03 — agents & architecture

Tool call

The model's structured request to do something in the world — Bash("rm -rf …"), Read("/etc/passwd"), an HTTP fetch, a database query — emitted as a name plus arguments for the host to execute. It is the moment intent becomes effect, which makes it the highest-value point of control in the whole stack: the model layer decides what an agent wants, the tool layer decides what it can, and only the second is enforceable.

Related terms

  • Action layer Agents & architecture

    The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.

  • PreToolUse hook Agents & architecture

    A callback the agent host invokes after the model has requested a tool call but before the call executes, handing over the tool name and arguments and…

  • MCP Agents & architecture

    An open protocol, introduced by Anthropic in 2024 and now broadly adopted, that standardises how agents connect to external tools and data sources.

Agents & architecture

Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.

Tool call is term 3 of 8 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0