the four-step tool-call loop
1 / describe
host registers tools
name + description
+ JSON Schema input
+ executor function
2 / decide
model emits either
text answer OR
tool_calls: [ {id,
name, arguments} ]
3 / execute
host validates args
against schema,
gates consequential
tools, runs executor
4 / observe
host appends
tool result with
matching id; re-
invokes the model
loop closes until model returns text or host hits MAX_TURNS
same loop, different names
OpenAI : tools / tool_calls / tool_choice
Anthropic : tools / tool_use / tool_result
Gemini : functionDeclarations / functionCall
MCP : tools/list / tools/call / content
A2A : skills / SendMessage / Artifact parts
WebMCP (2026) : browser tool manifest / dispatch
every row is the same four steps with different column labels.
pure vs consequential
pure (safe to re-run)
get_weather, search_docs, get_time
consequential (gate required)
send_email, delete_file, execute_trade
Meta Rule of Two (2026)
one turn may combine AT MOST two of:
- untrusted input
- sensitive data
- consequential action