Tool Calling & Agents

Gen AI interview function calling agents ReAct

What is tool / function calling and how does it work?

Tool calling lets an LLM invoke external functions — search, a calculator, an API, a database — instead of answering from memory alone. The model doesn't run the tool; it requests a call in structured JSON, your code executes it, and the result is fed back into the context.

The loop

You give the model tool schemas (name, description, parameters). It picks a tool and emits arguments → your code runs it → the output goes back to the model → it either calls another tool or answers.

Follow-ups
  • “Why does it help?” — Tools give fresh data, exact computation, and real-world actions — fixing the LLM's stale knowledge and shaky arithmetic.

What makes an LLM an agent?

An agent uses the LLM as a reasoning engine in a loop: it decides actions, calls tools, observes results, and keeps going until a goal is met — rather than producing a single response.

Plan break down goal

Decompose a task into steps.

Act call tools

Use tools / take actions in the environment.

Observe use feedback

Read results and adjust the next step; loop until done.

What is the ReAct loop?

ReAct = Reasoning + Acting. The model interleaves a thought (reasoning about what to do), an action (a tool call), and an observation (the result), repeating until it can answer. Explicit reasoning between actions improves tool choice.

Follow-ups
  • “How does memory fit in?” — Short-term memory is the running context; long-term memory is often a vector store the agent retrieves from.

Why are agents hard to make reliable?

Errors compound over a multi-step loop — a 90% per-step success rate over 10 steps is only ~35% end-to-end. Agents can also loop forever, pick the wrong tool, or hallucinate arguments.

Mitigations

Limit steps, validate tool arguments against the schema, add retries and verification/critic steps, keep tools few and well-described, and prefer human-in-the-loop for risky actions.

What are the safety concerns?

Giving a model the ability to act raises the stakes — especially with untrusted input.

Prompt injection hijacked instructions

Malicious text in a fetched page or document redirects the agent.

Excess permissions least privilege

Scope tools tightly; a delete/payment tool needs guardrails.

Confirmation human approval

Gate irreversible or outward-facing actions behind a human.