Agent Tools: Calls, Search, and Code

With GPT-5.6, we've released Programmatic Tool Calling, making this a good time to recap agent tools and ways to keep models focused as tool use grows.

Ask a support agent why order A-104 is late and it might read the order, call the carrier, and explain the delay. That exchange hides a loop: the model requests an action, a runtime executes it, and the result returns. Built-in tools, MCP, skills, Tool Search, and Programmatic Tool Calling change what the model sees and what comes back.

1. Tool Calling 101: the model asks; the application acts

With a client-owned function, the model doesn't run your code. It returns a tool name, JSON arguments, and call ID. Your application checks the request, runs the function, and returns function_call_output with the same ID.

The client-owned tool loop: no external action happens until your application executes step 3. Generated with GPT-Image-2 in Codex.

In Python, returning function_call_output hands control back to the model:

1import json
2from openai import OpenAI
3
4client = OpenAI()
5
6def get_order(order_id): return {"order_id": order_id, "promised_date": "2026-07-13"}
7
8order_tool = {
9    "type": "function", "name": "get_order", "strict": True,
10    "description": "Return the promised delivery date for an order.",
11    "parameters": {
12        "type": "object",
13        "properties": {"order_id": {"type": "string"}},
14        "required": ["order_id"], "additionalProperties": False,
15    },
16    "output_schema": {
17        "type": "object",
18        "properties": {
19            "order_id": {"type": "string"}, "promised_date": {"type": "string"},
20        },
21        "required": ["order_id", "promised_date"], "additionalProperties": False,
22    },
23}
24
25first = client.responses.create(
26    model="gpt-5.6", tools=[order_tool], input="Why is order A-104 late?",
27    tool_choice={"type": "function", "name": "get_order"},
28)
29call = next(item for item in first.output if item.type == "function_call")
30result = get_order(**json.loads(call.arguments))
31
32final = client.responses.create(
33    model="gpt-5.6",
34    tools=[order_tool],
35    input=[*first.output, {
36        "type": "function_call_output",
37        "call_id": call.call_id,
38        "output": json.dumps(result),
39    }],
40)
41print(final.output_text)

The harness repeats this loop until the model returns a final message. Strict schemas keep arguments well-shaped; the executor still checks permissions.

2. Tool execution can run in different places

Built-in tools, including web search, file search, and hosted shell, can run in OpenAI's infrastructure. A remote MCP server exposes and runs tools remotely; Responses supports these servers and OpenAI-maintained connectors, asking for approval by default before sharing data.

A skill bundles instructions and files. Attach it to hosted shell and the model can follow its procedure or run its scripts. It first sees the skill's name, description, and path, then reads SKILL.md when selected.

1carrier_mcp = {
2    "type": "mcp",
3    "server_label": "carrier",
4    "server_url": "https://example.com/mcp",
5    "allowed_tools": ["track_package"],
6    "require_approval": "always",
7}
8incident_shell = {
9    "type": "shell",
10    "environment": {
11        "type": "container_auto",
12        "skills": [{"type": "skill_reference", "skill_id": "skill_..."}],
13    },
14}
15
16response = client.responses.create(
17    model="gpt-5.6",
18    tools=[carrier_mcp, incident_shell],
19    input="Investigate why order A-104 is late using the incident skill.",
20)

The harness unifies these surfaces: MCP exposes remote tools, skills provide procedures and files, and the harness controls where calls run.

3. Tool Search: when context becomes the constraint

Every visible tool definition takes context. Names, descriptions, and schemas use input tokens, similar tools become harder to tell apart, and a large MCP catalog becomes a large prompt.

Tool Search lets compatible GPT-5.4-or-later models load deferred definitions only when needed:

1shipping = {
2    "type": "namespace", "name": "shipping",
3    "description": "Order tracking and delivery tools.",
4    "tools": [{
5        "type": "function", "name": "get_delivery_eta",
6        "description": "Return the ETA for an order.",
7        "defer_loading": True,
8        "parameters": {
9            "type": "object", "required": ["order_id"],
10            "properties": {"order_id": {"type": "string"}},
11            "additionalProperties": False,
12        },
13    }],
14}
15
16response = client.responses.create(
17    model="gpt-5.6",
18    input="When will order A-104 arrive?",
19    tools=[shipping, {"type": "tool_search"}],
20)

Hosted Tool Search chooses from tools declared in the request; client-executed search can return tools for the current tenant or project. Search adds a step, so small catalogs may gain little. A deferred function still exposes its name and description, while a namespace or MCP server can begin with one short description. Loaded tools are appended to preserve the cache prefix. Skills defer instructions and files; Tool Search defers callable schemas.

4. Programmatic Tool Calling for predictable multi-tool work

Direct calls return each result to the model. That's useful when a result changes the next decision, but simple joins, filters, and parallel lookups can fill context with data that code could reduce.

Programmatic Tool Calling lets GPT-5.6 write JavaScript that runs in a fresh, isolated V8 runtime. V8 runs JavaScript inside Chrome, but this isn't a browser or Node.js. It supports top-level await, loops, conditions, and parallel calls, with no package installation, direct network access, general-purpose filesystem, subprocesses, console, or persistent state.

Three direct calls compared with three parallel calls in the isolated V8 runtime. Generated with GPT-Image-2 in Codex.

When a program reaches a client-owned function, it pauses while your application runs the call; returning its call_id and caller resumes it. carrier_mcp can also pause for approval, and output_schema tells JavaScript which fields it can inspect.

1for tool in (order_tool, carrier_mcp):
2    tool["allowed_callers"] = ["programmatic"]
3
4response = client.responses.create(
5    model="gpt-5.6",
6    tools=[
7        order_tool,
8        carrier_mcp,
9        {"type": "programmatic_tool_calling"},
10    ],
11    input="Compare order A-104 with carrier status and return delay evidence.",
12)

Programs can call function and custom tools, MCP, apply_patch, shell, and code interpreter, but not web search or file search. Top-level Tool Search must load a deferred tool before the program starts; a running program cannot search for tools.

Keep calls direct when the next step needs model judgment, approval, citations, or a side effect. Use a program when clear rules let code return a smaller result without losing evidence. Hosted execution changes where work runs, Tool Search changes which definitions enter context, and programmatic calls change which results return. Combine them when an eval shows that correctness holds while tokens, latency, or cost improve.

Bonus: keep long tool loops on one connection

If an agent repeatedly switches between the model and client-owned tools, Responses WebSocket mode can reduce continuation overhead. The socket connects your harness to Responses; it doesn't make tools run faster. It accepts the same response.create fields for functions, MCP, Tool Search, and Programmatic Tool Calling, though the docs don't benchmark every combination. OpenAI has observed up to 40% faster execution in rollouts with 20 or more calls, so measure your workflow.

Try it with your agent

Take an Appshot of this article, open your agent project in Codex, and paste:

Use this article and the current codebase to upgrade this agent's tool path. Group large or infrequently used tools and enable Tool Search to defer them. Find bounded stages where Programmatic Tool Calling can run calls in parallel and return compact results. Keep semantic decisions, approvals, citations, and side effects as direct calls. Compare both paths for correctness, evidence coverage, tool success, tokens, latency, retries, and cost before changing production routing.