What is the difference between function calling and MCP?

Function calling is the model capability: the model emits a structured request to call a named function. MCP is a standard way to package and serve tools so any compatible client can discover and call them. You write an MCP server once (tools, resources, prompts) instead of re-implementing the same functions for every model provider and framework.

How do agents get permission to use a user's Gmail or Slack?

With delegated OAuth: the user approves scopes once, and a token store keeps and refreshes the token. The model never sees the token; the runtime or a broker attaches it when the API call is made. Integration platforms such as Composio, Arcade and Pipedream Connect, and gateways such as AWS AgentCore Gateway with AgentCore Identity, handle consent, storage, refresh and revocation for you.

Quick Answer

How Do AI Agents Connect With APIs and External Tools?

Q: How do AI agents connect with APIs and external tools?

Through tool calling. The developer describes each tool (name, purpose, JSON input schema) to the model; when the model decides a tool is needed it returns a structured call instead of text; the agent's runtime executes the real API request with its own credentials and sends the result back to the model, which continues. In 2026 tools are usually exposed through the Model Context Protocol (MCP, current stable spec 2026-07-28), so the same server works in Claude, ChatGPT, Cursor and agent frameworks, and production agents route those calls through a gateway that holds credentials and enforces policy.

Published: October 18, 2026

The short answer

An AI agent connects to an API by asking for a tool call; your code, not the model, makes the request. The loop is always the same:

Describe the tool — name, what it does, a JSON schema for its inputs.
The model chooses — given the user’s goal, it returns call get_invoice(customer_id="C-102") instead of prose.
The runtime executes — it validates the arguments, attaches credentials, calls the real API.
The result goes back — the response (trimmed) is appended to the context; the model decides the next step or answers.

What changes between setups is how tools are packaged and where credentials and policy live. As of October 18, 2026 there are four common ways to do it:

Approach	How it works	Use it when
Native function calling	Tool schemas passed in the API request; your code dispatches calls	One app, one model provider, a few internal APIs
MCP server	Tools served over the Model Context Protocol; any MCP client discovers and calls them	Same tools used from several clients (Claude, ChatGPT, Cursor, your agent)
Integration platform	Composio, Arcade or Pipedream Connect provide thousands of prebuilt tools with per-user OAuth	Agents acting in many SaaS apps on behalf of many users
Tool gateway	AWS AgentCore Gateway, Cloudflare AI Gateway, an API gateway in front of MCP servers; holds credentials, enforces policy, logs	Production and enterprise deployments

Step by step: connecting an agent to an API safely

1. Wrap the API as a narrow tool

Expose create_refund(order_id, amount) rather than a generic http_request(url, body). Narrow tools are easier for the model to use correctly and far easier to secure. Return compact JSON, not whole web pages — every byte you return is tokens you pay for.

2. Serve it over MCP

The 2026-07-28 MCP specification is the current stable version and the largest revision since launch: a stateless core that scales on ordinary HTTP infrastructure, plus extensions for server-rendered UIs (MCP Apps) and long-running work. The official SDKs (TypeScript, Python and others; Ruby reached 1.0) let you define tools in a few lines. Once served over MCP, the same tool works in Claude, ChatGPT, coding agents and frameworks such as LangGraph or the OpenAI Agents SDK. Useful ready-made servers are listed in best MCP servers.

3. Handle authentication outside the model

Service credentials (your own database, internal APIs): keep them in a secrets manager and inject them at call time. See best secrets managers for AI agents.
User credentials (their Gmail, Slack, Salesforce): use delegated OAuth with a token store. This is what Composio, Arcade and Pipedream Connect sell. On AWS, AgentCore Identity does this and is free when used through AgentCore Runtime or Gateway.
Never paste a key into the system prompt: anything in context can be leaked by prompt injection.

4. Put a gateway and policy in front

A gateway gives you one place to log every call, rate-limit, and enforce rules such as “refunds over $25 need a human”. AgentCore Policy checks each tool call through AgentCore Gateway against your rules; ServiceNow’s AI Passport and similar control planes do the same across vendors (see ServiceNow AI Control Tower alternatives).

5. Require approval for irreversible actions

Payments, deletes, emails to customers: pause and ask. Frameworks with checkpoints (LangGraph, durable runtimes) can wait hours for approval and resume.

6. Test the tool, not just the model

Write evals that check the agent picks the right tool, passes valid arguments and recovers from API errors (timeouts, 429s, empty results). See how to monitor and evaluate AI agents in production.

Common mistakes

Too many tools. Dozens of overlapping tools confuse the model; load tools per task or use tool search.
Huge tool outputs. Return the five fields the model needs.
No idempotency. Retries can double-charge; pass idempotency keys on write calls.
One shared identity for every agent. Give each agent its own scoped credentials so you can revoke one without stopping all.

For where these agents run, see best platforms for building and deploying AI agents; for protocol background, MCP vs A2A vs ACP.

Last verified: October 18, 2026.