Quick answer: Function calling lets an application define functions a model can select and supply with structured arguments. MCP lets a host connect to portable servers, discover tools, resources and prompts, and invoke them through a standard protocol. MCP tools are commonly exposed to a model through function- or tool-calling behavior, so the technologies are complementary.
The choice is not “MCP or tools.” Both designs ultimately need a model to select an operation and trusted code to execute it. The difference is where the tool contract lives, how it is discovered and how many hosts can reuse it.
Comparison at a glance
| Dimension | Function calling | MCP |
|---|---|---|
| Tool definition lives in | Application request or code | MCP server, discovered by client |
| Discovery | Application supplies functions | Protocol lists server capabilities |
| Portability | Provider/application-specific wiring | Reusable across compatible MCP hosts |
| Connection | In-process or application-managed API | stdio or Streamable HTTP client-server relationship |
| Capabilities | Callable functions/tools | Tools, resources, prompts and protocol features |
| Ownership | Agent application team | Server owner can maintain integration contract |
| Authentication | Application-specific | MCP transport authorization plus downstream policy |
| Best fit | Small, app-owned tool surface | Shared or third-party integration ecosystem |
How function calling works
The application sends the model:
- function name;
- description;
- parameter schema;
- conversation input.
The model may return a function call with structured arguments. Application code validates and executes it, then returns the result to the model.
Function calling does not execute code by itself. It produces a structured request for the application. The application remains responsible for authentication, policy, errors and side effects.
How MCP tool use works
The host connects to an MCP server, initializes the protocol and lists tools. It can filter the available set and expose selected tool definitions to the model. When the model proposes a call, the host sends it through the MCP client to the server. The result returns through the host to the model.
From the model's perspective, an MCP tool can resemble any other tool. The protocol adds the external server relationship and discovery lifecycle.
Read what is MCP and how MCP works.
Use function calling when
- one application owns the tool and runtime;
- the tool is tightly coupled to product logic;
- latency and simplicity matter;
- only a small set of functions is needed;
- the integration will not be distributed to other hosts;
- application code already manages authorization and state.
Example: a SaaS support assistant calls get_current_user_plan inside the same backend. Publishing a server may add no value.
Use MCP when
- several compatible AI hosts need the capability;
- an external provider maintains the integration;
- dynamic tool discovery is useful;
- resources or prompt templates matter alongside tools;
- a local process or remote service needs a standard connection;
- customers expect to connect the service to their agent client.
Example: GitHub provides an official MCP server that exposes repository and issue capabilities across supported development experiences.
Use both together
An application can have:
- internal function tools for private product logic;
- hosted platform tools for search or code execution;
- MCP servers for third-party services;
- specialist agents exposed as tools.
OpenAI's tool documentation presents built-in tools, function calling and remote MCP as parts of the same capability landscape. Select each boundary according to ownership and reuse.
Tool design principles apply to both
Narrow job
Prefer create_refund_draft over execute_payment_action.
Clear description
Explain when the model should call the tool, important limits and what it returns.
Typed parameters
Use enums, required fields, formats and additionalProperties: false where the ecosystem supports it.
Structured results
Return stable fields and explicit error states. Avoid a large human-formatted blob when the agent needs two values.
Trusted validation
Never rely on schema generation alone. Verify user, tenant, resource, limits and policy in code.
Anthropic's official tool-writing guidance emphasizes evaluating tool use because descriptions and outputs directly affect agent performance.
Approval differences
With app-owned functions, you build approval behavior. With MCP, the host may have standardized approval UX. OpenAI's remote MCP integration requires approval by default unless configured otherwise and supports tool-specific policies.
Do not assume every MCP host behaves the same. Servers must enforce authorization regardless of host approval. The host confirmation proves user intent in that interface; it does not replace server-side permission.
Security comparison
Function-calling risks
- unsafe generated arguments;
- broad application credentials;
- prompt injection influencing tool choice;
- duplicate execution after retry;
- missing approval or audit.
Additional MCP risks
- malicious or compromised server;
- tool definitions changing remotely;
- sensitive context sent to a third party;
- OAuth audience and token handling;
- local package or executable compromise;
- registry and package identity confusion.
Use AI agent security best practices and MCP security best practices.
Context and tool count
Both approaches can overload the model with schemas. Limit tools by task. OpenAI's tool-search documentation recommends deferring large tool sets and grouping capabilities into clear namespaces or MCP servers. The official MCP client guidance similarly warns against loading every tool upfront.
Measure:
- selection accuracy;
- schema token use;
- list/discovery latency;
- unnecessary calls;
- result size;
- completion cost.
Migration from functions to MCP
- Preserve domain logic in a service layer.
- Identify tools worth sharing outside the application.
- Create task-oriented schemas and concise results.
- Implement an MCP server around the service layer.
- Add OAuth or local process controls.
- Test with more than one client.
- Evaluate behavior against the original function integration.
- Publish version and security support expectations.
Do not automatically expose every internal function. MCP is a product surface that requires curation.
Frequently asked questions
Does MCP replace function calling?
No. Hosts often turn discovered MCP tools into model-callable tools. Function calling remains the mechanism by which many models select structured actions.
Is MCP slower than function calling?
It can add discovery and a process or network hop. Cached tool lists and higher-level server tools can reduce other work. Benchmark the full task.
Can I use MCP without an agent?
Yes. A host can let users browse resources or invoke capabilities without a long-running agent loop.
Should an internal tool use MCP?
Use MCP when portability, server ownership or compatible host support justifies it. A direct function is often simpler for one private application.
Pushable AI
99helpers
Lynara
OpenWeave
SEOReport