Function calling vs MCP: what does each do, and when would you use both?

function calling is how a model asks your application to run a tool: you describe tools in the API request, and the model returns a structured call. The Model Context Protocol (Model Context Protocol) is how an application finds and connects to tools that someone else wrote and runs. They work at different layers, and most real agents use both. MCP supplies the tools, and function calling is how the model calls them.

Function calling (tool use)

• You put tool definitions in each request: a name, a description and a JSON schema for the input.
• The model returns a call such as get_order(order_id="A-1042"). It never runs anything.
• Your code executes it and sends the result back.
• Each model maker has its own request format (OpenAI's tools with function calls, Anthropic's tool_use and tool_result blocks), but the idea is the same.

MCP

• A standard protocol between an MCP host (the AI application, such as Claude Code or an IDE) and MCP servers (programs that offer capabilities). The host creates one MCP client per server.
• Servers offer 3 kinds of thing: tools (actions), resources (data to read) and prompts (templates).
• Messages are JSON-RPC 2.0. The client lists tools with tools/list and runs one with tools/call.
• Transports: stdio for a local server started as a process, Streamable HTTP for a remote one.

How they fit together

The host connects to a GitHub MCP server and calls tools/list. It passes those tools to the model as ordinary tool definitions. When the model returns a tool call, the host sends tools/call to the server and hands the result back to the model. The model does not know or care that MCP was involved.

When to use which

• Function calling alone: your own 2 or 3 tools inside one application. Defining them in code is simplest.
• MCP: tools you want to reuse across several applications (an IDE, a chat app, your agent), or tools another team or vendor maintains. Write the integration once, and every MCP host can use it.
• Both: the normal case for a serious agent. A few local functions, plus MCP servers for GitHub, a database or a ticket system.

Risks to mention

An MCP server is code you are trusting. Its tool descriptions go into the model's context, and its results can carry injected instructions. Use servers you trust, give them least privilege, and keep a person's approval on tools that write or delete.