Function tools defined: custom code vs sandboxed runtimes
A function tool is custom code an agent executes to interact with external systems, distinct from the sandboxed Code Interpreter or hosted search utilities.
The modern Agent Framework relies on a strict taxonomy where Function Tools serve as the primary mechanism for extending capabilities beyond basic conversation. The line that matters most runs between Hosted MCP Tools, which the provider runtime invokes on your behalf, and Local MCP Tools, which run on hosts you control along with their environment variables and secrets. Everything else follows from that split: who owns the failure when a tool goes down, and who can gate the call before the model sees the result.
These function definitions often require no subscription but demand precise architectural understanding. The environment includes experimental options like Bing Grounding and Azure AI Search, yet the fundamental ability for an agent to call custom code remains the most critical differentiator for enterprise deployment. Mastering this distinction prevents the common failure mode of treating all external connections as identical black boxes.
Defining the Core Taxonomy of Agent Function Tools
Function Tools vs Code Interpreter and File Search Definitions
Function Tools represent custom code that agents call during conversations to execute specific logic. This definition separates user-set actions from built-in capabilities like Code Interpreter, which executes code in a sandboxed environment, or File Search, designed to query uploaded documents. Built-ins extend agent memory and compute yet lack the arbitrary logic execution found in custom functions. Image Generation operates as a hosted capability within the Foundry and OpenAI Responses runtime.
| Feature | Function Tools | Code Interpreter | File Search |
|---|---|---|---|
| Primary Role | Custom logic execution | Sandboxed code runtime | Vector search on uploads |
| Definition Source | User-set code | Provider runtime | Provider runtime |
| Foundry Support | Yes | Yes | Yes |
Sandboxed interpreters maintain fixed safety boundaries while custom code demands rigorous validation before deployment. Bing Grounding provides web grounding via your own Grounding with Bing. Builders must weigh the complexity of maintaining custom repositories against the convenience of managed, built-in runtimes.
Versioning Hosted Tool Configuration with Foundry Toolboxes
Configuration management scales through Foundry Toolboxes, which serve as named, versioned bundles of these hosted tool settings. Grouping tools into a single toolbox definition allows for versioned management of hosted tool configurations within a Foundry project. A change to a web search parameter propagates consistently without manual re-deployment of individual function definitions.
Reliance on hosted runtimes introduces a dependency on external service availability. Failures trigger immediate internal alerts during local execution whereas hosted tool availability depends on the provider's runtime status. Tools marked experimental or preview emit an "ExperimentalWarning" the first time they are used in a process.
Hosted Shell Execution: Responses Runtime vs Copilot CLI
The OpenAI Responses runtime hosts a dedicated Shell tool distinct from the GitHub Copilot CLI's built-in utilities. This hosted shell execution runs within the provider's managed environment, contrasting sharply with the local file system and URL fetch capabilities embedded directly into the Copilot runtime. The Responses Shell centralizes command execution under provider governance while Copilot's approach relies on local permissions gated by a specific handler.
| Feature | Responses Shell | Copilot Built-ins |
|---|---|---|
| Execution Location | Hosted runtime | Local CLI environment |
| Access Model | Provider-managed | Local permission-gated |
| Scope | Remote command execution | File system and URL fetch |
Choosing the Responses client type enables remote command execution unavailable in standard chat completions. Centralization introduces a dependency on the provider's availability and audit logs rather than local control. The GitHub Copilot model offers immediate local context but lacks the standardized remote invocation pattern found in the OpenAI system. Multi-agent systems requiring consistent remote shell access cannot rely on local CLI tools alone. Operational consistency demands selecting the Responses path for hosted workflows.
Mechanics of Hosted and Local MCP Tool Execution
Hosted vs Local MCP Tool Execution Paths
Provider runtimes invoke MCP servers directly when executing Hosted MCP Tools, while Local MCP Tools run on custom hosts or local environments. This architectural split decides if tool invocation leans on provider infrastructure or stays inside a builder-managed process boundary. Hosted MCP Tools need the provider to keep active connections to external MCP servers, creating a dependency on network configuration and security policies set by the provider. Local MCP Tools operate on custom hosts or local environments, keeping execution paths within builder infrastructure and cutting reliance on provider runtime availability. Sensitive database credentials therefore stay on-premise while scalable web lookups apply hosted endpoints.
Control versus convenience drives the decision here. Hosted execution simplifies deployment yet restricts how much builders can customize the underlying execution environment. Local execution moves the operational burden to the builder, who must then handle server availability and versioning alone.
Configuring FoundryAgent and Copilot Studio Remote Tools
Tool definitions for FoundryAgent live on the remote agent definition, not the client, pushing configuration authority to the service boundary. Operators cannot declare capabilities locally under this constraint. They must modify the Foundry agent definition directly to enable specific functions like code interpretation or file search. Copilot Studio and A2A agents run on a remote service so their capabilities are configured on the remote agent rather than through the Agent Framework client. This distinction separates local orchestration logic from remote capability declaration, forcing builders to manage state across two distinct configuration surfaces.
Remote configuration models enforce strict separation between the orchestration layer and the execution environment. Governance policies applied at the service level remain intact regardless of the calling client's context. Validating remote definitions before deploying orchestration workflows helps avoid runtime failures caused by missing tool declarations.
Operationalizing Agent Composition Through Nested Function Calls
Converting Agents to Function Tools via Agent.as_tool
Specialized logic nests inside larger workflows when the OpenAI Agents SDK converts an inner agent into a callable function tool. Python implementations wrap the agent using the as_tool method, while .NET environments achieve identical structural results by applying Call.AsAIFunction to an AIAgent object.
Defining specific arg_name and description fields customizes the exposed interface so the outer agent invokes the tool with correct parameters. Rigid hierarchical systems enforce fixed roles like "researcher" or "analyst," yet this approach supports flexible multi-agent patterns where capabilities assemble ad-hoc based on task requirements. Industry movement favors these "multi-agent" systems where composition patterns and manager-style orchestration dominate architectural trends. Shifting architecture from monolithic prompts to composable infrastructure units demands precise governance on tool approval to prevent runaway execution loops.
Building Nested Workflows with WeatherAgent and Main Agent
Defining a specialized WeatherAgent with the instruction "You answer questions about the weather" using the gpt-4o-mini model starts the construction of nested workflows. This inner agent operates as a discrete unit within an AIProjectClient, remaining isolated until a parent orchestrator explicitly invokes it. Converting this agent into a callable function tool serves as the primary mechanism for composition, allowing a general-purpose Main Agent to delegate specific queries like "What is the weather like in Amsterdam?" without possessing native meteorological knowledge. Orchestration strategies align with this pattern where specialized planners hand off tasks to optimized sub-agents. Creating the main agent uses the same model and instructions "You are a helpful assistant.", using the inner agent as a tool.
Emphasis grows on "tool-using agents," where the capability of an agent to apply external tools serves as a primary metric for framework evaluation. Hosted tools sit alongside local function definitions within the framework, ensuring the inner agent can ground its responses in real-time data before returning results to the manager. Development convenience conflicts with production security; using DefaultAzureCredential simplifies local testing but introduces latency and unintended credential probing risks in live deployments. Engineers should transition to ManagedIdentityCredential to enforce strict identity boundaries. Added latency from round-trip communication between the main and inner agents limits this nested approach. Nested agent composition offers modular flexibility for builders but demands careful monitoring of execution time and token consumption.
Manager-Style Orchestration vs Isolated Sandbox Security
Manager-style orchestration separates from the isolated sandboxes found in security-focused platforms through architectural divergence. The OpenAI Agents SDK implements composition patterns where a central coordinator delegates tasks to specialized sub-agents using flexible handoffs. CrewAI formalizes this further by defining a "Crew" containing rigid roles like "researcher" or "analyst" to enforce structured collaboration. Flexible agent-to-agent communication takes priority over strict boundary enforcement in this approach. Platforms like OpenHands prioritize containment by executing code within virtual machine boundaries to prevent host compromise.
| Feature | Orchestration Focus | Isolation Focus |
|---|---|---|
| Primary Goal | Workflow Flexibility | Security Containment |
| Execution | Shared Process Space | Virtual Machine |
| Risk Profile | Logic Loops | Host Compromise |
| Example | OpenAI Agents SDK | OpenHands |
Security and isolation trends rise as platforms like OpenHands specifically market "isolated sandboxes" as a key feature for cloud coding agents, reflecting concerns about agent autonomy. Composition also costs visibility: nested handoffs obscure the exact network path of sensitive data, while pure isolation blocks collaborative behavior but guarantees that one compromised agent does not expose the broader system state. Builders must weigh the operational efficiency of shared memory against the catastrophic risk of unrestricted code execution. Selecting the correct topology depends entirely on whether the agent requires deep system access or merely coordinated logic.
Implementing Governance via Tool Approval and Error Resolution
Tool Approval Gates for Function and MCP Invocations
Tool Approval stops every function tool, hosted utility, and MCP call before the model sees the result. Because the mechanism lives inside the framework's chat client for both .NET and Python, the gate sits at the framework level rather than inside individual providers, and human-in-the-loop oversight applies whichever backend runs the call.
The cost is latency, since the agent thread freezes while waiting for a decision, and approval state has to survive sessions, streaming responses and middleware layers. Coverage is broad rather than total: the layer catches OpenAI, Azure and local models alike where provider-specific filters do not, but remote agents such as Copilot Studio run on distant services, bypass this gate and need their own governance configuration.
Configuring Human-in-the-Loop Decisions in .NET and Python
Gating tool invocation means telling the function-invoking chat client to halt until a human validates the request, with the policy routing pending function tools or MCP calls to an external review interface before the agent processes results.
- Initialize the chat client with a custom approval handler that suspends the session state.
- Map specific high-risk tools, such as shell execution or financial transactions, to mandatory review queues.
- Resume the agent loop only after the external system returns an allow or reject signal.
The pause must not drop streaming responses or persistent sessions, so context has to survive the wait and the review queue has to stay short enough that reviewers keep using it. What the added interaction time buys is a hard boundary in front of external actions: unauthorized state changes never reach production.
Troubleshooting Tool Not Supported and Invocation Errors
Fix "tool not supported" exceptions by checking if the local client path matches the provider's capability matrix.
- Confirm the selected client type supports the requested tool; the Responses client enables Code Interpreter while Chat Completion does not.
- Validate that Local MCP Tools are registered in the function-invoking chat client for .NET or Python runtimes.
- Check for
ExperimentalWarningemissions indicating preview features like Bing Grounding require specific resource bindings.
Operators must confirm agent-to-agent calls target remote agents ready to accept them, with capabilities declared on the remote side rather than in the client. Tools marked experimental or preview appear on the provider page. Builders restrict function tools to those the underlying model explicitly supports to avoid runtime crashes. Validating tool schemas against provider documentation ensures compatibility before deployment.
About
Diego Alvarez, Developer Advocate at AI Agents News, brings direct, hands-on expertise to the complex environment of function tools. His daily work involves building and benchmarking autonomous agents using frameworks like CrewAI, AutoGen, and LangGraph, where function calling serves as the critical bridge between static models and actionable outcomes. Unlike theoretical overviews, Diego's analysis stems from rigorous testing of how agents execute custom code, search files, and invoke MCP servers in real-world scenarios. At AI Agents News, an independent hub for engineers evaluating agentic systems, he focuses on practical implementation details often missed in marketing materials. This article dissects the Agent Framework's tool types by connecting technical specifications to actual developer needs, such as reliability, cost, and failure modes. By grounding every claim in runnable examples and honest comparisons, Diego ensures readers understand not just what these tools promise, but how they perform when building production-ready multi-agent systems.
Conclusion
Scaling agent architectures reveals that unmanaged function tools create brittle execution paths where a single schema mismatch halts the entire workflow. As the industry shifts toward multi-agent composition, the operational cost moves from writing code to maintaining strict compatibility matrices between disparate runtimes. You must treat tool definitions as versioned contracts rather than flexible suggestions. Relying on implicit support for features like Bing Grounding or Code Interpreter without explicit client validation invites runtime crashes that are difficult to trace in distributed systems.
The taxonomy is what makes such a check possible: a function tool is your code and your failure, a sandboxed runtime like Code Interpreter belongs to the client type you selected, and a hosted tool belongs to the provider whose status page you will be reading during an outage. Remote agents such as Copilot Studio declare their capabilities on the remote side rather than in your client, so the same manifest can be complete in one place and empty in another. Reading the tool list as three separate ownership boundaries, instead of one list of black boxes, is what keeps the failure modes legible.
Frequently Asked Questions
A function tool is custom code you define and the agent calls during a conversation. Code Interpreter runs code inside a provider sandbox and File Search queries uploaded documents, so neither one executes arbitrary logic of your own.
In Python you wrap it with as_tool(), and in .NET you apply Call.AsAIFunction() to an AIAgent, which turns a specialist such as a WeatherAgent into a callable the manager invokes with named arguments. The cost is a round trip: every delegation adds latency and token consumption to the parent loop.
An ExperimentalWarning emits the first time a preview tool is used in a process, so it appears once per run and not on every call. Treat it as a version signal rather than an error: preview features like Bing Grounding need specific resource bindings, and a missing binding shows up later as a tool not supported exception.
Foundry Toolboxes bundle hosted tool settings into versioned groups. This allows operators to propagate parameter changes consistently across agents, eliminating the need for manual re-deployment of individual function definitions within a project.
Hosted MCP tools depend entirely on external provider runtime availability. Unlike local tools that trigger immediate internal alerts, hosted failures rely on provider status, creating potential downtime risks for critical agent workflows.
References
