Building AI Agents in PHP: Tool Calling with Laravel

Short summary

A practical guide to building AI agents in Laravel using plain PHP tool calling — no framework required. The pattern uses three pieces: an AgentController, an AgentRunner loop (max N rounds), and a ToolRegistry mapping tool names to classes that implement a simple Tool interface. The critical security insight: authorization must live in your code (e.g., scoping queries by auth()->id()), never in the prompt, because attackers can steer tool selection and arguments via crafted prompts.

• •Agent loop pattern: model picks tool, you execute, model continues — no framework needed
• •Each tool is one class implementing name, description, parameters (JSON Schema), and handle()
• •Authorization must live in code, not prompts — treat every tool as a public API endpoint

Generated with AI, which can make mistakes.