Build an Agent From Scratch: The Tool Loop Without a Framework

Hand-roll a tool-using agent on the chat completions API and nothing else: parse the model's tool calls, dispatch them to plain Python functions, close the loop with correctly threaded tool results, add stop conditions and budgets, turn every failure into a tool result the model can read, put an approval guardrail in front of a side-effecting refund tool, control context with truncation and a trace, and finish with an evaluation run that scores the agent on a fixed question set.

80 min8 steps3 domainsIntermediate

Part of the AI Engineer Course

Hands-on labs require Pro · $29.99/mo · cancel anytime

What you'll learn

1
One round trip: what the model actually sends back
An agent is a loop around one API call. Before writing the loop, look at
2
The dispatcher: from a tool name to a running function
The model returns a name and some arguments. Something has to turn that
3
Close the loop
Send the conversation with the tools. If the assistant message carries tool
4
Stop conditions: budgets for steps, tool calls and tokens
The loop script in fake_client.py is a real transcript. A small model
5
Errors as information: nothing raises out of the loop
Two more recordings. In malformed, the model's arguments string is two
6
A guardrail in front of the tool that moves money
Five of the six tools read or compute. refund writes a line to the refunds
7
Control the context and trace every step
Every tool result is appended to the conversation and sent back on every
8
Evaluate the agent on a fixed question set
Everything so far makes the agent robust. Nothing so far says whether it

Prerequisites

Python: functions, dicts, json, try/except, a while loop
The chat completions message format: system, user, assistant, tool roles
Read the module's tool-calling lecture first: the model emits intent, your code executes

Exam domains covered

Tool Calling and AgentsUsing LLMs via APIAgent Evaluation

Skills & technologies you'll practice

This intermediate-level ai/ml lab gives you real-world reps across:

AI AgentsTool CallingFunction CallingAgent LoopGuardrailsAgent EvaluationLLM API

Why build the agent loop yourself

Every agent framework hides the same forty lines: send the conversation with a tools array, read the tool calls off the assistant message, run the matching functions, append one tool message per call with its id, send the conversation back, and repeat until the model answers in text. Building that loop once by hand is the fastest way to understand what the frameworks do, to debug them when they misbehave, and to decide whether you need one at all. The lab goes past the happy path. A scripted model replays real failure transcripts captured from a small model: an endless loop on an unknown order, arguments that are not valid JSON, and an API response with no choices. You add stop conditions and budgets, turn every failure into information the model can act on, put an approval guardrail in front of the refund tool with an audit log, truncate oversized tool results, trace each step, and score the finished agent against a fixed question set with an exit code a CI job can use.

Frequently asked questions

Do I need LangChain, LangGraph or another framework for this lab?

No. The agent is written against the chat completions API with the OpenAI Python client and plain functions. Frameworks wrap the same loop; after this lab you can read theirs.

Which model does the lab use?

A hosted Llama 3.3 70B instruct model behind the lab's proxy for the live steps, and a scripted stand-in that replays recorded transcripts for the failure-handling steps, so those tests are deterministic and cost nothing.

What does the agent do with a tool that fails?

It returns the failure to the model as the tool result, in JSON, and lets the model decide whether to retry with different arguments or report the problem. Nothing raises out of the loop, and budgets stop it from retrying forever.

How is the refund tool kept safe?

A policy hook runs before any side-effecting tool. Refunds above a limit are denied and the denial goes back to the model as a tool result, every decision is written to an audit log, and an explicit approval flag is the only way to lift the limit.