Function calling, which Anthropic calls tool use, is a model API feature: your app sends tool definitions, the model replies with a structured request to call one, and your code runs it. MCP is a protocol for publishing tools from a server so any compatible AI app can discover and call them. Most MCP clients use function calling underneath. An agent is the loop that uses either.
What is function calling?
The model asks your application to run a function. It never runs anything itself.
- Your app sends the model a list of tools, each with a name, a description and a JSON Schema for its inputs.
- The model decides a tool would help and replies with a structured call: the tool's name and the arguments. In Claude's API this is a
tool_useblock withstop_reason: "tool_use". - Your code runs the function and sends the output back, in Claude's API as a
tool_result. - The model reads the result and either answers or calls another tool.
The tool definitions live in your code and work only in your app. Claude's API also offers strict tool use (strict: true), which makes tool calls match your schema exactly.
What does MCP add on top of function calling?
MCP moves the tools out of one app and into a server that any compatible app can use. A client asks the server what tools it has (tools/list), hands those definitions to its model, and when the model picks one, the client sends the call to the server (tools/call).
So inside Claude, ChatGPT or Cursor, an MCP tool reaches the model through that product's own function calling. What MCP adds is everything around it:
- Reuse. One server works in every client that supports the protocol, instead of one integration per app.
- Discovery. Clients learn the tools at run time, so you can change the server without redeploying the apps.
- Sign-in. A standard OAuth flow, so each person connects as themselves.
- More than tools. Resources to read and prompts a person can pick, where the client supports them.
The transports and sign-in rules are in what is an MCP server.
Where do AI agents fit?
An agent is a model in a loop: call a tool, read the result, decide the next step, repeat. Function calling is how each step is requested. MCP is one place the tools can come from. An agent can use both in the same run.
So "agent vs MCP" is not a real choice. How much the loop does without a person is covered in what is an AI agent.
| Function calling | MCP server | Agent | |
|---|---|---|---|
| What it is | A model API feature | A protocol and a service | A loop around a model |
| Where tools are defined | In your app's code | In the server | Uses tools from either |
| Who runs the tool | Your app | The server | Whichever provides the tool |
| Works in other AI apps | No | Yes, any compatible client | Depends on its tools |
| Sign-in per person | You build it | Standard OAuth flow | Inherits from its tools |
| Best for | One product, a few tools | A system many people or apps need | Multi-step work with judgment between steps |
Should you build function calls or an MCP server?
- Plain function calling when the tools serve one application you control, the list is small and stable, and nobody needs them from Claude, ChatGPT or an editor directly.
- An MCP server when people want the system inside the AI apps they already use, when more than one app or team needs it, or when each person must sign in as themselves.
- Both, from one server. As of September 2026, Claude's API can call a remote MCP server directly through its MCP connector, a beta that supports tool calls only and needs a server reachable over HTTP. OpenAI's Responses API has an
mcptool type with an approval setting. Build the server once and call it from your own product too.
"Check an order's status" as a function call lives inside your support app, and only that app can use it. As an MCP server it is the same logic behind a URL: support staff use it from Claude, operations from Claude Desktop, your app through the API connector, each signed in as themselves. Design is covered in MCP server design for internal AI tools.
What goes wrong with tool-using AI?
- Vague tool descriptions. The model picks tools from their names and descriptions. Two tools that sound alike get confused, whichever layer defines them.
- Missing arguments filled by guessing. Anthropic's docs note a model may infer a plausible value for a required field the user never gave. Validate inputs and ask when a required value is missing.
- Trusting a tool's own labels. MCP lets a server mark a tool read-only, but the spec tells clients to treat those labels as untrusted. The permission check belongs in the code that runs the tool.
- Unbounded loops. Set step limits and timeouts on an agent retrying a failing tool.
Common questions
Is MCP replacing function calling?
No. MCP sits on top of it. An MCP client fetches tool definitions from a server and passes them to its model, which asks for a tool through the model API's ordinary function calling. MCP standardizes where tools come from and how they are called, not how the model chooses them.
Can my own app use an MCP server through the API?
Yes. As of September 2026, Claude's API has an MCP connector, in beta, that calls a remote MCP server's tools from a normal Messages request, and OpenAI's Responses API accepts remote MCP servers as a tool type. Both need the server reachable over HTTP. You can also build your own MCP client with the official SDKs.
Is an MCP server more secure than function calling?
Neither is secure by itself. MCP gives you a standard OAuth sign-in and one place to enforce permissions and log calls. The limits that matter are still the ones written into the tool's own code.