Tool calling, Spring functions, and Model Context Protocol

A tool lets a model request deterministic application work. The model proposes; trusted code validates, authorizes, executes, and returns a result.

Spring tools

class ClaimsTools {
  @Tool(description = "Get a claim by the authenticated claim id")
  ClaimView getClaim(String claimId) {
    return service.authorizedView(SecurityContext.user(), claimId);
  }
}

chatClient.prompt().user(text).tools(new ClaimsTools()).call().content();

Spring AI 2.0 ChatClient automatically registers ToolCallingAdvisor unless disabled. Avoid adding a second loop. Use user-controlled execution when the UI must show intermediate progress or approvals.

Tool contract

Define narrow names, precise descriptions, strict schemas, bounded output, idempotency, timeouts, error types, and returnDirect only when appropriate. Never expose a generic SQL, shell, HTTP, or “run anything” tool to untrusted requests.

Authorization

Derive user/tenant/permission from authenticated server context—not model arguments. Separate read and write tools. Require human approval for costly, destructive, external, or high-impact actions.

MCP

Spring AI 2.0 includes MCP Java SDK 2.0 aligned with the 2025-11-25 spec and supports MCP clients/servers, annotations such as @McpTool, resources, prompts, Streamable HTTP, and STDIO. MCP standardizes capability exchange; it does not make a remote server trusted.

Tool injection

Tool results and MCP content are untrusted input. Delimit them, ignore embedded instructions, validate return schemas, cap size, and record provenance.

Feynman check

The model may ask to use a wrench. The workshop manager checks identity, permission, tool condition, safe operating area, and the result.