What is tool calling?
Tool calling lets a language model ask your application to run a named function with arguments it chose, then read the result.
A sandbox is where the riskiest tool, "run this code", should execute: on Runtime each call runs in a Firecracker microVM with its own kernel, billed for the CPU it uses. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while the model is thinking between calls (pricing).
How it works
Anthropic and OpenAI describe the same round trip. You send the model a list
of tools, each with a name, a description and a JSON schema for its input. The
model answers with a structured call instead of text; in Anthropic's API that
is a tool_use block with stop_reason: "tool_use". Your code runs the
function and sends the output back, a tool_result in Anthropic's terms, and
the model either answers or calls another tool. OpenAI's guide names the same
five steps and says the cycle repeats until the model gives a final answer.
| Term | Meaning |
|---|---|
| Tool definition | Name, description and input schema the model reads |
| Tool call | The model's structured request: which tool, which arguments |
| Tool result | What your code returns, fed back to the model |
| Client tool | Runs in your application (Anthropic's term; includes bash and editors) |
| Server tool | Runs on the provider's infrastructure, such as web search |
| MCP | A standard way to publish tools so any compatible client can call them |
Where the code runs matters
A tool that fetches the weather is harmless. A tool that runs Python, a shell command or a test suite runs whatever the model wrote, and a prompt injection can decide what that is. Run it in your web server and it can read your environment and reach your network. Run it in a sandbox and it reaches only the sandbox.
A code tool backed by a sandbox
Your handler receives the model's arguments and runs them in a sandbox the conversation owns. The result is plain data to send back as the tool result.
TypeScriptimport { Sandbox } from "withruntime";// Handler for a tool the model calls as run_python({ code }).export async function runPython(sbx: Sandbox, code: string) { await sbx.files.write("/workspace/cell.py", code); const run = await sbx.exec(["python3", "cell.py"], { timeoutMs: 30_000 }); return { exitCode: run.exitCode, stdout: run.stdout, stderr: run.stderr, timedOut: run.timedOut };}await using sbx = await Sandbox.create({ network: { internet: false } });console.log(await runPython(sbx, "print(sum(range(10)))"));A timeout comes back as a result with timedOut: true and the output so far,
not an exception, so the model can read what happened and try again. Output is
capped at 64 KiB per stream unless the command streams
(run commands).
Tools that already exist
Runtime's MCP server publishes tools such as
runtime_sandbox_create, runtime_sandbox_exec and
runtime_sandbox_files_write, so an agent that speaks MCP can use sandboxes
with no handler code. Well-known MCP servers such as GitHub, Postgres and a
Playwright browser can also run inside a sandbox
(MCP servers in a sandbox).
Related
- What is an agent loop?
- What is the Model Context Protocol?
- What is a code interpreter?
- What is an idempotency key?
Sources
- Anthropic, Tool use with Claude, checked 25 September 2026
- OpenAI, Function calling, checked 25 September 2026
Facts on this page were checked on 25 September 2026.