What is function calling?
Function calling is the mechanism by which a language model asks an application to run a piece of code on its behalf. The developer sends the model a list of functions it may use, each with a name, a description, and a schema for its parameters. When the model decides a function is needed, it emits a structured call, the function name and a JSON object of arguments, instead of prose. The application runs the function, perhaps a database query or an API request, and feeds the result back into the conversation so the model can continue.
The model never executes anything itself. It only proposes. That separation is what makes function calling safe to build on: the application decides whether to honor the request, with what credentials, and whether to ask a person first. Function calling is the building block beneath the broader idea of tool use, and the Model Context Protocol standardizes how tools are described and connected.
Why function calling matters
Function calling is how a model gets past the limits of its training data and acts on current information. It can look up current inventory, check a customer’s order status, create a ticket, or schedule a job. It also connects the model to deterministic code for things models do poorly, such as exact arithmetic or date math. For a business this is the step where an assistant becomes an agent, and where access control, audit logs, and approval workflows become mandatory.
Function calling in practice
A managed service provider runs a help desk assistant for its clients. Its functions include looking up a ticket, searching the knowledge base, checking a device’s last check-in, and resetting a password. The first three are read-only and run automatically. The password reset is a write action that changes a system of record, so the assistant’s call is held until a technician approves it, and the approval and the result are both logged against the ticket. FlatClaw, the open-source private AI platform from Kirk Tech Solutions, is built around this pattern, with each function governed by its own permission and an approval step for writes.
What to watch for
- Models sometimes call a function with wrong or invented arguments, so validate every parameter before execution.
- Give the model only the functions the current user is allowed to use, and run them with that user’s permissions rather than a shared service account.
- Function descriptions are part of the prompt, and vague or overlapping descriptions cause the model to pick the wrong tool.
- Function results flow back into the model’s context, which makes them a path for prompt injection if they contain untrusted text.