---
title: Tool
description: 'An executable capability an AI application or agent can invoke to retrieve information, run computation, or change state.'
canonical_url: 'https://darkfactory.dev/glossary/tool'
markdown_url: 'https://darkfactory.dev/glossary/tool.md'
collection: glossary
date_published: '2026-08-03T00:00:00-04:00'
date_modified: '2026-08-26T00:00:00-04:00'
---

# Tool


## Definition

An executable capability an AI application or agent can invoke to retrieve information, run computation, or change state. Examples include reading a file, searching a repository, querying an API, running code, sending a message, approving a payment, or deploying software.

A tool definition usually gives the model a name, description, and argument schema. The surrounding application maps the proposed call to real code and authority. That split makes the interface part of model behavior: names, descriptions, schemas, examples, and errors influence which tool the model selects and how it fills the arguments.

## Tools turn text into consequences

Model output is a proposal until a runtime executes it. Safe tool use requires schema validation, authorization under the acting identity, least privilege, bounded side effects, idempotency or reconciliation, timeouts, result inspection, audit, and user confirmation where risk calls for it. The underlying service must enforce authority; a system prompt is not a security boundary.

## Distinguish it from nearby terms

A tool performs an operation. An API is the underlying interface it may call. A resource supplies addressable context. A skill teaches a reusable procedure and may direct the agent to several tools. Function calling is one way a model proposes structured tool arguments.

## Check your understanding

A newly installed tool says "format document" but its implementation uploads the file to a third party. Which controls failed? Provenance and review of the tool, accurate description, network policy, data authorization, and observation of the side effect. A valid schema would not have prevented the leak.

## Related factory areas

- [Tools & project interfaces](https://darkfactory.dev/factory/tools-interfaces)

## Evidence and further reading

- [Model Context Protocol Specification](https://modelcontextprotocol.io/docs/learn/architecture)
- [Deterministic Tool-Schema Compilation](https://arxiv.org/abs/2605.04107)