# What is tool calling?

Tool calling lets a language model ask your application to run a named
function with arguments the model chose. The model then reads the result.

**A sandbox is where the riskiest tool, "run this code", should run. On Runtime,
each call runs in a Firecracker microVM with its own kernel. You pay only for
the CPU it uses.** A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while
the model thinks between calls ([pricing](/docs/pricing)).

## How it works

Anthropic and OpenAI describe the same round trip. You send the model a list
of tools. Each tool has a name, a description and a JSON schema for its input.
The model responds with a structured call instead of text. In Anthropic's API,
that call is a `tool_use` block with `stop_reason: "tool_use"`. Your code runs
the function and sends the output back as a `tool_result`, in Anthropic's terms.
The model then either gives a final answer or calls another tool. OpenAI's guide
names the same five steps, ending in "a final response from the model (or more
tool calls)". It says an application can continue the flow for as many tool
calls as the task requires.

| Term            | Meaning                                                                  |
| --------------- | ------------------------------------------------------------------------ |
| Tool definition | Name, description and input schema the model reads                       |
| Tool call       | The model's structured request: which tool, which arguments              |
| Tool result     | What your code returns, fed back to the model                            |
| Client tool     | Runs in your application (Anthropic's term; includes `bash` and editors) |
| Server tool     | Runs on the provider's infrastructure, such as web search                |
| MCP             | A standard way to publish tools so any compatible client can call them   |

## Where the code runs matters

A tool that fetches the weather is harmless. A tool that runs Python, a shell
command or a test suite runs whatever the model wrote. A
[prompt injection](/glossary/prompt-injection) can decide what that is. If you
run it in your web server, it can read your environment and reach your network.
If you run it in a sandbox, it reaches only the sandbox.

## A code tool backed by a sandbox

Your handler receives the model's arguments and runs them in a sandbox that the
conversation owns. The handler returns plain data, which you send back as the
tool result.

```ts
import { Sandbox } from "withruntime";

// Handler for a tool the model calls as run_python({ code }).
export async function runPython(sbx: Sandbox, code: string) {
  await sbx.files.write("/workspace/cell.py", code);
  const run = await sbx.exec(["python3", "cell.py"], { timeoutMs: 30_000 });
  return { exitCode: run.exitCode, stdout: run.stdout, stderr: run.stderr, timedOut: run.timedOut };
}

await using sbx = await Sandbox.create({ network: { internet: false } });
console.log(await runPython(sbx, "print(sum(range(10)))"));
```

A timeout returns a result with `timedOut: true` and the output so far. It does
not throw an exception. The model can then read what happened and try again.
Output is capped at 64 KiB per stream, unless the command streams its output
([run commands](/docs/javascript#run-commands)).

## Tools that already exist

Runtime's [MCP server](/docs/mcp) publishes tools such as
`runtime_sandboxes_create`, `runtime_sandboxes_exec` and
`runtime_sandboxes_files_write`. An agent that speaks MCP can use sandboxes with
no handler code. Well-known MCP servers, such as GitHub, Postgres and a
Playwright browser, can also run inside a sandbox
([MCP servers in a sandbox](/docs/javascript#mcp-servers-in-a-sandbox)).

## Related

- [What is an agent loop?](/glossary/agent-loop)
- [What is the Model Context Protocol?](/glossary/model-context-protocol)
- [What is a code interpreter?](/glossary/code-interpreter)
- [What is an idempotency key?](/glossary/idempotency-key)

## Sources

- [Anthropic, Tool use with Claude](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview), checked 25 October 2026
- [OpenAI, Function calling](https://developers.openai.com/api/docs/guides/function-calling), checked 25 October 2026

Facts on this page were checked on 25 October 2026.