How AI Agents Use Tools to Work with APIs and Databases

A language model on its own is a brilliant talker and a useless employee. It cannot check a live price, look up a customer record, or send an email — it can only produce text and hope you mistake fluency for action. Tool use is the thing that closes that gap, and it is far less magical than the vendor decks make it sound: a loop, a contract, and guardrails, with the model itself never touching anything at all.

The model never touches the outside world — and that's the whole point

Strip the marketing and an agent is a while-loop, a handful of tools, and guardrails holding the whole thing back from embarrassing you in production. The model emits a structured function call; your application runs it, holds the credentials, and hands the result back as an observation. The model then reasons again. That loop — reason, call, observe, reason — is what turns a text generator into an actor. Anyone selling you an "agent platform" without being blunt about who actually executes the code is selling you the loop and hiding the liability.

The description does the work, not the schema

A tool is a name, a description, and a typed parameter schema — and Anthropic is blunt that the description is "by far the most important factor in tool performance." The model matches your request against descriptions, not against some deep understanding of your systems. A vague description means a wrong tool, confidently chosen. Strict mode and schema validation help, but a schema alone rejects nothing: your application has to validate every call before it reaches a real system, or you have built a very articulate way to shoot yourself in the foot.

Keep the keys away from the model, or don't be surprised

Authentication stays with the application, full stop. API keys and OAuth tokens are never exposed to the model; it asks, the application attaches the credentials. The same discipline applies to errors: a raw error dump or a wall of unfiltered data is not an observation, it's a prompt for the model to improvise. Good errors name what failed, which field caused it, and what to try instead — because for an agent, the error is not a log entry. It is the next instruction.

Databases are where the hype gets dangerous

Database tools follow the same loop with much higher stakes. LangChain's own docs warn its SQL agent "can execute arbitrary SQL" — expensive scans, locking queries, unintended writes. The answer is not a smarter model, it's least privilege enforced outside the model: read-only roles, table allow-lists, statement timeouts, and query validation that blocks destructive patterns. Treat every generated query as untrusted input, keep read and write tool sets on separate roles and connections, and make destructive writes ask for explicit confirmation. A write cannot be undone by asking the model to try again.

Even the best models are wrong a third of the time on multi-turn calls

Selection sounds solved until you look at the numbers. The Berkeley Function-Calling Leaderboard's April 2026 snapshot puts the best tested configuration — Claude Opus 4.5 with native function calling — at 77.47% overall and just 68.38% on multi-turn calls. Accuracy is good, not perfect, and it degrades exactly where agents live: across turns, with memory, and with changing context. Fewer, more capable tools beat a sprawling catalogue — OpenAI suggests keeping under 20 functions per turn — because every extra description is another chance to pick wrong.

The biggest risk isn't a bad tool call. It's a poisoned observation.

Prompt injection is LLM01 in the OWASP Top 10 for LLM Applications 2025, for the second straight edition, because the model reads instructions and data through the same channel. Text fetched by a tool — a web page, a document, a database row — can carry instructions the model follows as if they came from you. Combine that with private data access and external communication and you get what Simon Willison calls the lethal trifecta. And a tool result alone proves nothing: a report of success after a failed write misleads the model exactly like a confident wrong answer. Make your tool outputs trustworthy, or your agent is just a very persuasive liar with API keys.

Go deeper

Read the full guide on Agentic Affairs: How AI Agents Use Tools to Work with APIs and Databases

Originally published on Agentic Affairs (https://agentic-affairs.com)