Also called function calling, this is the boundary where a model stops describing and starts doing. The model never executes anything itself; it emits a structured request that your code chooses to run. That indirection is the entire security model, and it is why enforcement belongs in the tool layer rather than in the prompt — a spend cap checked server-side holds even when the model is wrong or has been manipulated.
Tool quality drives agent quality more than model choice does. Loosely typed tools with vague descriptions are the most common cause of behaviour that gets blamed on model hallucination; usually the model was guessing at an ambiguous interface. Strict schemas, predictable errors and descriptions that state when to call the tool — not just what it does — produce markedly more reliable agents.
Codazz builds this in production — MCP & Tool Integration.