Skip to content

Chapter 3.5 — Tool use, function calling and MCP

🎯 Objective

Present the most sensitive layer of an agent: real actions on real systems.

🧠 Concepts

  • Tool use — the agent uses an external system to obtain data or execute an action.
  • Function calling — schema-first; the model proposes, the application validates, authorizes and executes.
  • Structured outputs — outputs follow a versioned schema.

🛡️ Mandatory flow

LLM proposes tool_call -> schema validates -> policy authorizes ->
executor calls the system -> result returns to the model ->
final synthesis

🧠 Tool registry

A versioned catalog that stores:

  • name, short description, version;
  • input/output schema;
  • permissions;
  • owner;
  • criticality;
  • status (experimental, active, deprecated, removed);
  • approval policy;
  • rate and cost limits;
  • runbook;
  • changelog.

🧩 MCP (Model Context Protocol)

An open protocol to connect AI applications to tools, resources and prompts via clients and servers. The spec is relatively recent, in active evolution, with growing adoption among providers and SDKs — useful in production, but still consolidating, with non-trivial changes between versions.

MCP helps with:

  • interoperability;
  • discovery;
  • host/server separation;
  • reduction of ad hoc integrations.

MCP does NOT replace:

  • corporate authorization;
  • threat modeling;
  • runtime;
  • eval harness;
  • observability;
  • governance;
  • human approval;
  • business versioning.

Maturity. Treat MCP like any emerging protocol dependency: version pinning, capability review at each upgrade, versioned contracts in the servers you expose, integration regression tests. We return to this point in Ch. 4.9 (supply chain) and Ch. 7.4 (deprecation).

🤝 A2A (Agent2Agent)

A2A is an open protocol, originally proposed by Google in 2024 and now maintained as a project under the Linux Foundation (a2a-protocol.org), for interoperability between agents. Where MCP standardizes the agent↔tool/resource boundary, A2A standardizes the agent↔agent boundary.

Key concepts:

  • Agent Card. A document (JSON) with the remote agent's "spec sheet": declared capabilities, endpoints, supported methods, authentication schemes, execution modes (synchronous, streaming, push). Conceptually analogous to openapi.json for HTTP APIs.
  • Task lifecycle. A2A models exchanges as tasks (tasks) with states (submitted, working, input_required, completed, failed, canceled).
  • Messages and artifacts. Each task carries messages (text/JSON/files) and artifacts as structured deliverables.

A2A does NOT replace:

  • Authorization between agents (it needs OAuth/OIDC, mTLS, JWT, etc.);
  • Agent identity (each agent still needs a strong identity);
  • Threat modeling, audit log, runtime, evals and HITL;
  • Versioning and governance of the capabilities declared in the Agent Card.

Maturity. A2A is an emerging protocol. In 2024–2026 there is still evolution of the spec, SDK and capabilities; treat it as a consolidating technology, with the same cautious stance as MCP. Adopt it in production with explicit migration windows, controls outside the protocol, and regression tests at each spec release.

Practical differences vs MCP:

Axis MCP A2A
Boundary Agent ↔ tool/resource Agent ↔ agent
Primary unit Tool/resource/prompt Task with messages and artifacts
Discovery Server capabilities Agent Card
Execution state Implicit in the client Explicit task states
Maturity More consolidated Consolidating

🔧 Tool versioning and lifecycle

tool.crm.search_customer@1.4.0
mcp.crm-server@2.1.0
schema.create_ticket@3.0.0
  • Compatible: new optional field, improved description, timeout within the limit.
  • Incompatible: renaming a field, removing a field, changing an enum, altering authorization or a side effect.

🚨 Risks of exposing too many tools

  • Wrong selection.
  • Increased tokens.
  • Indirect prompt injection.
  • Exfiltration.
  • Broad permissions.
  • Latency.
  • Accidental execution.
  • Regressions.

Mitigation: lazy loading — expose tools only after classifying intent and risk.

  • EX-AGT-01 — a simple agent with function calling.
  • EX-AGT-02 — a tool registry with versioning.
  • EX-AGT-03 — a minimal, versioned MCP server.

📚 References