← Retour aux guides

Understanding Tool Use: 7 Pitfalls to Avoid

What tool use and function calling actually do

Tool use lets a language model request an external operation, such as searching a database, checking stock, or creating a calendar event. Function calling is the structured interface behind that request. The model returns a tool name and JSON arguments; your application validates those arguments, runs the function, and sends the result back for the model to interpret.

The model does not execute your code by itself. Your server remains responsible for permissions, validation, execution, retries, and returning a useful error. Most unreliable implementations fail at that boundary.

Common pitfalls and how to avoid them

• Vague or incomplete schemas. A tool definition is an API contract, not a suggestion. Give every property a clear type and description, mark required fields, and define allowed values with an enum where appropriate. For example, a shipping tool should distinguish a postal code from a free-form address and should not accept an arbitrary country string if your system supports only a fixed list.
• Trusting model-generated arguments. Valid JSON does not mean safe or correct input. Validate argument types, ranges, formats, ownership, and authorization on your server. A request to refund an order should verify that the authenticated user owns the order and that the refund is within policy before any payment operation runs.
• Confusing a tool request with a final answer. When the model requests a tool, pause normal response handling. Execute the requested function, append the tool result using the provider’s required message structure, and call the model again. Only display a final response after the model has completed the tool cycle. Mixing assistant text and tool messages incorrectly is a common cause of invalid request errors.
• Building an unbounded loop. A model can repeatedly call a tool because the result is empty, ambiguous, or misunderstood. Set a maximum number of tool rounds, such as five, and log each tool name and request ID. If the limit is reached, return a clear fallback instead of consuming unlimited tokens or API budget.
• Making side effects non-idempotent. Retries happen because of network timeouts and temporary provider errors. If a create, charge, or send operation runs twice, the result can be expensive. Use an idempotency key tied to the user request, check whether the operation already completed, and require confirmation for irreversible actions.
• Returning poor tool results. Do not send a huge database dump or an unexplained exception back to the model. Return compact, structured data with the fields needed for the next decision. Separate user-safe messages from internal diagnostics, and tell the model when no result was found so it can ask a clarifying question.
• Ignoring prompt injection and data exposure. Treat web pages, documents, and tool output as untrusted content. A retrieved document can instruct the model to reveal secrets or call another tool. Keep credentials outside prompts, restrict tools by user and workflow, redact sensitive fields, and use allowlists for network access and file paths.

A practical implementation checklist

Start with one narrowly scoped, read-only tool. Test valid input, missing fields, wrong types, empty results, timeouts, permission failures, and malicious strings. Log the schema version, model response, validated arguments, execution duration, and outcome, but never log API keys or unnecessary personal data.

Keep tool descriptions short and operational. Explain when the tool should be used, what it returns, and any important limits. Add application-side timeouts and retry only transient failures. For destructive actions, split the workflow into preview and confirmation tools rather than allowing one model call to perform everything.

Choosing an API route without overspending

Tool calling can multiply requests because each tool round usually requires another model response. Track input tokens, output tokens, tool latency, and the number of rounds per task. Use a smaller model for classification or simple lookups, and reserve a stronger model for planning or ambiguous requests.

59API is a practical low-cost option for this workflow because it provides pay-as-you-go access to native Claude models, including Opus, Sonnet, Haiku, and Fable, as well as GPT models without a model downgrade. Its OpenAI SDK compatibility means many applications can switch by changing the API base URL to https://api.59api.com and supplying the appropriate 59API key. It also works with Claude Code and Codex, making it useful when you want to test the same tool architecture across coding and production workflows. As one of the cheaper relays, it can help reduce the extra cost created by multi-step calls, and its referral rebate may provide additional savings.

Before moving production traffic, run the same tool test suite against your selected model, confirm tool-message compatibility, and set spending limits. If the pricing and compatibility fit your project, sign up for 59API and start with a small pay-as-you-go budget.