Tool calling—letting AI not just chat but actually execute actions—is the core capability that makes Agents real. Over the past three years, it has evolved from "stuffing instructions into the Prompt" to OpenAI's June 2023 launch of function_call as a first-class API citizen, then to GPT-4o's structured-output forced decoding. Anthropic released MCP (Model Context Protocol—a unified standard for models to talk to external tools and data sources) in late 2024, effectively installing a universal socket for the whole industry: any model and any tool that plug in according to this protocol can call each other.
What This Is
Put simply, for AI to "do things," it first has to learn to "press the right buttons." The early approach was to have the model write text in its reply along the lines of Thought: I need to search / Action: search, then use regex to scrape it out—resulting in engineers spending five hours a day debugging format errors. In June 2023, OpenAI made tool calling a native API capability: after dedicated training (SFT—supervised fine-tuning on human-labeled data), the model could directly output structured JSON invocation requests. GPT-4o went further, enforcing at the decoding stage (the step where the model generates text) that outputs must conform to a JSON Schema (a format specification that describes data structure, like writing a "contract" for JSON), sharply cutting down hallucinated fields.
MCP goes one step further: it defines a standard protocol between models and external tools—think of it like a USB-C interface. Anthropic Claude, OpenAI, Google, and China's major models have all announced support. That means developers write an MCP tool once and every compatible model can use it, instead of adapting for each vendor separately.
Industry View
Supporters argue that MCP solves the biggest source of repetitive labor in Agent engineering. Anthropic, Cursor, Block and others have open-sourced hundreds of MCP servers covering database queries, file read/write, browser operations and more. China's Zhipu and Alibaba Cloud Bailian are following quickly.
The opposition is equally clear. First, the security boundary: once a model can freely invoke any MCP tool, the attack surface for prompt injection (malicious instructions hidden in web pages or documents that trick the model into dangerous actions) expands dramatically. Security firm Trail of Bits has published a list of design flaws in the MCP protocol. Second, the commercial game: although OpenAI has announced support for MCP, its own Responses API is still pushing a standard that isn't fully compatible, and the industry fears that the "universal protocol" will fracture into new islands.
Impact on Regular People
For enterprise IT: when procuring AI customer service or data analytics tools, one question to ask vendors is "do you support MCP?" If yes, switching models later won't require rebuilding integrations—migration costs drop significantly.
For individual professionals: tools you already use daily—Cursor, Claude Desktop—now ship with built-in MCP marketplaces. Non-technical users can point and click to give AI abilities like "read your local files" or "check your calendar," no coding required.
For the consumer market: MCP standardization will accelerate AI assistants moving from "chat toys" to "practical tools that can order food, edit documents, and check bills for you"—but the security risks land on ordinary users too. Giving AI too much permission is the same as handing a stranger the keys to your front door.