Tools & MCP
How agents call the outside world — and how MCP standardizes that interface.
By the end of this lesson, explain tool calling and how the Model Context Protocol makes tools interoperable.
A model can only produce text. Tools are how that text turns into action: the model emits a structured request to call a function, the runtime executes it against a real system (a search, a database, an API), and feeds the result back. Everything an agent *does* — as opposed to says — goes through a tool.
First, see the whole system. Then we’ll open it up.
Tool call round-trip
- The model emits a structured tool call; the runtime invokes the real tool/API and returns the result as an observation the model can use.
flowchart LR model[Model] -->|structured tool call| runtime[Runtime] runtime -->|invoke| tool[Tool / API] tool -->|result| runtime runtime -->|observation| model
Each tool is described by a schema (name, purpose, parameters) that goes into the model's context so it knows what's available and how to call it. The Model Context Protocol (MCP) standardizes this: an MCP server exposes tools, resources, and prompts over a common protocol, so any MCP-aware client can use them without bespoke integration — the way a common API contract decouples services.
This is where the abstraction starts leaking.
Every tool schema you expose is spent context — and attack surface. The model can only reliably choose among a modest set of well-described tools; flood it with hundreds and selection degrades. Tool schemas are also a token tax on every single request, whether or not they're used.
Over-permissioned tool
- Trigger
- An agent is given a tool with broad authority and no per-call authorization.
- Symptom
- A hallucinated or manipulated tool call performs a damaging real-world action.
- Blast radius
- Whatever the tool can reach — data, money, infrastructure.
- Mitigation
- Least-privilege tools, per-call authorization, human confirmation for high-impact actions, audit logs.
Deep dive: Privilege Escalation
Powerful tools make an agent more capable but widen blast radius and attack surface; narrow, read-only tools are safer but limit what the agent can accomplish. Tool design is fundamentally an authority-scoping decision.
What problem does MCP solve for tools?
Interoperability — it standardizes how tools/resources are exposed so any MCP-aware agent can use them without a custom integration per tool.