# Protocols, Tools and Interoperability This area covers how a model reaches the world outside its own text. On one side sit the descriptions that tell a model what an action does and what arguments it takes. On the other sit the actual endpoints, credentials, browsers, and terminals that carry the action out. Between them sit the protocols that let tools, agents, and applications connect without every single pair being wired together by hand. It matters because integration, not intelligence, is where most agent projects stall. A capable model with no clean way to authenticate, no schema for its output, and no protection against repeating an action becomes an expensive text generator. These concepts also decide blast radius. Whether a mistake ends as a harmless retry or as an incident depends on sandboxing, rate limits, permission scopes, and whether the operation was safe to run twice. ## Start here 1. [API](/en/glossary/api) 2. [REST API](/en/glossary/rest-api) 3. [Tool Calling](/en/glossary/tool-calling) 4. [Tool Schema](/en/glossary/tool-schema) 5. [JSON Schema](/en/glossary/json-schema) 6. [Model Context Protocol](/en/glossary/model-context-protocol) 7. [MCP Server](/en/glossary/mcp-server) ## How the pieces fit together Work from the inside out. A tool schema describes an action in a form the model can read, and JSON Schema is usually the notation. When the model picks an action it emits a structured call, and application code, never the model itself, performs it. That code talks to an API, authenticates with a key or a delegated grant, and respects whatever limits the provider sets. Protocols standardize the plumbing so one server can expose the same tools to many different clients instead of each application writing its own adapter. Webhooks reverse the direction entirely, letting an outside system start work rather than wait to be asked. ## Where to start Begin with ordinary web plumbing, since none of the agent-specific layers replace it. Understand what an API is, how a REST interface is shaped, and how a static key differs from a delegated authorization in what it grants and how it is revoked. Then read tool schemas and structured output together, because they are the same idea pointed in two directions: one constrains what the model may ask for, the other constrains what it hands back. Protocol specifications are worth reading only after that, since otherwise they look like ceremony around a problem you have not felt yet. ## Being reachable by agents Interoperability runs both ways, and the outbound half is easy to forget. If you publish anything public, other people's agents are already reading it, and how they read it is now partly your decision. Machine-readable descriptions of your site, crawl directives aimed at automated readers, and clean structured data all shape whether an agent quotes you accurately or invents a version of you. Agent cards extend the same idea to services that want to be discovered and called by other agents. Treat all of it as part of your interface rather than an afterthought, because the consumer on the other end does not skim. ## What people get wrong Retries are the classic one. Models produce nondeterministic sequences and networks fail halfway, so any action that creates, sends, or charges needs an idempotency key, or the same message goes out three times. Permissions are the second. A single long-lived credential with full account access is convenient right up until an agent takes an action nobody intended, and scoped, revocable grants cost very little to set up at the start. The third is reaching for browser control when an API already exists. Driving an interface is slower, breaks with every redesign, and belongs in the fallback position rather than the default one. ## Commonly confused ### Function Calling vs Tool Calling The same mechanism under two names, with tool calling now the broader term because the actions involved reach far beyond functions in your own code. ### MCP Server vs MCP Client The server exposes tools and data, while the client is the application holding the model and requesting them, so one client usually talks to several servers. ### API Key vs OAuth A key identifies your application and usually carries broad standing access, while OAuth grants scoped, revocable permission on behalf of a specific user. ### Browser Automation vs Web Scraping Scraping is about extracting content from pages, while browser automation is about performing actions in them, and only one of the two needs to click anything. ## Every term in Protocols, Tools and Interoperability - [Agent Card](/en/glossary/agent-card): An agent card is a machine readable metadata document that describes an AI agent to other agents, listing its name, address, capabilities, supported input and output formats, and how to authenticate with it. The term comes from the A2A protocol, where cards are published at a well known path on the agent's own domain so that clients can discover them automatically. - [Agent to Agent Protocol](/en/glossary/agent-to-agent-protocol): An agent to agent protocol is a standard that lets independent AI agents, built by different teams on different frameworks, discover each other and exchange tasks over a network. The best known example is A2A, originally published by Google and later donated to the Linux Foundation. Agents describe themselves in a published metadata document and communicate without exposing their internal tools or reasoning. - [API](/en/glossary/api): An API, or application programming interface, is a defined way for one piece of software to request something from another. It specifies the available operations, the inputs each expects, the outputs it returns, and the errors it can raise, so that two systems can work together without either needing to know how the other is built. - [API Key](/en/glossary/api-key): An API key is a secret string that a client sends with each request to identify itself to a service. It is the simplest form of API credential, easy to issue and to use, but it carries no user identity, usually does not expire on its own, and grants whatever it is permitted to do to anyone who holds it. - [API Versioning](/en/glossary/api-versioning): API versioning is the practice of labeling an interface so that changes can be introduced without breaking existing clients. The version may appear in the URL path, in a request header, or in a dated release identifier. Its purpose is to let a provider evolve while callers written against an older contract keep working unchanged. - [Batch Request](/en/glossary/batch-request): A batch request bundles several operations into one API call so they are transmitted and processed together. Bulk endpoints accept an array of records for a single operation, while generic batching accepts a list of independent sub-requests. Batching reduces per call overhead and round trips, at the cost of more complicated partial failure handling. - [Bearer Token](/en/glossary/bearer-token): A bearer token is a credential whose mere possession grants access, presented in an HTTP Authorization header with the Bearer scheme. The server validates the token and needs no further proof of identity, which is what the term bearer means. Bearer tokens are defined for OAuth 2.0 in RFC 6750 and are usually short lived. - [Browser Automation](/en/glossary/browser-automation): Browser automation is the programmatic control of a web browser, driving navigation, clicks, typing, and data extraction through code. It is used for testing, for repetitive web tasks, and increasingly to let AI agents operate websites that offer no API. Modern tools control real browser engines, so pages behave the same way they do for an ordinary visitor. - [Callback URL](/en/glossary/callback-url): A callback URL is an address that one system gives another so the second system can direct a browser or a request back to it once something finishes. It appears in authorization flows as the redirect target after a user approves access, and in asynchronous APIs as the endpoint that receives a result when a long running job completes. - [Capability Discovery](/en/glossary/capability-discovery): Capability discovery is the exchange at the start of a connection in which each side declares what optional features it supports, so both can agree on a working subset. It lets a protocol evolve without breaking older peers, because a participant simply does not use a feature the other side did not advertise. The Model Context Protocol performs this during initialization. - [Computer Use](/en/glossary/computer-use): Computer use is a capability in which an AI model operates a graphical computer interface directly, viewing the screen as images and issuing mouse and keyboard actions. It lets a model work with any application, including software that exposes no API at all, at the cost of being slower and less reliable than calling a programmatic interface. - [Connector](/en/glossary/connector): A connector is a prebuilt, reusable component that links a platform to one specific external service, packaging the authentication, endpoints, and data mapping that an integration to that service requires. Users typically enable one and sign in rather than writing code. The term is vendor specific, and the depth of what a connector actually does varies widely between products. - [Cursor](/en/glossary/cursor-pagination): A cursor is an opaque marker returned with a page of results that tells the server where the next page should begin. Instead of counting a numeric offset, the client passes the cursor back and the server resumes reading immediately after the encoded position. The same idea appears as a continuation token in streaming and event APIs. - [Deprecation Policy](/en/glossary/deprecation-policy): A deprecation policy is a provider's published commitment about how an API feature is retired: how much notice is given, how the warning is communicated, and how long the feature keeps working after being marked obsolete. Deprecated means discouraged and scheduled for removal, not yet removed. Clear policies let integrators plan migrations instead of reacting to outages. - [Elicitation](/en/glossary/elicitation): Elicitation is a Model Context Protocol feature that lets a server ask the connected client to collect additional information from the user during an operation. The server sends a request describing what it needs, the client presents it and returns the user's answer or a decline. It exists so servers can pause for missing input rather than failing or guessing. - [Function Calling](/en/glossary/function-calling): Function calling is a capability in which a language model, given descriptions of available functions, responds with a structured request naming one of them and supplying arguments, rather than replying in prose. The application receives that request, executes the function itself, and returns the result to the model. The model never runs any code. - [GraphQL](/en/glossary/graphql): GraphQL is a query language and server-side runtime for APIs in which the client states exactly which fields it wants and receives a JSON response shaped to that request. It was released publicly by Facebook in 2015 and is now stewarded by the GraphQL Foundation. A single endpoint typically serves queries, mutations, and subscriptions against a strongly typed schema. - [gRPC](/en/glossary/grpc): gRPC is an open source remote procedure call framework originally developed at Google and now hosted by the Cloud Native Computing Foundation. Service methods and message types are declared in a Protocol Buffers interface file, compiled into client and server code, and transported over HTTP/2 with binary serialization. It supports unary calls and streaming in either or both directions. - [Headless Browser](/en/glossary/headless-browser): A headless browser is a full browser engine running without a visible window, controlled entirely by code. It loads pages, executes JavaScript, applies styles, and builds the same document as a normal browser, but renders offscreen. This makes it the standard way to run automated tests and page fetching on servers, where no display exists at all. - [HMAC Signature](/en/glossary/hmac-signature): An HMAC signature is a keyed hash computed over a request payload with a secret shared by sender and receiver, sent alongside the request so the receiver can recompute it and confirm the payload is authentic and unmodified. HMAC is defined in RFC 2104. It is the standard way providers let receivers verify that a webhook genuinely came from them. - [Idempotency](/en/glossary/idempotency): An operation is idempotent when performing it more than once has the same effect as performing it once. This property matters whenever a request might be delivered twice, because a network failure often leaves the caller unsure whether the first attempt succeeded. Idempotency is what makes a safe retry possible without creating duplicates. - [Integration](/en/glossary/integration): An integration is a working connection between two systems that lets data or actions flow between them. It is the built result rather than the interface that made it possible, and it typically includes authentication, data mapping, error handling, and some way of keeping the two sides in step over time. - [JSON Schema](/en/glossary/json-schema): JSON Schema is a specification for describing the structure of JSON data, stating which fields exist, what types they hold, which are required, and what values are allowed. It is used both to validate documents automatically and to document them. In AI systems it is the usual way to define tool parameters and to constrain model output. - [JSON-RPC](/en/glossary/json-rpc): JSON-RPC is a lightweight remote procedure call protocol in which requests and responses are JSON objects. A request names a method, supplies parameters, and usually carries an identifier that the matching response echoes. Version 2.0 is transport agnostic, running over HTTP, WebSocket, standard input and output, or any other message channel. - [llms.txt](/en/glossary/llms-txt): llms.txt is a proposed convention in which a website publishes a plain markdown file at the path /llms.txt containing a short, curated description of the site and links to its most useful pages. The intent is to give language models a clean overview instead of leaving them to parse navigation and layout. It is a community proposal rather than an adopted standard. - [Long Polling](/en/glossary/long-polling): Long polling is a technique in which a client sends an HTTP request and the server intentionally holds it open until new data is available or a timeout expires. The client then immediately issues another request. It approximates server push using only ordinary request and response semantics, and predates widely available streaming transports. - [MCP Client](/en/glossary/mcp-client): An MCP client is the component inside an AI application that maintains a connection to a single MCP server and relays messages between that server and the application. The application that creates one or more clients is usually called the host. Clients handle version and capability negotiation, request routing, and returning tool results to the model. - [MCP Server](/en/glossary/mcp-server): An MCP server is a program that exposes tools, data resources, or prompt templates to AI applications using the Model Context Protocol. It wraps an underlying system such as a database, file store, or web service, describes what it can do in machine readable form, and executes the requests that a connected client sends to it. - [Model Context Protocol](/en/glossary/model-context-protocol): Model Context Protocol is an open standard that defines how AI applications connect to external tools and data sources. It specifies a client and server architecture in which servers expose capabilities such as callable tools, readable resources, and reusable prompts, and clients consume them over a common message format. It was originally published by Anthropic and is developed openly as a public specification. - [Mutual TLS](/en/glossary/mutual-tls): Mutual TLS is a configuration of the TLS protocol in which both parties present certificates during the handshake, so the server authenticates the client as well as the client authenticating the server. Ordinary HTTPS authenticates only the server. Mutual TLS is widely used between internal services and for high assurance API access. - [OAuth](/en/glossary/oauth): OAuth is an open standard that lets an application act on a user's behalf inside another service without ever seeing that user's password. The user approves a limited scope of access at the service itself, and the application receives a token that grants only what was approved and can be revoked at any time. OAuth 2.0 is the version in general use. - [OpenAPI Specification](/en/glossary/openapi-specification): The OpenAPI Specification is an open standard for describing HTTP APIs in a machine readable document, written in YAML or JSON. It defines endpoints, parameters, request and response schemas, authentication methods, and examples. Originally named Swagger, it was donated to the OpenAPI Initiative under the Linux Foundation and is now the most widely used API description format. - [Pagination](/en/glossary/pagination): Pagination is the practice of returning a large result set in smaller sequential pages rather than all at once. The response carries one page of items plus a way to request the next, such as a page number, an offset, or an opaque cursor. It bounds memory, response size, and query cost for both sides. - [Rate Limiting](/en/glossary/rate-limiting): Rate limiting is a control that caps how many requests a client may make to a service within a period of time. It protects capacity, contains cost, and prevents one caller from degrading service for everyone else. Callers that exceed the limit receive a rejection, conventionally an HTTP 429 status, often accompanied by guidance on when to retry. - [Refresh Token](/en/glossary/refresh-token): A refresh token is a long lived credential issued alongside a short lived access token, used solely to obtain a new access token when the old one expires. It is never sent to the resource API. Keeping it separate lets access tokens expire quickly without forcing the user to sign in again each time. - [Replay Attack Protection](/en/glossary/replay-attack-protection): Replay attack protection is the set of measures that stop a valid captured request from being accepted a second time. A signature proves a message is authentic but says nothing about whether it is fresh, so protocols add timestamps, single use values, or sequence tracking to ensure each request is honored only once. - [Resource (MCP)](/en/glossary/mcp-resource): A resource in the Model Context Protocol is a piece of readable context that a server exposes to a client, identified by a URI and returned on request. Resources are one of the protocol's primitives alongside tools and prompts. Unlike a tool, reading a resource is intended to supply information rather than to perform an action with side effects. - [REST API](/en/glossary/rest-api): A REST API is a web interface organized around resources identified by URLs, manipulated with standard HTTP methods, and exchanged in a common format such as JSON. REST, short for representational state transfer, is an architectural style described in 2000 rather than a protocol, and most interfaces called REST follow only part of it. - [robots.txt for AI Agents](/en/glossary/robots-txt-for-ai-agents): robots.txt is a text file at a website's root that tells automated clients which paths they may request, standardized as the Robots Exclusion Protocol. Applied to AI, site owners add rules naming the crawlers operated by AI companies in order to allow or refuse them. Compliance is voluntary, so the file expresses a request rather than an enforced control. - [Sandbox](/en/glossary/sandbox): A sandbox is an isolated environment in which code runs with restricted access to the surrounding system, so that whatever happens inside cannot damage or reach what lies outside. Isolation typically covers the file system, the network, other processes, and resource consumption. It is the standard containment measure for running untrusted code or agent generated commands. - [Scope](/en/glossary/oauth-scope): A scope is a named permission requested during an authorization flow that bounds what an issued token may do. Scopes appear as space separated strings in the authorization request, are shown to the user on the consent screen, and are enforced by the resource server on every call. They express the principle of least privilege in access delegation. - [SDK](/en/glossary/sdk): An SDK, or software development kit, is a package that makes a service usable from a specific programming language, wrapping its network interface in native functions, types, and error classes. A good one handles authentication, retries, pagination, and streaming, so that developers write ordinary code instead of assembling HTTP requests by hand. - [Server-Sent Events](/en/glossary/server-sent-events): Server-Sent Events is a web standard for streaming a one way sequence of text events from a server to a client over a single long lived HTTP response. The response uses the text/event-stream media type and a simple line based format, and browsers consume it through the EventSource interface with automatic reconnection built in. - [Service Account](/en/glossary/service-account): A service account is an identity belonging to an application or automated process rather than a person, used to authenticate machine to machine calls. It holds its own credentials and permissions, and it authenticates without an interactive login or consent screen. Cloud platforms, databases, and internal APIs all use service accounts to attribute and restrict automated access. - [Stdio Transport](/en/glossary/stdio-transport): Stdio transport is a communication mechanism in which two programs exchange messages over standard input and standard output rather than a network socket. The host launches the other program as a child process and writes requests to its standard input, reading replies from its standard output. It is one of the transports defined for the Model Context Protocol. - [Streaming Response](/en/glossary/streaming-response): A streaming response is an API reply delivered as a sequence of partial chunks while it is still being produced, rather than as one complete payload sent at the end. The client processes each chunk on arrival, which lowers perceived latency. Language model APIs commonly stream generated text token by token, alongside events describing tool calls and completion. - [Structured Output](/en/glossary/structured-output): Structured output is model output constrained to a predefined machine readable format, most often JSON matching a supplied schema, instead of free form prose. Some providers enforce this during generation so the result is guaranteed to parse and conform, while weaker approaches merely request the format in the prompt and validate afterwards. - [Terminal Execution](/en/glossary/terminal-execution): Terminal execution is giving an AI agent the ability to run shell commands on a machine and read their output. It is among the most capable tools an agent can hold, since almost any software task can be expressed as a command, and among the most dangerous, because the same interface can delete data or send secrets elsewhere. - [Tool Calling](/en/glossary/tool-calling): Tool calling is the pattern in which a language model is given a set of external capabilities, chooses one, has the surrounding application run it, reads the result, and repeats until the task is finished. It is largely synonymous with function calling, with different vendors preferring different names for the same underlying mechanism. - [Tool Schema](/en/glossary/tool-schema): A tool schema is the machine readable description of a single capability offered to a language model, giving the tool a name, a natural language description of when to use it, and a formal definition of its parameters. Models rely on this description alone when deciding whether and how to call the tool, so its wording directly shapes behavior. - [Web Scraping](/en/glossary/web-scraping): Web scraping is the automated extraction of data from web pages, turning content meant for human reading into structured records. A scraper fetches pages, parses the markup, selects the relevant elements, and stores the result. It is a long standing practice whose legality and acceptability depend heavily on what is collected, how it is collected, and what is done with it. - [Webhook](/en/glossary/webhook): A webhook is an HTTP request that one system sends to a URL you supply whenever a chosen event happens, so you learn about it immediately instead of repeatedly asking. It inverts the usual direction of an API call, since the provider becomes the caller and your endpoint becomes the server. Whether it is called inbound or outbound depends on which side you stand on. - [WebSocket](/en/glossary/websocket): WebSocket is a standardized protocol that upgrades an HTTP connection into a persistent, full duplex channel over a single TCP connection. Once the handshake completes, either side may send message frames at any time without waiting to be asked. It is specified in RFC 6455 and is supported natively by browsers through the WebSocket JavaScript interface. [Back to the AI Glossary](/en/glossary)