A model writes the order, a program cooks it

A language model generates text. When it “uses” a tool, it generates a request: the tool’s name and the inputs to pass to it. CMU’s agents course summarizes this relationship: “The model proposes; external software decides whether and how to execute”².

Google’s guide for Gemini function calling agrees: “The model doesn’t execute the function itself”³. Anthropic’s guide states that Claude “returns a structured call that your application executes (client tools) or that Anthropic executes (server tools)”⁴. In both cases, a program runs the tool.

Stanford’s course outlines a tool call in four steps: select a tool from the schemas in the context, fill in the typed arguments from the task, validate those arguments, and then execute the tool. The result then returns to the context⁵. The model performs the first two steps. Software handles the last two. We call this software the harness: it’s the program surrounding the model that reads its requests, determines what actually happens, and feeds the results back.

Why do we emphasize this distinction? Because safety and reliability reside on the harness side. Writing never delete the database into the prompt adds more text; it does not add a security lock. Claude Code’s documentation states this explicitly: “Permission rules are enforced by Claude Code, not by the model”¹.

Once the model only writes requests, a tool is no longer a single thing. It becomes four questions. Each question is answered by a different part of the system. We sort them this way; it is not an industry standard.

1. What does the model see? This is the contract. For a Claude tool, the contract includes a name, a description “of what the tool does, when it should be used, and how it behaves”, and an input_schema, “A JSON Schema object defining the expected parameters for the tool”⁶. Anthropic describes tools as “a contract between deterministic systems and non-deterministic agents”⁷. The model only knows a tool through this contract. Chapters 2 and 3 will explain this in detail.

2. Who says yes, and who runs it? This is the harness, which is code. Claude Code checks its rules in a fixed order: “deny, then ask, then allow”¹. And “Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don’t change what Claude Code allows”¹. Chapter 6 focuses on this question.

3. How is the tool plugged in? The packaging. The same capability can arrive as an MCP server, where a host application “establishes connections to one or more MCP servers”⁸; as a skill, which is “a directory containing, at minimum, a SKILL.md file”⁹; or as a command the model runs through one general tool. The Claude Code team frames the choice this way: “Do you give it one general-purpose tool like bash or code execution? Or fifty specialized tools, one for each use case?”¹⁰ Chapter 4 compares five ways to hand a tool over.

4. Who controls it across a company? This is the gateway and the admin console. In ChatGPT’s workspace controls, “Role access controls who can use an app. Actions controls what the app can do. Permissions controls when ChatGPT asks before using an app”¹¹. Sierra routes its agents through one company gateway. By its own account, 89% of its employees use this gateway to connect agents to 45 services¹². Chapter 7 covers this layer.

Each owner can fail independently. A clear contract cannot protect you if a harness is set to approve everything. A careful harness cannot vouch for a server that nobody reviewed.

Calling code that lives somewhere else is not new. In 1984, Birrell and Nelson published their remote procedure call package and stated its guarantee: if a call returns, the procedure ran exactly once; otherwise “the procedure will have been invoked either once or not at all—the user is not told which”¹³. CORBA 1.0 followed in October 1991 with an Interface Definition Language and an Interface Repository¹⁴. In 2000, SOAP defined “a convention for representing remote procedure calls and responses”¹⁵, and Fielding’s dissertation defined REST¹⁶. In 2016, the Language Server Protocol let a language server “be implemented once and have different tools take advantage of it”¹⁷. In 2017, OpenAPI 3.0 described HTTP APIs so that “both humans and computers” can “discover and understand the capabilities of a service without requiring access to source code”¹⁸.

In all these cases, a program was the caller. Research systems began handing the call to a model in 2022¹⁹, and in 2023 it became an API. On June 13, 2023, OpenAI let developers describe functions so the model could “intelligently choose to output a JSON object containing arguments to call those functions”²⁰. Now, the caller reads a description in plain language and guesses what to send. It might pick the wrong tool, invent an input, or obey something it read. OpenAI’s launch post already warned that “untrusted data from a tool’s output can instruct the model to perform unintended actions”²⁰.

On November 25, 2024, Anthropic open-sourced the Model Context Protocol (MCP), to replace a world where “Every new data source requires its own custom implementation”²¹. Within six months the other large vendors had adopted it. OpenAI’s Agents SDK added MCP support on March 26, 2025²². Google launched its Agent Development Kit on April 9, 2025 with MCP tools in its tool list²³. Microsoft announced “broad first-party support” for MCP at Build on May 19, 2025²⁴. OpenAI’s Responses API added remote MCP servers the next day²⁵. Google’s agent-to-agent protocol, A2A, describes itself as one that “complements Anthropic’s Model Context Protocol”²⁶.

So the plumbing is old, and so are its unsolved questions, such as whether a call that never answered actually ran. The caller is new: it reads, it guesses, and it can be misled.

1. Explain to a friend why the model cannot delete a file by itself. Name the part of the system that can.
2. Pick one tool you have used with an agent, such as web search or a calendar. For each of the four questions, say who answers it in that product.
3. Say in two sentences what is forty years old about calling a tool, and what changed when the caller became a model.