---
title: "Tool calling, Spring functions, and Model Context Protocol"
chapter: "15"
---

# Tool calling, Spring functions, and Model Context Protocol

A tool lets a model request deterministic application work. The model proposes;
trusted code validates, authorizes, executes, and returns a result.

## Spring tools

```java
class ClaimsTools {
  @Tool(description = "Get a claim by the authenticated claim id")
  ClaimView getClaim(String claimId) {
    return service.authorizedView(SecurityContext.user(), claimId);
  }
}

chatClient.prompt().user(text).tools(new ClaimsTools()).call().content();
```

Spring AI 2.0 `ChatClient` automatically registers `ToolCallingAdvisor` unless
disabled. Avoid adding a second loop. Use user-controlled execution when the UI
must show intermediate progress or approvals.

## Tool contract

Define narrow names, precise descriptions, strict schemas, bounded output,
idempotency, timeouts, error types, and `returnDirect` only when appropriate.
Never expose a generic SQL, shell, HTTP, or “run anything” tool to untrusted
requests.

## Authorization

Derive user/tenant/permission from authenticated server context—not model
arguments. Separate read and write tools. Require human approval for costly,
destructive, external, or high-impact actions.

## MCP

Spring AI 2.0 includes MCP Java SDK 2.0 aligned with the 2025-11-25 spec and
supports MCP clients/servers, annotations such as `@McpTool`, resources,
prompts, Streamable HTTP, and STDIO. MCP standardizes capability exchange; it
does not make a remote server trusted.

## Tool injection

Tool results and MCP content are untrusted input. Delimit them, ignore embedded
instructions, validate return schemas, cap size, and record provenance.

## Feynman check

The model may ask to use a wrench. The workshop manager checks identity,
permission, tool condition, safe operating area, and the result.