LLM Tool Calling and MCP (Model Context Protocol) Explained

Tool calling (also called function calling) lets an LLM ask your application to run a function, such as searching an index, looking up an order or creating a ticket, and then use the result. The Model Context Protocol (MCP) is an open standard for exposing tools, data and prompts to AI applications through a common client-server protocol, so one integration works across many agents and hosts. This guide covers how tool calls flow, how to design tool schemas, how to execute them safely, and where MCP fits.

How a tool call works

Designing tool schemas

{
  "name": "issue_refund",
  "description": "Refund all or part of a paid order. Only for orders delivered in the last 30 days. Amounts above 100 USD require human approval and return status 'pending_approval'.",
  "input_schema": {
    "type": "object",
    "required": ["order_id", "amount", "reason"],
    "properties": {
      "order_id": { "type": "string", "description": "Order id from get_order, e.g. '8812'" },
      "amount":   { "type": "number", "minimum": 0.01, "description": "USD, at most the order total" },
      "reason":   { "type": "string", "enum": ["damaged", "late", "wrong_item", "other"] }
    }
  }
}

• Descriptions are prompts: say when to use the tool, when not to, and what the limits are. Most tool misuse is a vague description.
• Narrow tools beat generic ones: get_order and issue_refund are safer and easier to evaluate than call_api(method, url, body).
• Typed, constrained arguments: enums, minimums, formats. Validate them again in code.
• Useful errors: return structured errors the model can act on ("order not found", "refund window expired") instead of stack traces.
• Small results: return the fields the model needs, paginated, not entire database rows.
• Keep the tool count manageable: dozens of overlapping tools confuse models; group them, or load relevant tools per task.

Executing tools safely

Parallel tool calls (several independent lookups in one turn) cut latency; make sure your runtime executes them concurrently and returns all results together.

The Model Context Protocol (MCP)

Without a standard, every AI application writes its own integration for every system (N apps × M tools). MCP defines a common protocol: MCP servers expose capabilities from a system (a database, a ticketing tool, a file store), and MCP clients inside AI applications (hosts such as chat apps, IDEs or your own agent) connect to them.

In a system design, MCP is an integration layer: it doesn't remove the need for authorisation, rate limiting, auditing or approvals. Remote MCP servers need authentication, per-user authorisation and the same least-privilege thinking as any API. Only connect servers you trust, since a malicious server's tool descriptions and results can carry injected instructions.

Function calling vs MCP vs plain APIs