How LLMs Got Hands: The History of Tool Use and Function Calling (2026)

In 1504, at the siege of Landshut, a German knight named Götz von Berlichingen lost his right hand to his own sword when cannon fire drove it back against him. He had a replacement built out of iron. The second version had jointed fingers on ratchets that could be set by hand, and it held a shield, a rein, or a quill. It felt nothing. It reasoned about nothing. It just closed on the thing you put in it and did not let go.

That is a surprisingly exact description of what happened to language models between 2021 and 2026.

A model on its own is a very good reader and writer with no way to touch anything. It cannot check today's price, run a query, send an email, or add two large numbers reliably. The entire history below is the story of bolting a hand onto it: first as a research trick, then as an API parameter, then as an open protocol, and finally as a screen it could point at. This is the missing link between "chatbot" and "agent," and it happened in about forty months.

TL;DR: LLM tool use went from a research paper to industrial plumbing in under four years. Toolformer landed February 9, 2023, OpenAI shipped function calling June 13, 2023, and by December 9, 2025 the Model Context Protocol reported 97 million monthly SDK downloads across 10,000 active servers. See how Taskade agents use tools →

What Is Tool Use in a Large Language Model?

Tool use is the ability of a model to emit a structured request naming an external function and its arguments, which software outside the model then executes and feeds back as new context. The model does not run anything. In a 2026 production stack, a single tool call crosses four boundaries: the model writes a call, a harness validates it against a schema, the harness executes it, and the result re-enters the transcript as fresh input.

That separation is the whole design. It is why tool calling is safe enough to ship: every permission check, timeout, rate limit, and audit log lives in the code around the model, never inside it. It is also why tool use is not one invention but a stack of them, each fixing a failure the previous layer exposed.

Three terms get used interchangeably and should not be:

• Tool use is the capability.
• Function calling is the specific API mechanism: declare a function with a JSON Schema, get back a name and arguments, run it yourself.
• Provider-hosted tools are functions the model vendor runs on your behalf, such as web search or a code sandbox. You never see the call.

The Prehistory: Why a Model Needed Hands at All (2021 to 2022)

Every early tool-use paper is answering the same complaint: a model that has read the entire internet still cannot tell you what happened this morning, and still gets long multiplication wrong. The knowledge is frozen at the training cutoff and the arithmetic is pattern-matched rather than computed. Neither problem gets solved by scale, which is exactly why researchers reached outside the model instead.

WebGPT is the one people forget. Reiichiro Nakano and colleagues at OpenAI fine-tuned GPT-3 to answer long-form questions inside a text-only web browser, with human feedback deciding which browsing behaviour was good. It shipped in December 2021, a full year before ChatGPT. The model was already searching, clicking, and quoting sources. It just had no product around it.

MRKL, from AI21 Labs in May 2022, contributed the architecture diagram everyone else redrew. Its acronym stands for Modular Reasoning, Knowledge and Language, and its argument was blunt: stop trying to make one network do discrete reasoning, and route those parts to modules that already do it correctly.

The Definitive Timeline of LLM Tool Use, 2021 to 2026

Tool use crossed from research to default API surface in roughly thirty months, between the ReAct paper in October 2022 and the OpenAI Responses API in March 2025. Every row below is dated to a primary source: an arXiv submission, a vendor announcement, or a protocol specification revision.

Toolformer: The Model That Taught Itself to Use an API

Toolformer, submitted to arXiv on February 9, 2023 by Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom at Meta AI, showed a model could decide for itself when an API call was worth making. The training method is the interesting part: the model sampled candidate API calls into its own training text, executed them, and kept only the calls whose results reduced its prediction loss on the following tokens. Then it fine-tuned on what survived.

The tool set was deliberately mundane: a calculator, a question answering system, two search engines, a translation system, and a calendar. That mundanity is the point. The paper's framing is that models "struggle with basic functionality, such as arithmetic or factual lookup, where much simpler and smaller models excel." The fix was never to make the model better at arithmetic. The fix was to let it hand arithmetic to a calculator.

Toolformer is the conceptual ancestor of every "the model knows which tool to reach for" claim made since. It also set up the failure mode that dominated the next three years: a model that decides when to call can also decide wrongly, confidently, and repeatedly.

ReAct: The Loop That Made Tools Repeatable

ReAct, submitted October 6, 2022 by Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao, is the single most copied structure in agent engineering. It interleaves a reasoning trace with task actions so the model can revise a plan after seeing what actually happened. The paper reports absolute success rate improvements of 34 percent on ALFWorld and 10 percent on WebShop over imitation and reinforcement learning baselines, plus gains on HotpotQA and Fever.

What made it stick was not the score. It was the shape. Before ReAct, a tool call was a one-shot substitution. After ReAct, it was a cycle with a stopping condition, which is exactly what an agent loop is. The ReAct pattern is why your agent framework has a max_steps parameter.

What Actually Happens During One Tool Call

Exactly one step in a tool call touches the outside world, and the model is not in it. The model produces text; the agent harness parses, validates, authorizes, executes, and returns. Read the trace below and notice that turns two and four are pure text generation, while turn three is ordinary software doing ordinary work.

TURN 1   -> model      role: user
                       content: "What was our Q3 revenue?"
           tools[]     [{ name: "query_db",
                          input_schema: { sql: string } }]
TURN 2   <- model      stop_reason: tool_use
           tool_call   { id: "call_01",
                         name: "query_db",
                         arguments: { sql: "SELECT sum(amount) ..." } }
           NOTE        The model produced TEXT. Nothing has run yet.
TURN 3   -> harness    validate args -> check permission -> set timeout
                       -> execute -> catch errors -> redact
           tool_result { tool_use_id: "call_01",
                         content: "418293.55" }
           NOTE        This is the ONLY step that touches the world.
TURN 4   <- model      stop_reason: end_turn
           content     "Q3 revenue was $418,293.55."

Everything that has ever gone wrong with an AI agent went wrong at one of those four lines. Bad arguments break turn two. Missing permission checks break turn three. Errors returned as prose instead of structured data break turn four, because the model reads "something went wrong" and narrates a plausible answer anyway. This is why agent permissions and the agent environment matter more than model choice for reliability.

Tool-Calling Formats by Provider

There is no single wire format for tool calls, and the differences are not cosmetic. Anthropic returns a parsed object, OpenAI returns a JSON string you must parse yourself, and Google expects an OpenAPI-flavoured declaration. Framework authors spend real effort on this table.

The practical consequence is that "supports function calling" is not a binary. It never was.

2024: The Year Tool Calls Became Reliable

Reliability, not capability, was the 2024 story. On August 6, 2024, OpenAI shipped Structured Outputs, reporting that gpt-4o-2024-08-06 scored 100 percent on complex JSON Schema adherence evaluations against under 40 percent for gpt-4-0613. Setting strict: true on a function definition moved argument validity from "usually fine" to a decoding guarantee.

Measurement caught up in the same window. The Berkeley Function-Calling Leaderboard arrived in February 2024 from the same Berkeley group behind Gorilla, scoring single calls, parallel calls, multiple-tool selection, and the underrated skill of declining to call a tool when none applies. Then tau-bench, published June 17, 2024 by Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan, put an agent in a conversation with a simulated user under domain rules and introduced a pass-to-the-k metric that measures whether the agent behaves the same way across repeated trials. The headline finding was uncomfortable: strong models succeeded on fewer than half the tasks, and consistency was far worse than raw accuracy suggested.

If you are building evaluation into your own workflows, the same discipline applies at product scale: see agent evals explained and agent evaluation.

Computer Use: When the Tool Became the Whole Screen

Computer use removed the requirement that a tool exist at all. On October 22, 2024, Anthropic released a public beta in which Claude reads a screenshot and returns cursor movements, clicks, and keystrokes, scoring 14.9 percent on OSWorld against a next-best model at 7.7 percent and humans at 70 to 75 percent. The company described the model as learning to "count how many pixels vertically or horizontally it needs to move a cursor," and called the result slow and often error-prone.

OpenAI followed on January 23, 2025 with Operator, powered by a Computer-Using Agent model that combined vision with reasoning and reported 38.1 percent on OSWorld and 58.1 percent on WebArena. Fourteen months separated a 14.9 and a 38.1 on the same benchmark.

The strategic significance is bigger than the scores. Function calling requires someone to build and maintain an API. Computer use requires only that software have a screen, which describes essentially all enterprise software written before 2015. That is why computer use agents and browser agents became the fallback path for systems with no integration story, and why they carry the highest risk: a model that can click anything can click the wrong thing.

MCP: Solving the N by M Problem

The Model Context Protocol, released by Anthropic on November 25, 2024, standardised how a tool is published so that it does not have to be rebuilt for every client. Before MCP, connecting N applications to M tools meant writing N times M integrations. After MCP, each application implements the protocol once and each tool implements it once, which is N plus M.

The launch shipped three things at once: the specification and SDKs, local server support in Claude Desktop, and a repository of pre-built servers for Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer. Block and Apollo were named as early adopters.

What made it a standard rather than a vendor format was the next five months. Sam Altman confirmed OpenAI support on March 26, 2025, starting with the Agents SDK. Demis Hassabis said Google would support it in the Gemini API and SDK on April 9, 2025. By December 9, 2025 Anthropic donated MCP to the newly formed Agentic AI Foundation under the Linux Foundation, alongside Block's goose and OpenAI's AGENTS.md, with platinum members including AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI.

If you are wiring MCP into a real workspace, start with what MCP is, then MCP servers, choosing between servers, and building a hosted server. The wiki entries for MCP servers and MCP clients cover the two halves of the protocol.

2025 to 2026: The New Bottleneck Is Too Many Tools

Once every tool was easy to publish, the constraint moved from access to attention. Every tool definition is text sitting in the context window before any work begins, and near-duplicate tools make selection harder rather than easier. On November 24, 2025 Anthropic shipped three features aimed squarely at this: a Tool Search Tool, Programmatic Tool Calling, and Tool Use Examples.

The reported numbers are specific. Loading tool definitions on demand rather than upfront cut one measured context load from 77,000 tokens to 8,700, an 85 percent reduction, while accuracy on Anthropic's MCP evaluation rose from 49 to 74 percent for Opus 4 and from 79.5 to 88.1 percent for Opus 4.5. Programmatic tool calling, where the model writes code that orchestrates tools inside a sandbox and only the final output re-enters context, dropped average usage from 43,588 to 27,297 tokens on complex research tasks, a 37 percent reduction. Tool Use Examples raised accuracy on complex parameter handling from 72 to 90 percent.

The academic literature has caught up as well. A March 2026 survey, The Evolution of Tool Use in LLM Agents, organises the field across inference-time planning, training methods, safety, resource efficiency, capability completeness, and evaluation, and draws the line this article draws: single-tool calls and long-horizon multi-tool orchestration are different problems.

What Still Breaks, and What Fixed It

Six failure modes account for most production incidents involving tool-using agents, and five of them have a known mitigation with a shipping date attached. This is the practical distillation of the timeline above.

The pattern across all six is the same one Götz von Berlichingen's blacksmith understood. The hand does not need to feel. It needs a ratchet that holds a defined position, and a person who decides what to put in it. For deeper coverage of the recovery half, see AI agent error recovery and agent observability.

How Taskade Puts Tools in an Agent's Hands

Taskade AI Agents come with tools already wired, so the tool-selection problems above are configuration rather than engineering. Agents draw on a built-in toolset including web search, file analysis, and workspace actions, and they act inside the same workspace where your projects, documents, and data already live. That matters because the hardest part of tool use in practice is not the call format, it is giving the model an environment worth acting in.

Three pieces do the work:

• 100+ bidirectional integrations across the tools your team already uses. Triggers pull events in, actions push data out, so an agent can both watch for a change and respond to it.
• A hosted MCP server on paid plans, which lets outside AI clients connect to your Taskade workspace over the open protocol described above. Connecting Taskade outward to third-party MCP servers is available on Business and higher. See the Taskade MCP server and MCP connectors.
• Automations for the deterministic parts. When a step must run the same way every time, a workflow beats a model deciding, and the agent calls the workflow as a tool.

Taskade Genesis turns a plain-language description into a working app with agents and automations attached, and Taskade EVE coordinates the agents inside it. Under the hood you get 15+ frontier models from OpenAI, Anthropic, Google, and open-weight providers, so tool-heavy work can be routed to whichever model handles it best. Everything lands in a workspace with 7 project views: List, Board, Calendar, Table, Mind Map, Gantt, and Org Chart.

Paid plans start at $10 per month for Pro, billed annually. Start building free →

Frequently Asked Questions

Keep Reading

• The history of workflow automation for the pre-AI half of this story
• The agent harness explained, the software layer that actually runs your tools
• Agentic design patterns and the AI agent stack
• What is LangChain and the history of Claude Code
• Context engineering, because tool definitions are context too
• Wiki: tool calling, tools, structured outputs, chain of thought, agent skills, agent sandbox
• Product: Taskade AI Agents, Automations, Integrations, Community apps

Forty months separate a research paper about a model that could use a calculator from a Linux Foundation project with 97 million monthly SDK downloads. The models did not change shape in that time. What changed is that we built them a hand, then a wrist, then a rule about what they are allowed to pick up. Memory tells an agent what it knows, intelligence tells it what to do, and execution is the part that finally touches something real.

▲ ■ ●