Code calling is all you need

Reddit r/AI_Agents 06/16/26, 06:28 PM Tools

code-calling function-calling llm tool-use framework security efficiency

Summary

Argues that using code generated by LLMs to call external tools (code calling) is more efficient and capable than traditional JSON-based function calling, but requires secure sandboxing. The author is building a framework for this approach.

**Hi there,** I am here to open a discussion about **function calling** (the classic approach using JSON) and **code calling** (or whatever you want to call it, code generated by an LLM that calls external tools). Both work, but in most cases, code seems to be **much more efficient, capable, and fast**. This is because it can make several calls in parallel or save values as variables and pass them to another tool without iterating back to the LLM. The big issue related to code calling is security; you need a good sandbox to push it to production. I think the pure approach using code could be the future. In fact, I am working on a framework for it, and I am open to collaborating with anyone who wants to join!

Original Article

Similar Articles

What is Codemode

Armin Ronacher

Armin Ronacher explains Codemode, a new Pi 1.0 feature that lets LLMs orchestrate complex tool calls from JavaScript running in a sandboxed WASM/QuickJS harness environment, revisiting his earlier "code is all you need" argument for agent tool design.

Quoting Jeremy Morrell

Simon Willison's Blog

Jeremy Morrell suggests that LLMs and modern sandbox primitives create opportunities for extensible software on the web, allowing users to safely extend applications and gain enhanced capabilities.

Mistral Patent for "Code implemented tool calls"

Hacker News Top

Mistral has been granted a patent for a method that uses an LLM to generate code blocks encapsulating tool calls, executing them in a sandbox and pausing for client-side results when needed.

Your LLM shouldn’t be your coding-agent workflow

Reddit r/openclaw

Argues that LLMs should be used for reasoning within coding-agent workflows, while deterministic infrastructure handles queues, state, retries, and recovery, so the process doesn't break when usage limits hit.

Giving LLMs exec() power is a security nightmare. I built a open-source AST-based guardrail to stop malicious agent execution.

Reddit r/AI_Agents

Introduces ast-guard, an open-source AST-based security tool that prevents malicious code execution from LLM-generated Python strings by parsing them into an abstract syntax tree and applying node-level whitelisting and context-aware safety checks.