Introduction to AI Agents: Tools, Tool Calling and the Agent Loop

In Topic 04, you learned how a chatbot uses context and conversation history. Now let's take the next step: How can an AI move beyond answering questions and actually perform tasks?

Imagine asking an AI:

Build a landing page for my coffee shop and save the files.

A normal LLM might generate HTML code in its reply. But it cannot save files by itself.

An AI agent can use tools provided by the application to create directories, write files, inspect the results, and continue until the task is complete.

1. LLM vs. AI agent

Remember this simple analogy:

• LLM = Brain: Understands requests, reasons, and generates text.
• Tools = Hands: Let the application perform operations.
• Application = The system that connects the brain to the hands.

The key difference:

LLM:   "mkdir portfolio"  → produces text
Agent: calls createDirectory("portfolio") → creates the folder

Remember: Knowing how to do something is not the same as actually doing it.

2. What is a tool?

A tool is simply a normal function in your code that the model is allowed to request.

Examples:

The function itself is ordinary code. The AI-related part is providing a definition that tells the model what the function does and what inputs it accepts.

A tool definition has three main parts:

For example, a calculator tool could accept:

{
  "operation": "multiply",
  "a": 53,
  "b": 29
}

The model converts the user's natural language into structured inputs that normal code can understand.

3. How does tool calling work?

Suppose the user asks:

What is 53 × 29?

The model does not need to calculate the answer itself. It can request the calculator tool.

Notice something important: the model requests the tool; your application executes it. The model does not directly run your JavaScript function.

Also, one user question may require multiple calls to the LLM: one to request the tool and another to produce the final answer after receiving the result.

4. The tool-calling loop

Sometimes one tool is not enough. The model may need to use a result to decide what to do next.

The pattern is:

Think → Act → Observe → Think again

For example:

Convert $120 to Indian rupees, then split it equally between 6 people.

Assume the exchange rate returned by the currency service is ₹83 per dollar.

1. The model requests convertCurrency(120, "USD", "INR").
2. The application runs it and gets ₹9,960.
3. The model sees that result and requests calculate("divide", 9960, 6).
4. The application returns ₹1,660.
5. The model explains that each person gets ₹1,660.

The loop continues until the model returns a final answer or the application stops it.

5. How does the model choose a tool?

Imagine you provide these three tools:

• calculate()
• getCurrentWeather()
• convertCurrency()

The user sends a request to one endpoint, such as POST /api/chat. The model decides which tool is appropriate based on the user's request and the tool definitions.

Clear tool descriptions help the model choose correctly.

Why use a schema instead of just asking for JSON?

Telling a model "reply in JSON" is only an instruction. It may produce invalid JSON or an unexpected value.

A schema defines the contract: expected fields, types, and allowed values.

For example:

{
  "operation": "multiply",
  "a": 53,
  "b": 29
}

The schema could restrict operation to add, subtract, multiply, divide, mod, or power, preventing unexpected values such as "multiplication".

In the course example, strict: true, enum, and additionalProperties: false help enforce the expected argument shape. Your application should still validate inputs and handle errors.

Memory trick: The model understands the intent; the schema defines the shape.

6. Information tools vs. action tools

This distinction is important when designing production systems.

Information tools

Read or retrieve information.

• Check order status
• Get weather
• Read a file
• Check stock levels

Action tools

Change something in the real world.

• Issue a refund
• Send an email
• Book a ticket
• Write a file

A wrong information call might produce an incorrect answer. A wrong action call might send money to the wrong person or delete important data.

That's why action tools need stronger permissions and safeguards.

7. Agent vs. workflow

Both can complete tasks, but they differ in who decides the steps.

Workflow: fixed steps

1. Create directory
2. Write index.html
3. Write style.css
4. Write script.js

The developer defines the sequence in advance.

Agent: chooses steps

Goal: Build a coffee shop website.

The model decides what to do next,
uses tools, checks the results,
and continues until finished.

The developer defines the goal and available tools; the model chooses the steps.

An agent is more flexible, but that flexibility means you need controls to stop mistakes and loops.

A practical system can combine both: use a fixed workflow for a refund and an agent to interpret the customer's message.

8. Building a website agent with Node.js

The course example creates a website using four tools:

createDirectory(path);
writeFile(path, content);
readFile(path);
listFiles(path);

The user might ask:

Build a landing page for a premium coffee shop called BrewLab.

The agent can create a folder and write the HTML, CSS, and JavaScript files, then inspect the generated files before reporting completion.

The important idea is that the model can write code, but tools let it save and verify that code.

Why not give the agent a terminal?

A general-purpose runCommand(command) tool could give the model access to far more than it needs, including environment variables, secrets, source code, and the network.

Instead, provide narrow tools that can only access the workspace needed for the task.

What is a sandbox?

A sandbox is a restricted area where the agent is allowed to operate.

project/
├── src/               Not allowed
├── .env               Not allowed
└── generated-sites/   Allowed

A path such as ../../.env attempts to escape the allowed folder. This is called path traversal.

The application must resolve and validate every path before reading or writing files. A system prompt saying "stay inside this folder" is not enough; the backend must enforce the restriction.

9. Three essential safety controls

1. Least privilege

Give each tool only the permissions it needs. Prefer writeFile() inside a restricted workspace over unrestricted shell access.

2. Step limits

An agent might keep requesting tools indefinitely. Set a maximum number of rounds; the course example uses MAX_STEPS, defaulting to 10 in its Node.js and Python loop.

3. Human in the loop

Require human approval for risky actions, such as large refunds, payments, deleting data, or changing security permissions.

Golden rule: The model proposes an action. The application decides whether it is allowed to run.

10. Interview revision

"What is an AI agent?"

An LLM-based system that uses tools and a loop to work toward a goal.

"What is tool calling?"

The model requests a function with structured arguments; the application executes it and returns the result.

"What is the agent loop?"

Think, act, observe, and repeat until done or stopped.

"What is the difference between a tool and a tool definition?"

The tool is the actual function; the definition describes its name, purpose, and parameters to the model.

"Why use a schema?"

To define expected argument fields, types, and allowed values.

"Agent vs. workflow?"

A workflow has predefined steps; an agent chooses steps toward a goal.

"What is path traversal?"

Using paths such as ../ to escape an intended directory.

"Why limit agent steps?"

To prevent endless loops, unnecessary API costs, and requests that never finish.

"What is human in the loop?"

A person reviews or approves an action before it runs.

11. Remember Topic 05 forever

Repeat until the goal is complete or a safety limit stops the agent.

The course's mental model is:

LLM + tools + environment + observations + loop + goal = AI agent

A chatbot primarily answers. An agent can decide, act, inspect the result, and continue working toward a goal.

Quick quiz

1. Who actually executes a tool call?

• The LLM directly
• The application
• The user

2. What are the three parts of a tool definition?

• Name, description, parameters
• Prompt, memory, context
• URL, password, database

3. What is the difference between a workflow and an agent?

• A workflow always uses AI
• An agent has no tools
• A workflow has predefined steps; an agent chooses steps

4. Which is an information tool?

• Issue a refund
• Check order status
• Delete a customer

5. What protects a workspace from paths like ../../.env?

• A system prompt alone
• The model's training
• Backend path validation and sandboxing