Agents and tools

A model that can act

A language model only writes text. It cannot open a file or search the web by itself, and its math is not reliable. An agent is a program wrapped around the model that gives it tools and runs a loop.

The program sends the conversation and a list of tools to the model. If the model answers with a tool call, the program runs the tool, adds the result to the conversation and asks the model again. When the model answers with plain text, the loop ends and the user gets the answer.

On this page the model replies are written in advance, because no real model runs in your browser. The tools are real, though, and every tool result you see is computed when you get there. The one exception is a made-up web page in the prompt injection example.

Try it. Press play and follow the loop.

Tools are described in words

The model never sees the code of a tool. It sees a name, a short description and a schema of the arguments, sent as text with every request. From that alone it decides when a tool fits and how to fill in the arguments.

So a tool is only as good as its description. A vague one gets called at the wrong time or with the wrong values. Every tool description also costs tokens on every single request.

Try it. Look at the four tools this agent has and their sizes in tokens.

A tool call is just text

When the model wants a tool, it writes a small block of JSON with the tool name and the arguments. The program checks it, runs the tool and sends back the result, or an error message if something was wrong. The model reads the error and can try again.

The program is in charge here, not the model. It decides which calls are allowed, which need a human to confirm and how many steps the loop may take.

Try it. Edit the call and run it. Break the JSON on purpose and see the error the model would get.

Plan, act, look, repeat

A real task takes several rounds. The model looks something up, works with the result, maybe calls another tool, and only then writes the answer. Each round adds the call and the result to the conversation, so the context grows with every step.

The task here needs a fact from a handbook, a unit conversion and some arithmetic. No single tool could do it, and the model alone would have to guess the battery size.

Try it. Step through the task and watch the token count grow.

When agents go wrong

Agents fail in a few typical ways. A tool call has a typo. The model keeps searching for something that is not there. Or a tool brings back text that contains instructions, such as a web page that says to ignore all previous orders. This last one is called prompt injection, and it is the best known security risk of agents.

The defences sit in the program around the model. Error messages that say what to fix, a hard limit on steps, treating every tool result as data and never as orders, and asking a human before anything that spends money, sends a message or deletes data.

Try it. Play the three cases.

One plug for every tool

Every agent app used to wire up its tools in its own way. The Model Context Protocol (MCP), published by Anthropic in late 2024, makes it a standard. A tool provider writes an MCP server once, and any app that speaks MCP can connect it and list its tools.

More servers mean more abilities, and also longer tool lists in every request. Good agents connect only what the task needs.

Loop

Model, tool call, tool result, model again, until a plain answer

Tool call

JSON with a name and arguments, run by the program

Main risk

Prompt injection through tool results

Standard

Model Context Protocol (MCP)