兔子API
use-case
Tool use and AI agent model guide
Direct answerAn agent is a controlled loop, not merely tool calling: structured schemas, least privilege, state, idempotency, timeouts, approval, audit, and replayable evaluation.
Updated · Reviewed
Minimal agent structure
An agent loop has a goal and state, model decision, structured tool call, tool result, and termination condition. The model only proposes calls; the application validates, authorizes, executes, and records them. Natural language must never become a privileged command directly.
Tool design
Keep schemas narrow and explicit, enumerate dangerous choices, and bound strings and resources. Separate read from write tools and use preview/confirmation for high-risk actions. Revalidate network targets, file paths, amounts, and recipients on the server.
State and recovery
Set per-run token, time, tool-count, and cost budgets and persist resumable state and idempotency keys. Handle timeout, partial success, duplicate callback, unavailable tools, and model changes, and provide human takeover and cancellation.
Evaluation
Replay traces and measure task success, wrong tools, privilege attempts, loops, human intervention, latency, and cost. Test prompt injection, forged tool results, exfiltration, and deletion; attractive final prose is not sufficient.
Production principles
Default to least privilege and reject unknown tools, with confirmation for sensitive actions. Record model version, prompt, tool arguments, results, and decision reasons and redact secrets and personal data from logs.
Use cases
- Multi-step execution
- Tool calling
- Long-running research and coding
API protocols
/v1/responses/v1/chat/completions/v1/messages
FAQ
Does a model tool_call mean the tool has already run?
Usually not. The model proposes a tool and arguments; the application validates schema, authorization, and side effects, executes it, and returns the result. Some provider-hosted tools return already executed results, so inspect response types and avoid duplicate execution.
How can an agent be stopped from looping and consuming unbounded tokens or money?
Set per-run limits for tokens, time, tool count, concurrency, and cost, define success and stop conditions, and persist state with idempotency keys. Repeated failure should trigger fallback, human takeover, or termination rather than unbounded retry.
How should an agent be evaluated—is a correct final answer enough?
No. Replay the full trace and measure task success, wrong tools, privilege attempts, loops, human intervention, latency, and total cost. Test prompt injection, forged tool results, exfiltration, cancellation, and recovery.
Should an agent directly access production databases, filesystems, and arbitrary URLs?
No. Use least privilege, separate read and write tools, and constrain paths, network targets, amounts, and recipients. High-risk writes need preview and approval. Redact secrets and personal data from logs and preserve audit and revocation controls.
Related guides
Official sources
- OpenAI Function Calling Official
- Anthropic Tool Use Official