What is tool calling? Claude Code, Codex, Cursor and Grok

Nov 7, 2026

Tool calling is when a model names a function and its arguments, and the app runs it. How Claude Code, Codex, Cursor and Grok Build take that step.

Tool calling is when a model answers with a function name and arguments instead of only text. The app runs that function and sends the result back. The model then continues.

What is MCP owns the comparison with a plain API, a skill, and an MCP server. This entry is the short definition, plus how Claude Code, Codex, Cursor and Grok Build expose the same step. The free lesson Tools and permissions is the checklist to use before you approve one.

How tool calling works

You, or the host, send a list of tools with the request. Each tool has a name, a description, and the arguments it accepts. The model either writes an answer or returns a tool call. It does not run the function itself.

The host runs it. A file read, a shell command, or an MCP tools/call all land here. The output goes back into the conversation, and the agent loop decides whether to call another tool or stop.

Permission modes decide whether that run asks you first. A sandbox limits what an approved command can touch.

Tool calling in each tool

	Claude Code	Codex	Cursor	Grok Build
Who picks the tool	The model, from the prompt and what it has learned	The agent, inside your permissions	Agent, with no documented cap on calls in one task	The model. Permissions decide which calls may run
Built-in actions	File, search, shell, web, and code intelligence. The reference lists each name	Tools to gather information or take action. Local commands run in the sandbox	Search, read, edit, shell, web, browser, image generation, questions	Rules can name bash, read, edit, grep, MCP, and web tools
A tool you add	An MCP server	An MCP server	Not a custom-tool format on the agent page	An MCP server, namespaced as `server__tool`

Claude Code

Tools are what make Claude Code agentic. Without them, Claude can only answer with text. With them, it can read files, edit, run commands, and search the web. The how-it-works page groups those into file operations, search, execution, web, and code intelligence.

The tools reference is the list of exact names you put in permission rules, such as Bash, Read, and Edit. Claude decides when to use them. You name them when you allow or deny a call. Custom tools come from an MCP server. A skill does not add a new tool entry. It runs through the existing Skill tool.

Glob and Grep are marked absent by default on macOS, Linux, and WSL. The how-it-works page still lists search as a category. This entry does not guess which tool fills that gap on those systems. See How Claude Code works and the tools reference.

OpenAI Codex

The agent guide describes tools as one of the three parts of an agent, next to the model and the guardrails. It does not publish a table of tool names the way Claude Code does.

Local commands in the desktop app, the CLI, and the IDE extension run in the sandbox, including git, package managers, and test runners. Crossing that boundary follows the approval policy. MCP is how Codex reaches a tool that lives in another system. See Working with agents and MCP in Codex.

Cursor

The agent page calls tools the building blocks of Agent. The ones it names are file and folder search, web search, fetching a rule, reading a file, editing a file, running a shell command, the browser, image generation, and asking you a question.

It also says there is no limit on the number of tool calls Agent can make during a task. The page points at a tool-calling fundamentals article for the protocol underneath. The steps in this entry are the ones the agent page itself names. See Cursor Agent.

Grok Build

The permissions page says permissions decide which tool calls may run. The sandbox is separate. It limits what an approved call can do on the filesystem and network.

An allow or deny rule names a tool. The documented filters include Bash, Edit, Read, Grep, MCPTool, WebFetch, and WebSearch. The example config uses lowercase bash and read. This entry does not claim those spellings are interchangeable.

MCP tools sit beside the built-in ones, named <server>__<tool>. The xAI API has a separate function-calling guide, where your own code runs the function. That guide is the API, not a mode inside grok. See Permissions and MCP servers.

Details checked against each vendor’s documentation in November 2026.

A real example

The Claude Code settings reference shows an allow rule that approves npm run commands without a prompt. permissions.allow can live in any settings file:

{
  "permissions": {
    "allow": ["Bash(npm run *)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)"],
    "defaultMode": "acceptEdits"
  }
}

The rule does not make the model call npm run. It only skips the prompt when a call matches. A task that should stay read-only still needs you to say so:

The RSS item limit is in src/pages/rss.xml.ts. Read that file and tell me the number. Do not edit it.

Grok’s permissions page shows the same split in ~/.grok/config.toml, with tool = "bash" and a pattern such as git *.

Cloudflare Domains Toolkit is an MCP server, so its tools arrive as tool calls. The domain tutorial walks through search and a quote, and the purchase tool stops until you confirm.

When to use tool calling

Use it when the next step depends on the machine or on a service. A file, a test command, or a domain quote are that kind of step. The Vercel AI SDK tutorial is the same shape inside an app you run: tool() defines the function, the model asks for it, your code returns the result.

Skip a write or a purchase when you only wanted the model to read. The course lesson says to start read-only and to widen one step at a time.

A skill is the other choice when the work is a procedure the agent can follow with the shell it already has. What is MCP puts that next to function calling.

Pitfalls

In auto mode, Claude Code does not send every allow rule through the classifier. A specific rule such as Bash(npm test) skips it, unless the rule carries per-command allowed domains. A destructive argument the prefix did not anticipate can then get through. The settings reference is the page that states this.

Glob and Grep being absent by default on macOS, Linux, and WSL means a permission rule for those names does nothing until the tool is actually available. The tools reference is where that row is marked.

Cursor’s agent page states there is no limit on tool calls in one task. A wide prompt can keep reading and editing until you steer it. The queued-message keys on that page are how you do that.

On Grok, deny always wins over allow. A remembered “always allow” grant still prompts for patterns such as rm and git push. An explicit config or CLI allow rule auto-approves them. Under always-approve they run unless you add a deny.

A tool result is text the model will read. The course lesson treats that text as untrusted, including a page or a ticket that tries to change the task.

What is MCP separates function calling, an HTTP API, a skill, and an MCP server.
Vercel AI SDK tutorial builds a chatbot whose getOrder tool runs in your own route.
Tools and permissions is the five checks before you approve a call.
Cloudflare Domains Toolkit exposes search, quote, and purchase as MCP tools. The tutorial keeps the purchase behind a confirmation.

Agent loop: The agent loop is the cycle a coding agent repeats: look, act, check, and go again. How Claude Code names that cycle, and what the other tools document.
Permission modes: Permission modes decide what a coding agent can do without asking. The modes in Claude Code, Codex, Cursor and Grok Build, and what YOLO mode really skips.
Sandbox: An agent sandbox limits which files and hosts a coding agent's commands can reach. How the boundary works in Claude Code, Codex, Cursor and Grok Build.

All AI glossary entries →

Follow @flaviocopes

Want me to talk about your product? You can sponsor this site.