Glossary
76 terms from “Agent Tool Calling: Getting Agents to Actually Do Things.” Hover the first occurrence in the lesson for its definition.
| Term | Definition | Source |
|---|---|---|
| tool | In an Agent context, a tool is a concrete capability the model can request during the conversation; the host program registers it and executes it, turning the model from something that only talks into something that can act. | Define tools — Claude API |
| host program | The host program is the code that actually receives the model's tool-call request, executes the operation, and passes the result back to the model — for example Claude Code, or an Agent script you write yourself. | How tool use works — Claude API |
| search_files | An example tool name used throughout the course, standing in for the class of concrete tool definitions that 'search project files by some condition.' | Define tools — Claude API |
| name | A required field in a tool definition; it is the identifier the model writes when it picks a tool, and it must match the name given at call time exactly. | Define tools — Claude API |
| description | A required field in a tool definition; it states in plain text what the tool does, when to use it, and how it behaves, and is the only readable basis the model has when choosing a tool. | Define tools — Claude API |
| input_schema | A required field in a tool definition; it is a JSON Schema that specifies the shape the parameters must take when the tool is called. | Define tools — Claude API |
| client tools | Tools the host application is responsible for executing itself; the model only generates the call request, while the real execution code runs on the host side. | Tool use with Claude — Overview |
| server tools | Tools that Anthropic's servers execute on your behalf, as opposed to client tools whose execution logic the host application must implement itself. | Tool use with Claude — Overview |
| structured data | The model's tool-call request comes back as a chunk of structured data (not a natural-language instruction), carrying the tool name and parameters for the host program to parse and execute. | How tool use works — Claude API |
| required | A field in JSON Schema that lists the parameter names a tool call must supply; a call missing those parameters is treated as invalid input. | Define tools — Claude API |
| Claude Code | The course's concrete example of the 'host program' concept — itself an Agent product that requests calls to many tools (read files, search code, run commands, and so on). | Tools reference — Claude Code Docs |
| tools | A field carried in the request sent to the model; it is a manifest of tools listing which ones the model may request in this conversation and what parameters each needs. | Define tools — Claude API |
| stop_reason | A field in the model's response explaining why the model stopped talking this time — values include tool_use, end_turn, and others — and it is only a signal, not a record of execution. | Tool use with Claude — Overview |
| tool_result | A content-block type in the message sent back to the model; it carries the finished result of a tool execution and matches its corresponding tool_use block via tool_use_id. | Handle tool calls — Claude API |
| tool_use_id | A field on a tool_result block that must match the id of its corresponding tool_use block exactly; the model uses it to pair each result with its request. | Handle tool calls — Claude API |
| is_error | An optional field on a tool_result block marking whether this tool execution itself failed; set to true, it tells the model this call ran into a problem. | Handle tool calls — Claude API |
| finish_reason | The field name that corresponds to stop_reason in OpenAI-compatible APIs; the value tool_calls means the model is requesting a tool call. | Tool Use — LM Studio Docs (OpenAI-compatible API) |
| messages | The array field in the request that carries conversation history; every turn's response must be appended to it verbatim, including the model's tool_use reply and the following tool_result. | How tool use works — Claude API |
| end_turn | A value of stop_reason meaning the model has finished talking for this turn, needs no more tool calls, and its content can be handed to the user. | Tool use with Claude — Overview |
| tool_use block | The content-block type in the model's response content array that represents one tool-call request; it is complete only when it carries all three fields id, name, and input. | Handle tool calls — Claude API |
| round-trip | The complete cycle of a tool call: the model emits a request, the host executes it, the result is sent back, and the model produces its next response. | How tool use works — Claude API |
| loop | The host-side way of handling multi-turn tool calls: while stop_reason is still tool_use, keep executing tools, sending results back, and requesting again, until it turns into end_turn. | How tool use works — Claude API |
| data dependency | Within one batch of parallel tool calls, when one call's parameter should in theory equal another call's return value — a value that doesn't yet exist at the moment the batch is generated. | Parallel tool use — Claude API |
| disable_parallel_tool_use | A setting on the request's tool_choice object; set to true, the model calls at most one tool per response, used to tighten behavior when parallel-call dependencies aren't yet worked out. | Parallel tool use — Claude API |
| blast radius | The range of damage one tool call can cause when it goes wrong; it is the core criterion for ranking the five tool categories. | Configure the sandboxed Bash tool - Claude Code Docs |
| read_file | The course's example name for the read category of tool; its typical parameter is a file path, and it returns the file's contents. | Tools reference — Claude Code Docs |
| write_file | The course's example name for the write category of tool; its typical parameters are a path and content, and once it runs it overwrites the original file and usually can't be undone. | Tools reference — Claude Code Docs |
| bash | The course's example name for the execute category of tool; its parameter is an open-ended command string that can run any shell command. | Configure the sandboxed Bash tool - Claude Code Docs |
| search_code | The course's example name for the search category of tool; its typical parameters include pattern and max_results, and it returns a list of match locations rather than whole file contents. | Introducing advanced tool use on the Claude Developer Platform | Anthropic Engineering |
| send_slack_message | The course's example name for the call-external-API category of tool; its typical parameters are a channel and text, and calling it crosses the network to a service you don't control. | The lethal trifecta for AI agents - Simon Willison's Weblog |
| command | The core parameter field of an execute-category tool (like bash); it is essentially an open-ended shell script whose capability isn't bounded by schema structure. | Configure the sandboxed Bash tool - Claude Code Docs |
| max_results | A common parameter on search-category tools; it caps how many matches come back in one call, avoiding an overload of results that blows out the context. | Introducing advanced tool use on the Claude Developer Platform | Anthropic Engineering |
| asymmetry between read tools and write tools | Read and write tools have similar call shapes, but a wrong read can just be read again while a wrong write often can't be undone — their risk consequences are not equivalent. | Tools reference — Claude Code Docs |
| retry_after | A field an external-API tool can return on failure, telling the model how long to wait before retrying — a concrete example of 'failure info should carry actionable clues.' | Tools - Model Context Protocol |
| total_matches | A field in the search_code tool's returned result giving the total number of hits, letting the model judge whether the results are complete or the search should be narrowed. | Introducing advanced tool use on the Claude Developer Platform | Anthropic Engineering |
| code_search_grep | The rewritten search-tool name in the course's comparison example; its description states clearly that it searches by content and names code_search_glob as the tool to use for finding files by name. | Writing effective tools for AI agents—using AI agents | Anthropic Engineering |
| code_search_glob | The file-name lookup tool paired with code_search_grep; the course uses it to show that naming the alternative tool in a description markedly lowers the model's odds of picking the wrong tool. | Writing effective tools for AI agents—using AI agents | Anthropic Engineering |
| enum | A JSON Schema keyword that narrows a parameter's value to one of a listed set of options; it is a real constraint that rejects invalid input, not just a note. | Creating your first schema - JSON Schema |
| additionalProperties: false | A top-level input_schema setting requiring the input object to carry only keys declared in properties, closing the gap where the model invents extra fields that slip into downstream code. | Strict tool use — Claude API |
| strict mode | With strict: true set on a tool definition, the platform constrains the model's sampling so the generated input strictly matches input_schema, and invalid parameters are never generated in the first place. | Strict tool use — Claude API |
| namespacing | The practice of prefixing tool names with the service (like github_, slack_), so that as tools grow the model can first rule out irrelevant options by prefix. | How to implement tool use - Claude Platform Docs |
| github_list_prs | The course's example of a namespaced tool name; the github_ prefix marks the tool as belonging to the GitHub service, helping the model tell it apart from same-named operations on other services. | How to implement tool use - Claude Platform Docs |
| slack_send_message | Another of the course's namespaced tool-name examples; the slack_ prefix marks it as belonging to the Slack service, distinguishing it from other message-sending tools. | How to implement tool use - Claude Platform Docs |
| title | A descriptive field in JSON Schema used to give a parameter a readable title; like description, it only explains and imposes no enforcing constraint. | Creating your first schema - JSON Schema |
| MCP | A protocol defining how clients and tool services interact; the course cites its explicit requirement that error messages be surfaced to the model so it can self-correct. | Tools - Model Context Protocol |
| 55K tokens | An example figure from Anthropic's engineering team: the definitions of 58 tools can occupy roughly 55K tokens of context, illustrating tool count's real impact on context overhead. | Introducing advanced tool use on the Claude Developer Platform | Anthropic Engineering |
| 134K tokens | A more extreme example the course cites, showing that as tool count keeps growing, the context consumed by tool definitions alone can balloon to a very significant scale. | Introducing advanced tool use on the Claude Developer Platform | Anthropic Engineering |
| file_type | An example parameter field the course uses to show that a description isn't a constraint; with only a description the model may fill it arbitrarily, and only enum actually narrows it. | Creating your first schema - JSON Schema |
| granularity | How finely a tool's responsibilities are divided; the course stresses granularity is neither best coarse nor best fine — split by function first, then control wrong-pick odds with namespacing and descriptions. | Writing effective tools for AI agents—using AI agents | Anthropic Engineering |
| prompt injection | An attack where instructions are hidden in content the Agent will eventually read (an issue, a web page), so the Agent mistakes that text for a new instruction it must obey. | The lethal trifecta for AI agents - Simon Willison's Weblog |
| allow | One of the three permission-rule tiers; it applies to read-only, side-effect-free operations that can be repeated without leaving a trace, and is auto-approved without human confirmation. | Configure permissions - Claude Code Docs |
| ask | One of the three permission-rule tiers; it applies to operations with side effects that are reversible and whose blast radius stays inside the local repo, and it requires human confirmation before running. | Configure permissions - Claude Code Docs |
| deny | One of the three permission-rule tiers; it applies to irreversible operations or ones whose blast radius reaches beyond local, refusing execution, and it is evaluated ahead of ask and allow. | Configure permissions - Claude Code Docs |
| Read(./.env) | A concrete permission-rule example from the course, putting the operation of reading the .env file directly on the deny list to keep secret contents from entering the conversation context. | Configure permissions - Claude Code Docs |
| Bash(git push:*) | A permission-rule example from the course; the Tool(specifier) form maps directly onto the exact tool name and call scope the host exposes to the model. | Configure permissions - Claude Code Docs |
| excessive agency | OWASP's risk category for a damaging action being triggered by an unexpected, ambiguous, or manipulated model output that should never have happened. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| Excessive functionality | One root cause of excessive agency: a single tool wears many hats (say, it can both read the inbox and send mail out), so one bad call has its blast radius magnified. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| Excessive permissions | One root cause of excessive agency: the tool itself does one thing, but the access it's granted goes past what the task actually needs. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| Excessive autonomy | One root cause of excessive agency: an Agent runs many steps in a row with no human check in the middle, so by the time a problem is noticed an irreversible action may already have run. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| lethal trifecta | The risk combination formed when access to private data, exposure to untrusted content, and the ability to communicate externally are all present at once, giving prompt injection a path to carry data out. | The lethal trifecta for AI agents - Simon Willison's Weblog |
| human-in-the-loop | One of OWASP's mitigations for excessive agency: high-impact actions must be approved by a human before they are taken. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| sandbox | An OS-level isolation mechanism that enforces filesystem and network isolation independently of the model's judgment, so damage stays contained even if prompt injection succeeds. | Configure the sandboxed Bash tool - Claude Code Docs |
| TOOLS | The single object in the course's example where each tool's schema fields and its actual execution handler live in one table, preventing the two sides from drifting apart. | Define tools — Claude API |
| toolSchemas | The tools parameter list derived from the TOOLS table and sent to the model; it holds only name/description/input_schema, not the handler. | Define tools — Claude API |
| toolHandlers | The execution-time lookup table derived from the TOOLS table, mapping each tool name to the function that actually runs it. | How tool use works — Claude API |
| github_repo_info | The third example tool the course implements; it queries basic info about a public GitHub repository and is the only tool that sends data outside the project. | How to implement tool use - Claude Platform Docs |
| SAFE_NAME | The regular expression in the course code used to validate the format of the owner/repo parameters, preventing an arbitrary string from being sent to the external network. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| MAX_TURNS | The cap on iterations set in the course's execution loop, preventing the model from endlessly requesting tool calls so the loop never terminates. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| PROJECT_ROOT | The constant in the course code for the project root directory; read_file and search_files both use it for a path-boundary check to prevent access to files outside the project. | Configure the sandboxed Bash tool - Claude Code Docs |
| recentCalls | The array in the course code that records the signatures of the last few tool calls, used to detect the pattern of 'the same tool with the same arguments called three times in a row.' | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| GITHUB_TOKEN | An optional credential read from an environment variable, used to raise the rate limit when calling the GitHub API; the call also works anonymously without it. | Configure permissions - Claude Code Docs |
| safety valve | The course's collective term for the set of guards added to the execution loop — MAX_TURNS, repeat-call detection, and the tools' internal path and format checks — each stopping a different runaway scenario. | LLM06:2025 Excessive Agency - OWASP Gen AI Security Project |
| function walk(dir) | The directory-walking function the course code implements itself, used inside searchFiles to recursively list files rather than shelling out to grep. | Configure the sandboxed Bash tool - Claude Code Docs |
| JSON Schema | The specification used to define a tool's input_schema; its title/description state intent and add no constraints, while keywords like enum and required actually validate values. | Creating your first schema - JSON Schema |
| grammar-constrained sampling | The technique behind strict mode: the platform constrains the model's token sampling to schema-valid outputs, so the generated tool inputs always match the JSON Schema. | Strict tool use — Claude API |
| tool_choice | The request object that controls how the model selects tools; setting disable_parallel_tool_use: true on it (when type is auto) makes the model call at most one tool per response. | Parallel tool use — Claude API |