Tools & MCP
Learn how tools expand AI capabilities beyond text. Covers function calling, Model Context Protocol (MCP), building custom tools, and formatting tool output for optimal AI understanding.
Tools as Context Sources
Tools are the mechanism by which AI models interact with the outside world. When an AI model uses a tool, the tool's output becomes part of the context — providing real-time data, computation results, or actions that the model could not access from its training data alone.
Function Calling / Tool Use
Function calling (also called tool use) is the API mechanism that lets AI models request specific actions. The model does not execute the function — it requests that your code execute it and return the results.
import anthropic client = anthropic.Anthropic() # Define available tools tools = [{ "name": "get_weather", "description": "Get current weather for a city", "input_schema": { "type": "object", "properties": { "city": { "type": "string", "description": "City name" } }, "required": ["city"] } }] # Model decides to call the tool response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=1024, tools=tools, messages=[{ "role": "user", "content": "What's the weather in Tokyo?" }] ) # Execute the tool and return results # The tool output becomes new context
MCP (Model Context Protocol)
The Model Context Protocol (MCP) is an open standard created by Anthropic that provides a universal way to connect AI models with external data sources and tools. Think of MCP as a "USB-C for AI" — a standardized interface that any tool can implement and any AI client can use.
How MCP Works
MCP Servers
Each data source or tool runs as an MCP server. Servers expose capabilities: tools (actions), resources (data), and prompts (templates).
MCP Clients
AI applications (Claude Desktop, IDE extensions, custom apps) connect to MCP servers as clients.
Protocol
Clients and servers communicate using JSON-RPC over stdio or HTTP. The protocol handles discovery, invocation, and response formatting.
from mcp.server import Server from mcp.types import Tool, TextContent app = Server("my-tools") @app.list_tools() async def list_tools(): return [ Tool( name="lookup_customer", description="Look up customer by email", inputSchema={ "type": "object", "properties": { "email": {"type": "string"} }, "required": ["email"] } ) ] @app.call_tool() async def call_tool(name, arguments): if name == "lookup_customer": customer = await db_lookup( arguments["email"] ) return [TextContent( type="text", text=format_customer(customer) )]
Types of Tools
Data Retrieval
Web search, database queries, API calls, file reading. Bring external information into the AI's context.
Computation
Code execution, mathematical calculations, data transformations. Perform operations the model cannot do reliably.
Actions
Send emails, create tickets, update databases, deploy code. Let the AI take actions in external systems.
Verification
Fact-checking, code linting, URL validation. Verify the model's outputs before presenting them.
Tool Output Formatting
How you format tool output affects how well the AI model can understand and use it. Follow these guidelines:
// BAD: Raw data dump {"id":123,"name":"John","created":"2024-01-15T10:30:00Z", "orders":[{"id":456,"total":99.99,"items":[...]},...]," address":{"street":"123 Main St",...},...} // GOOD: Structured, relevant, labeled Customer: John Smith (ID: 123) Account since: January 2024 Status: Active, Premium tier Recent Orders (last 3): 1. Order #456 - $99.99 - Delivered Jan 20 2. Order #457 - $149.50 - In transit 3. Order #458 - $29.99 - Processing Shipping Address: 123 Main St, Portland, OR
Building Custom Tools
When building custom tools for AI systems, follow these design principles:
- Single responsibility: Each tool should do one thing well. Prefer many focused tools over few complex ones.
- Clear descriptions: Write tool descriptions that help the model understand when and how to use each tool.
- Meaningful errors: Return clear error messages that help the model recover or inform the user.
- Bounded scope: Limit what each tool can access. Apply the principle of least privilege.
- Idempotent when possible: Read operations should be safe to retry. Write operations should handle duplicates gracefully.
Lilly Tech Systems