> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tradeoffs of Function Tools and MCP

> Comparison of function tools versus MCP for querying production BigQuery, weighing safety, auditability, flexibility, setup complexity, and reuse to guide deployment choices.

It's Tuesday. The email isn't from Claire — it's from Marcus on the platform team. Subject line: "What exactly can this thing run?"

Claire told Marcus an agent in customer success is issuing its own SQL against [production BigQuery](https://cloud.google.com/bigquery). Before anything touches a shared environment, Marcus needs three clear answers:

* Whose credentials are being used?
* What can those credentials do?
* What stops it from running a DELETE query?

He finishes with: "I'm not blocking you. I just need answers first."

This is the POC from last Wednesday coming back to bite us. Marcus is right — those three questions are reasonable platform-team concerns. Yesterday you might have struggled to answer them; today you'll be able to answer them properly. Along the way we’ll settle the long-running question: should you use handwritten function tools or [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners)?

![A presentation slide titled "Three Fair Questions" listing: "Whose credentials are being used?", "What can those credentials do?", and "What stops it from running a delete query?". Below the text is a simple diagram showing a Churn Agent connecting to a shared environment containing a Production BigQuery icon.](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Databricks/Tradeoffs-of-Function-Tools-and-MCP/three-fair-questions-credentials-bigquery.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=a041e8cdf07bea243bd26cbcfa9b364c)

Right now two versions of the agent sit on your machine:

* Left: the function-tool version — a handwritten function called `getCustomer` that embeds a parameterized SQL query.
* Right: the [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners) version — an MCP toolbox where the model writes its own SQL and calls an "execute SQL" tool.

Both use the same model, the same instruction, and we asked the same question (customer `CUS0003115`). Both returned five. Example SQL forms used:

```sql theme={null}
-- Function tool (parameterized)
WHERE customer_id = @cid

-- MCP (model-generated SQL)
WHERE customer_id = 'CUS0003115'
```

Both answers are correct — but which approach should you build and deploy? Compare them across five dimensions to decide.

![A dark-themed comparison table titled "Five Dimensions" contrasting "Function Tool" and "MCP" across rows like "Who writes the SQL?", "Flexibility", "Safety", "Setup", and "Reuse." Each cell contains short notes (e.g., "You do" vs "The model, fresh every question" and "Tight — one parameterized query" vs "Broad — runs whatever the model writes").](https://mintcdn.com/kodekloud-c4ac6d9a/YiW0Xl5gQ25uff6L/images/AI-Agents-For-Data-Analytics/Building-Agent-With-Databricks/Tradeoffs-of-Function-Tools-and-MCP/function-tool-vs-mcp-sql-comparison.jpg?fit=max\&auto=format\&n=YiW0Xl5gQ25uff6L\&q=85\&s=0f5b63e4c55c75bdf6a8df7fb20ad930)

Summary table (quick at-a-glance):

| Dimension | Function Tool | MCP |
| - | -: | - |
| Who writes the SQL? | You: prewritten and reviewed (`WHERE customer_id = @cid`). | The model: generates SQL per request. |
| Flexibility | Narrow: only the queries you implemented. | Broad: model can synthesize new queries on demand. |
| Safety / Auditability | Strong: parameterized queries, easy to audit and test. | Weaker by default: model can produce arbitrary SQL unless constrained. |
| Setup / Operational Overhead | Minimal: a single Python file + dependencies. | More: MCP server binary, protocol/tool contract, deployment. |
| Reuse | Code-level reuse (functions/packages). | Designed to serve multiple clients and agents with one toolbox. |

Deep dive on each dimension

1. Who writes the SQL?

* Function tools: you author the SQL. You choose columns, joins, and filters, and you can validate the query before the model ever sees it.
* [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners): the model composes SQL on every request, so the exact SQL varies with prompts and context.

2. Flexibility

* Function tools: fixed surface area. To answer new questions (e.g., "which 5 accounts dropped fastest?") you must implement additional queries.
* [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners): flexible. The model can synthesize novel queries in response to ad-hoc questions without code changes.

3. Safety (Marcus's primary concern)

* Function tools: tight and auditable. Parameterized queries treat user input as data, preventing the model (or an attacker) from changing query structure.
* [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners): broad and harder to contain. An `execute_sql` tool could run any SQL the model outputs, so you must introduce guardrails and policy enforcement.

Best practice: use parameterized queries and least-privilege credentials to minimize risk. Parameterization prevents SQL injection and makes it trivial to audit which statements the system can run.

4. Setup and operational complexity

* Function tools: low friction. Implement a function in `Python` (or your language of choice), install a dependency or two, and deploy.
* [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners): requires an MCP server/toolbox, a defined protocol, and additional deployment/monitoring work.

5. Reuse and scale

* Function tools: reuse is at the code level (copy, import, or publish a package).
* [MCP](https://learn.kodekloud.com/user/courses/mcp-for-beginners): built for cross-client reuse — one toolbox can serve multiple agents and use cases.

Make the choice that matches your constraints

* If your top priority is safety, auditability, and minimal blast radius: prefer function tools with parameterized queries and least-privilege credentials.
* If you need broad, exploratory capability and are willing to invest in guardrails, auditing, and runtime controls: MCP gives you the flexibility to ask new questions without code changes.

Neither option universally wins. Function tools trade flexibility for containment and auditability. MCP trades containment for flexibility and reuse. Your choice should reflect your risk tolerance, operational capacity, and how dynamic your query surface needs to be.

Links and references

* [MCP course](https://learn.kodekloud.com/user/courses/mcp-for-beginners)
* [BigQuery documentation](https://cloud.google.com/bigquery)
* [Python](https://www.python.org/)
* [pip](https://pip.pypa.io/en/stable/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/ai-agents-for-data-analytics/module/e7d9a0ef-37ce-482f-98c9-8e5332348342/lesson/58d99afe-284f-443e-b276-0c5db92835a3)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.