Tools
A model cannot act by itself. A tool is an action it asks for, and the software around it carries out.
You can explain what a tool call is. You can name the main tools in Codex.
You can explain a tool call step by step and name the main tools in Codex, with the risk that each one carries.
You can describe how function calling works, why results return as context, and why tool output is untrusted input.
Layer three is tools. Tools give the model a way to act.
The third layer is tools. They let the model ask for actions that reach outside the context.
Layer three: callable functions. They turn a text generator into a system that reads and changes state.
A model has no hands
A model only writes text. It cannot open a file, run a program or send an email.
A tool gives it hands. A tool is an action that the software around the model can do. The model asks for the action in a set form. The software does it.
Each request to run a tool is a tool call.
On its own, a model produces text and nothing else. It cannot open a file, run a command or send a message.
A tool is an action that the harness can run for the model. A tool call is one request to run it. The model does not run anything. It writes a request, and the harness decides whether to carry it out.
This split is the most important idea in the course. The model proposes. The software and you decide.
Tool use is usually built as function calling. The harness gives the model a list of tools, each with a name, a description and a JSON schema for its arguments. The model can then emit a structured call instead of plain text.
The model never executes anything. It emits a call, the harness validates and runs it, and the result is appended to the context as new input. "Toolformer" (Schick et al., 2023) is an early paper on teaching models to decide when to call tools.
Several independent calls can be issued in one turn and run in parallel. The model then reads all the results together.
What happens when Codex reads a file
You ask
You type a request, such as: show me the files in this folder.
You send a request, for example: list the files in this folder.
The prompt joins the context, together with the tool definitions that the harness offers.
The model asks for a tool
The model cannot see your folder. So it writes a request to run a command that lists files.
The model cannot see your folder. It writes a tool call that asks to run a command which lists the files.
The model emits a structured call to the shell tool, with the command as its argument, and ends its turn.
The harness checks permission and runs it
The software checks the rules. If the rules allow the command, it runs on your laptop. If not, it waits for your yes.
The harness checks your permission settings. If the command is allowed, or you approve it, the harness runs it on your laptop.
The harness applies the permission mode and the sandbox rules, then executes the command and captures its output.
The result returns to the context
The list of files goes back to the model as new text. Now the model can see it, and it writes its answer.
The output returns to the context as new text. The model reads it and writes its answer.
The output is appended to the context and the model is called again. It may answer or request another tool.
New thread
- List the project files
What files are in this folder?
I ran `Get-ChildItem` to list the folder. It holds five folders and a README.txt.
Ask Codex to do something
Codex runs a listing command, reads the output and answers.
| Tool | What it does | Example |
|---|---|---|
| Shell command | Runs a command in PowerShell on your laptop | List the files in a folder |
| File edit | Reads a file and changes it | Create hello.txt in the project |
| Web search | Looks up pages from a search index | Check what a term means |
| Image input | Lets the model see a picture you give it | Read a table in a screenshot |
| Plugin and MCP tools | Connect Codex to other systems | Read a file in Google Drive |
Why the shell matters
The shell is the command line. In Codex on Windows it is PowerShell.
One tool, the shell, can do very many jobs. It can list files, run a small program and more. The shell is a very useful tool. It is also the tool to watch most closely.
The shell is the command line. In Codex on Windows it is PowerShell. A single shell tool can list files, run a script, search text and start other programs.
That range makes it the most useful tool in Codex. It also makes it the one to watch. Read each command before you approve it, and decline any command you do not understand.
A general shell tool trades safety for coverage. One tool replaces many dedicated ones, but its effects are hard to predict from the call alone, so the sandbox and the permission mode carry the safety load.
Dedicated tools such as a file editor have narrow, checkable effects. Agents mix both: dedicated tools for common edits, and the shell for everything else.
Tool output is untrusted input. A web page or a file that the agent reads can contain text written to steer it, and that text enters the context beside your own instructions. Lesson 09 covers this as prompt injection.
Key terms
- Tool
An action the software can run for the model.
An action the harness can run for the model.
A function with a name, a description and an argument schema that the harness exposes to the model.
- Tool call
One request from the model to run a tool.
One request from the model to run a tool.
A structured model output that names a tool and its arguments. The harness executes it.
- Shell
The command line. You type a command and the computer runs it.
The command line.
A command interpreter. As a tool, it gives the agent general access to the programs on the machine.
- MCP
A standard way to connect Codex to other systems, such as a file store.
Model Context Protocol. A standard way to connect an agent to other systems.
Model Context Protocol. An open standard for connecting an agent to external systems that expose tools and data (modelcontextprotocol.io).
- Plugin
A bundle of skills and connections that adds abilities to Codex.
A bundle of skills and connections to other systems.
A bundle of skills, MCP servers and hooks that you install in the app and call with
@.- PowerShell
The Windows command line. Codex uses it on your laptop.
The Windows command line that Codex uses.
The Windows shell in which the Codex agent runs natively, inside the Windows sandbox.
Check yourself
Who runs a tool: the model or the software around it?
The software. The model only asks.
The software, which is the harness. The model only writes the request.
The harness. The model emits a call, and the harness validates and executes it.
After a tool runs, where does the result go?
Back to the model as new text. Then the model writes its answer.
Back into the context as new text, so the model can read it and answer.
It is appended to the context, and the model is called again with the extended input.
Which is riskier: reading a file or changing one?
Changing one. A change can be hard to undo, so you should approve it.
Changing one. Writes and sends have side effects, which is why permissions gate them.
Changing one. Writes have side effects that reads lack, so the permission mode gates them first.
OtterBlock is not affiliated with OpenAI. Codex and ChatGPT are OpenAI products.