Function tools defined: custom code vs sandboxed runtimes

A function tool is custom code an agent executes to interact with external systems, distinct from the sandboxed Code Interpreter or hosted search utilities.

The modern Agent Framework relies on a strict taxonomy where Function Tools serve as the primary mechanism for extending capabilities beyond basic conversation. While the OpenAI Agents SDK enables complex "multi_agent" orchestration patterns to compose specialized workflows, the underlying execution model demands clarity between provider-managed runtimes and local environments. Readers will learn to define the core differences between Hosted MCP Tools invoked by provider runtime and Local MCP Tools running on custom hosts. We will also dissect the mechanics of operationalizing agent composition through nested function calls, moving past simple prompts to structured software interaction.

Unlike the monthly fee for the Claude Code agent framework tool which offers terminal access, these function definitions often require no subscription but demand precise architectural understanding. The environment includes experimental options like Bing Grounding and Azure AI Search, yet the fundamental ability for an agent to call custom code remains the most critical differentiator for enterprise deployment. Mastering this distinction prevents the common failure mode of treating all external connections as identical black boxes.

Defining the Core Taxonomy of Agent Function Tools

Function Tools vs Code Interpreter and File Search Definitions

Function Tools represent custom code that agents call during conversations to execute specific logic. This definition separates user-set actions from built-in capabilities like Code Interpreter, which executes code in a sandboxed environment, or File Search, designed to query uploaded documents. Built-ins extend agent memory and compute yet lack the arbitrary logic execution found in custom functions. Image Generation operates as a hosted capability within the Foundry and OpenAI Responses runtime.

Distinct from individual tools, Foundry Toolboxes act as named, versioned bundles of hosted tool configurations managed within a project. This abstraction allows operators to deploy consistent toolsets across multiple agents without redefining each function. The rigid role hierarchy seen in structured Crews gives way to composable, granular tool definitions. Developers seeking flexible composition can apply patterns like `Agent.as_tool` to convert entire agents into callable functions for nested orchestration. Custom tools offer maximum flexibility yet remain subject to Tool Approval gates. A framework feature lets the system gate every tool invocation through a human-in-the-loop decision before the model receives the result. Sandboxed interpreters maintain fixed safety boundaries while custom code demands rigorous validation before deployment. Bing Grounding provides web grounding via your own Grounding with Bing. Builders must weigh the complexity of maintaining custom repositories against the convenience of managed, built-in runtimes.

Deploying Hosted MCP Tools and Foundry Toolboxes in Agents

Builders invoke Hosted MCP Tools as remote servers managed entirely by the provider runtime. This architecture offloads execution latency while Local MCP Tools run on custom hosts, granting full control over environment variables and secrets at the cost of local resource consumption. Sensitive database credentials remain on-premise while scalable web lookups apply hosted endpoints.

Configuration management scales through Foundry Toolboxes, which serve as named, versioned bundles of these hosted tool settings. Grouping tools into a single toolbox definition allows for versioned management of hosted tool configurations within a Foundry project. A change to a web search parameter propagates consistently without manual re-deployment of individual function definitions.

Reliance on hosted runtimes introduces a dependency on external service availability. Failures trigger immediate internal alerts during local execution whereas hosted tool availability depends on the provider's runtime status. Tools marked experimental or preview emit an "ExperimentalWarning" the first time they are used in a process.

The OpenAI Agents SDK enables this by allowing agents to act as tools for one another, creating nested orchestration patterns. A manager agent can delegate specific lookup tasks to a specialized subordinate agent configured with a specific toolbox. This composition strategy isolates failure domains, ensuring that a fault in a single hosted tool does not crash the entire multi-agent workflow.

Meanwhile, the OpenAI Responses runtime hosts a dedicated Shell tool distinct from the GitHub Copilot CLI's built-in utilities. This hosted shell execution runs within the provider's managed environment, contrasting sharply with the local file system and URL fetch capabilities embedded directly into the Copilot runtime. The Responses Shell centralizes command execution under provider governance while Copilot's approach relies on local permissions gated by a specific handler.

Choosing the Responses client type enables remote command execution unavailable in standard chat completions. Centralization introduces a dependency on the provider's availability and audit logs rather than local control. The GitHub Copilot model offers immediate local context but lacks the standardized remote invocation pattern found in the OpenAI system. Multi-agent systems requiring consistent remote shell access cannot rely on local CLI tools alone. Operational consistency demands selecting the Responses path for hosted workflows. Detailed orchestration patterns appear in the multi-agent composition documentation.

Mechanics of Hosted and Local MCP Tool Execution

Hosted vs Local MCP Tool Execution Paths

Provider runtimes invoke MCP servers directly when executing Hosted MCP Tools, while Local MCP Tools run on custom hosts or local environments. This architectural split decides if tool invocation leans on provider infrastructure or stays inside a builder-managed process boundary. Hosted MCP Tools need the provider to keep active connections to external MCP servers, creating a dependency on network configuration and security policies set by the provider. Local MCP Tools operate on custom hosts or local environments, keeping execution paths within builder infrastructure and cutting reliance on provider runtime availability.

Control versus convenience drives the decision here. Hosted execution simplifies deployment yet restricts how much builders can customize the underlying execution environment. Local execution moves the operational burden to the builder, who must then handle server availability and versioning alone.

Configuring FoundryAgent and Copilot Studio Remote Tools

Tool definitions for FoundryAgent live on the remote agent definition, not the client, pushing configuration authority to the service boundary. Operators cannot declare capabilities locally under this constraint. They must modify the Foundry agent definition directly to enable specific functions like code interpretation or file search. Copilot Studio and A2A agents run on a remote service so their capabilities are configured on the remote agent rather than through the Agent Framework client. This distinction separates local orchestration logic from remote capability declaration, forcing builders to manage state across two distinct configuration surfaces.

Builders choosing between hosted and local execution should note that Hosted MCP Tools invoke servers via the provider runtime, whereas Local MCP Tools require custom host management. Operational overhead defines the difference. Hosted configurations reduce local infrastructure burdens but limit customization to provider-supported features. Remote configuration models enforce strict separation between the orchestration layer and the execution environment. Governance policies applied at the service level remain intact regardless of the calling client's context. Validating remote definitions before deploying orchestration workflows helps avoid runtime failures caused by missing tool declarations.

Orchestration Patterns vs Isolated Sandboxes in Agent Runtimes

OpenAI Agents SDK enables multi-agent orchestration patterns that compose specialized agents into unified workflows. Manager-style orchestration uses a primary agent to delegate tasks via `Agent.as_tool` calls, creating complex dependency chains. Platforms like OpenHands prioritize security by running agents in isolated sandboxes on virtual machines. This architectural divergence forces a choice between workflow complexity and strict containment boundaries.

Credential authentication dynamics vary notably between architectures. Composed workflows depend on the specific implementation of the orchestration layer and the scoping mechanisms set by the developer. Composition patterns simplify high-level planning but may obscure the exact network path of sensitive data during handoffs. Builders must decide if the efficiency of automated handoffs outweighs the visibility loss inherent in nested agent-to-agent communication. Pure isolation prevents complex collaborative behaviors but guarantees that no single agent compromise exposes the broader system state.

Operationalizing Agent Composition Through Nested Function Calls

Converting Agents to Function Tools via Agent.as_tool

Specialized logic nests inside larger workflows when the OpenAI Agents SDK converts an inner agent into a callable function tool. This mechanism lets developers treat a WeatherAgent as a discrete utility without rewriting underlying code. Python implementations wrap the agent using the `as_tool` method, while.NET environments achieve identical structural results by applying `Call.AsAIFunction` to an AIAgent object.

Defining specific arg_name and description fields customizes the exposed interface so the outer agent invokes the tool with correct parameters. Rigid hierarchical systems enforce fixed roles like "researcher" or "analyst," yet this approach supports flexible multi-agent patterns where capabilities assemble ad-hoc based on task requirements. Industry movement favors these "multi-agent" systems where composition patterns and manager-style orchestration dominate architectural trends. Shifting architecture from monolithic prompts to composable infrastructure units demands precise governance on tool approval to prevent runaway execution loops.

Building Nested Workflows with WeatherAgent and Main Agent

Defining a specialized WeatherAgent with the instruction "You answer questions about the weather" using the gpt-4o-mini model starts the construction of nested workflows. This inner agent operates as a discrete unit within an AIProjectClient, remaining isolated until a parent orchestrator explicitly invokes it. Converting this agent into a callable function tool serves as the primary mechanism for composition, allowing a general-purpose Main Agent to delegate specific queries like "What is the weather like in Amsterdam?" without possessing native meteorological knowledge. Developers apply the `as_tool` method in Python, whereas.NET environments require `Call.AsAIFunction` to wrap the AIAgent instance. Orchestrations strategies align with this pattern where specialized planners hand off tasks to optimized sub-agents. Creating the main agent uses the same model and instructions "You are a helpful assistant.", using the inner agent as a tool.

Emphasis grows on "tool-using agents," where the capability of an agent to apply external tools serves as a primary metric for framework evaluation. Hosted tools sit alongside local function definitions within the framework, ensuring the inner agent can ground its responses in real-time data before returning results to the manager. Development convenience conflicts with production security; using DefaultAzureCredential simplifies local testing but introduces latency and unintended credential probing risks in live deployments. Engineers should transition to ManagedIdentityCredential to enforce strict identity boundaries. Added latency from round-trip communication between the main and inner agents limits this nested approach. Nested agent composition offers modular flexibility for builders but demands careful monitoring of execution time and token consumption.

Manager-Style Orchestration vs Isolated Sandbox Security

Manager-style orchestration separates from the isolated sandboxes found in security-focused platforms through architectural divergence. The OpenAI Agents SDK implements composition patterns where a central coordinator delegates tasks to specialized sub-agents using flexible handoffs. CrewAI formalizes this further by defining a "Crew" containing rigid roles like "researcher" or "analyst" to enforce structured collaboration. Flexible agent-to-agent communication takes priority over strict boundary enforcement in this approach. Platforms like OpenHands prioritize containment by executing code within virtual machine boundaries to prevent host compromise.

Security and isolation trends rise as platforms like OpenHands specifically market "isolated sandboxes" as a key feature for cloud coding agents, reflecting concerns about agent autonomy. Builders must weigh the operational efficiency of shared memory against the catastrophic risk of unrestricted code execution. Selecting the correct topology depends entirely on whether the agent requires deep system access or merely coordinated logic. OpenHands acts as a platform specifically designed to run agents in "isolated sandboxes" either on a virtual machine (VM) or in the cloud, emphasizing security isolation as a key metric.

Implementing Governance via Tool Approval and Error Resolution

Tool Approval Gates for Function and MCP Invocations

Tool Approval stops every function tool, hosted utility, and MCP call before the model sees the result. This mechanism lives inside the framework's chat client for both .NET and Python. It forces human-in-the-loop oversight no matter which backend runs the show. The control sits at the framework level, not within individual providers. Such a gate matters when external actions need explicit permission slips.

Latency increases because the agent thread freezes while waiting for a decision. Provider-specific filters might skip this, yet this governance layer catches OpenAI, Azure, and local models alike. Remote agents like Copilot Studio bypass this specific gate since they run on distant services. Those platforms need their own separate governance configs. The full pattern details how these approvals interact with sessions, streaming, and middleware.

Configuring Human-in-the-Loop Decisions in.NET and Python

Gating tool invocation means telling the function-invoking chat client to halt until a human validates the request. This approval pattern acts as a client-side interceptor in both .NET and Python. It ignores the specific LLM provider as long as tools execute locally. Any provider invoking tools locally works with this setup. Developers define a policy routing pending function tools or MCP calls to an external review interface before the agent processes results.

1. Initialize the chat client with a custom approval handler that suspends the session state.
2. Map specific high-risk tools, such as shell execution or financial transactions, to mandatory review queues.
3. Resume the agent loop only after the external system returns an allow or reject signal.

The complete implementation handles how these pauses affect streaming responses and persistent sessions. Context must survive the wait time. Strict gating fights against latency requirements. Teams balance review needs with usability to keep agents effective. This method lets teams wrap complex agents as tools, similar to patterns using `Agent.as_tool` for composition. A hard security boundary surrounds external actions. Interaction time grows, yet unauthorized state changes vanish from production environments.

Troubleshooting Tool Not Supported and Invocation Errors

Fix "tool not supported" exceptions by checking if the local client path matches the provider's capability matrix.

1. Confirm the selected client type supports the requested tool; the Responses client enables Code Interpreter while Chat Completion does not.
2. Validate that Local MCP Tools are registered in the function-invoking chat client for .NET or Python runtimes.
3. Check for `ExperimentalWarning` emissions indicating preview features like Bing Grounding require specific resource bindings.

Operators must confirm agent-to-agent calls target remote agents ready to accept them. Copilot Studio and A2A agents run on remote services where capabilities live on the remote agent, not the client. Tools marked experimental or preview appear on the provider page. Builders restrict function tools to those the underlying model explicitly supports to avoid runtime crashes. Validating tool schemas against provider documentation ensures compatibility before deployment.

References

• AI Agent Tools : Tutorial & Examples: AI agent