sums
3. The result: goes back to the AI
4. The AI answers: using the result
Like: Handing someone a phone and a calculator.

## D2 · Picture

Developers describe each tool with a name, a description and a schema for its arguments.
When a tool would help, the model outputs a structured tool call instead of prose; the application runs the tool and returns the result to the model.
Protocols such as the Model Context Protocol (MCP) standardise how tools and data sources are offered to AI applications, so one integration works across many clients.
1. Tool list: names + schemas
2. Tool call: structured request
3. Execute: by the application
4. Result: back into context
5. Continue: model answers
Like: Handing someone a phone and a calculator. Where it breaks: A person decides whether to believe what they hear on the phone. Models tend to treat tool results as trustworthy, so malicious text inside a result can steer them (prompt injection).

## D5 · Frontier

A tool call looks like a function call, but the model picks tools by reading their descriptions in plain language, and those descriptions are an attack surface.
Tool poisoning. Hidden instructions in a tool's description reach the model but not the user, and a server can change a description after it was approved, a "rug pull" (Invariant Labs, 2025).
The protocol can't enforce safety. The MCP specification says tool descriptions should be treated as untrusted and that the protocol itself cannot enforce its security principles; consent and access control are left to each host (MCP spec).
Over-broad permissions. A tool with more access than the task needs turns any successful injection into real damage (OWASP LLM06).
Choosing among many tools. Picking the right tool and arguments, especially over many turns, is still measured on leaderboards rather than solved (BFCL).

## Examples as of 2026-10-30

- Model Context Protocol (MCP)
- Function calling in the major model APIs
- Agent2Agent protocol (A2A)
- MCP servers for GitHub, Slack and databases

## Sources

- Toolformer: Language Models Can Teach Themselves to Use Tools: https://arxiv.org/abs/2302.04761
- Model Context Protocol specification: https://modelcontextprotocol.io/specification/2026-07-28/
- MCP Security Notification: Tool Poisoning Attacks (Invariant Labs): https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
- OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- Berkeley Function Calling Leaderboard (BFCL): https://gorilla.cs.berkeley.edu/leaderboard.html


---
Justuju · https://justuju.org/ · Content CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote with a link to the page.