A2 · Tools and agent-computer interface (ACI)

Principle

The model is told about functions: look up information, act on a system, manipulate data. It asks for them to be called, your code runs them and returns the result. Anthropic argues that crafting this agent-computer interface deserves as much effort as designing one for humans.

The problem it solves

Tools that are too many, overlap or are poorly described make the model pick the wrong one and bloat its context, whatever the architecture on top.

When to use it

• The model must read or change a real system: database, API, files, browser.
• You want to standardise tool access across several agents or applications (MCP).

When to avoid it

• Every API is exposed as is, by the dozen: group them into a few tools aimed at high-impact tasks.
• An agent must chain many tools over large volumes of data: have it write code (C4).

Common pitfalls

The anti-patterns that misuse this pattern, best established first. Each sheet describes the symptoms, the public incidents and the remedies.

Tools and agent-computer interface

• AP12 · Tool overload — Every tool definition is loaded on every turn, overlapping ones included.
• AP13 · Unbounded tool output — A tool’s raw result goes straight into the context, whatever its size.
• AP19 · Excessive tool functionality — An open-ended tool (raw SQL, shell, free-form HTTP) where the task needs only a few bounded actions.
• AP10 · API-mirroring tools — Every endpoint of an API built for developers becomes a tool, with no grouping by task.
• AP11 · MCP by default — MCP is picked by reflex, where a documented CLI or a direct call would have done.
• AP14 · Context dumping — A large payload passes through the model’s context only to be copied into another tool.
• AP15 · Opaque tool errors — The failing tool returns a code or a stack trace, and nothing about what to fix.
• AP16 · Error-prone tool — The tool’s parameters make mistakes easy: an ambiguous name, a relative path, an argument already known.
• AP20 · Unsupervised text-to-SQL — The model turns the question into SQL run straight against the database, with no business definitions and no review.
• AP18 · Over-specialized tooling — A dozen bespoke tools, where generic access to clean documentation would have done.

Security and permissions

• AP67 · Unverified tool supply chain — MCP servers, extensions and skills installed with no vetting or pinning, and the agent’s full trust.
• AP62 · Overbroad identity and tokens — The agent acts under a shared, powerful identity, with tokens that cover far more than its task.
• AP68 · Secrets within the agent’s reach — Credentials are readable by the agent, in its context or its files, instead of being injected outside the model.
• AP70 · Agent browsing in the user’s logged-in session — An agentic browser reads any page with the user’s open email and banking sessions.

All anti-patterns

Synonyms by vendor

• Tool use (A. Ng, A. Gulli (ch. 5))
• Function calling (usage courant)
• Tool-based agents (AWS)
• Agent-computer interface (ACI) (Anthropic)
• MCP (standardisation) (Anthropic)

Neighbouring patterns

• A1 · Augmented LLM
• A3 · Structured output
• C1 · Agent loop (ReAct)
• C4 · Code agent

Sources

• Building effective agents — Anthropic (E. Schluntz, B. Zhang), 2024-12-19
• SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering — J. Yang et al., 2024
• SWE-bench: Can Language Models Resolve Real-World GitHub Issues? — C. Jimenez et al. (ICLR 2024), 2024
• A practical guide to building agents — OpenAI, 2025-04-17
• Introducing advanced tool use — Anthropic, 2025-11-24