“Tool use” is what turns an LLM from a text generator into something that can genuinely take real action in the world — searching the web, running code, calling an API — worth understanding the actual mechanism underneath it.
tools = [
{
"name": "get_weather",
"description": "Get current weather for a location",
"parameters": {"location": "string"}
}
]
response = model.generate(
prompt="What's the weather in Berlin?",
available_tools=tools
)
# The model doesn't call the function directly - it outputs a
# STRUCTURED REQUEST describing what it wants to call:
# { "tool": "get_weather", "arguments": {"location": "Berlin"} }
if response.wants_tool_call:
result = execute_actual_function(response.tool_name, response.tool_arguments)
# Feed the REAL result back to the model so it can incorporate it into a final answer
final_response = model.generate(prompt_with_tool_result(result))
The Key Insight: The Model Never Actually Executes Anything
The model itself has no ability to genuinely execute code, browse the web, or call an API directly — it’s trained to recognize when a tool would help and to output a correctly structured request describing exactly which tool to call and with what arguments. Your application code is what actually receives that structured request, executes the real underlying function, and feeds the genuine result back into the conversation for the model to use.
Why This Design Matters for Safety
Because the model can only request a tool call rather than execute one directly and autonomously, your application retains full, explicit control over what actually happens — you can validate, rate-limit, or outright reject a requested tool call before ever actually executing it, which is exactly the guardrail that makes tool-using AI agents genuinely safe to deploy for real, consequential actions.