# What is tool calling?

Tool calling lets a language model ask your application to run a named function with arguments it chose, then read the result.

**A sandbox is where the riskiest tool, "run this code", should execute: on
Runtime each call runs in a Firecracker microVM with its own kernel, billed
for the CPU it uses.** A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while
the model is thinking between calls ([pricing](/docs/pricing)).

## How it works

Anthropic and OpenAI describe the same round trip. You send the model a list
of tools, each with a name, a description and a JSON schema for its input. The
model answers with a structured call instead of text; in Anthropic's API that
is a `tool_use` block with `stop_reason: "tool_use"`. Your code runs the
function and sends the output back, a `tool_result` in Anthropic's terms, and
the model either answers or calls another tool. OpenAI's guide names the same
five steps and says the cycle repeats until the model gives a final answer.

| Term            | Meaning                                                                  |
| --------------- | ------------------------------------------------------------------------ |
| Tool definition | Name, description and input schema the model reads                       |
| Tool call       | The model's structured request: which tool, which arguments              |
| Tool result     | What your code returns, fed back to the model                            |
| Client tool     | Runs in your application (Anthropic's term; includes `bash` and editors) |
| Server tool     | Runs on the provider's infrastructure, such as web search                |
| MCP             | A standard way to publish tools so any compatible client can call them   |

## Where the code runs matters

A tool that fetches the weather is harmless. A tool that runs Python, a shell
command or a test suite runs whatever the model wrote, and a
[prompt injection](/glossary/prompt-injection) can decide what that is. Run it
in your web server and it can read your environment and reach your network.
Run it in a sandbox and it reaches only the sandbox.

## A code tool backed by a sandbox

Your handler receives the model's arguments and runs them in a sandbox the
conversation owns. The result is plain data to send back as the tool result.

```ts
import { Sandbox } from "withruntime";

// Handler for a tool the model calls as run_python({ code }).
export async function runPython(sbx: Sandbox, code: string) {
  await sbx.files.write("/workspace/cell.py", code);
  const run = await sbx.exec(["python3", "cell.py"], { timeoutMs: 30_000 });
  return { exitCode: run.exitCode, stdout: run.stdout, stderr: run.stderr, timedOut: run.timedOut };
}

await using sbx = await Sandbox.create({ network: { internet: false } });
console.log(await runPython(sbx, "print(sum(range(10)))"));
```

A timeout comes back as a result with `timedOut: true` and the output so far,
not an exception, so the model can read what happened and try again. Output is
capped at 64 KiB per stream unless the command streams
([run commands](/docs/javascript#run-commands)).

## Tools that already exist

Runtime's [MCP server](/docs/mcp) publishes tools such as
`runtime_sandbox_create`, `runtime_sandbox_exec` and
`runtime_sandbox_files_write`, so an agent that speaks MCP can use sandboxes
with no handler code. Well-known MCP servers such as GitHub, Postgres and a
Playwright browser can also run inside a sandbox
([MCP servers in a sandbox](/docs/javascript#mcp-servers-in-a-sandbox)).

## Related

- [What is an agent loop?](/glossary/agent-loop)
- [What is the Model Context Protocol?](/glossary/model-context-protocol)
- [What is a code interpreter?](/glossary/code-interpreter)
- [What is an idempotency key?](/glossary/idempotency-key)

## Sources

- [Anthropic, Tool use with Claude](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview), checked 25 September 2026
- [OpenAI, Function calling](https://developers.openai.com/api/docs/guides/function-calling), checked 25 September 2026

Facts on this page were checked on 25 September 2026.