Agents & tool calling

Unrefused is an inference endpoint: it does not run tools for you, and it does not need to. Any agent — your own loop, LangChain, an MCP client — owns the tools and owns the loop. The gateway serves the model, streams the tool calls, and annotates every turn with policy decisions.

The loop

The OpenAI tool-calling shape works unchanged. The model returns tool_calls; your code executes them wherever they live; you feed results back as role: "tool" messages. Nothing about that contract changes because the model is served by Unrefused.

const res = await llm.chat.completions.create({
  model: "unrefused-glm-5.3-flash",
  messages,          // grows with every turn
  tools,             // your tools — from anywhere, including MCP
});
const msg = res.choices[0].message;
if (msg.tool_calls?.length) {
  for (const call of msg.tool_calls) {
    const result = await execute(call);        // your executor
    messages.push({ role: "tool", tool_call_id: call.id, content: JSON.stringify(result) });
  }
  // loop again — the model sees the tool results
}

Where policy fits

• The input stage evaluates user text (and image text parts) before the model sees them.
• The output stage evaluates assistant text. Tool-call arguments are evaluated by your own guardrails if you want that — the gateway treats them as opaque pass-through and, per ZDR, stores nothing about them.
• Tool results are messages too: they flow through the input policy on the next turn like any text.

Why this model is built for agent workloads

• 1M-token context. Agent traces grow fast — MCP-Universe measured input tokens climbing with every interaction step until context overflow degrades weaker models. The catalog flagship absorbs long horizons.
• Agentic post-training. GLM-5.3 was trained for long-horizon tool work — Z.ai reports open-weight SOTA on Terminal Bench 3.0 and Agents' Last Exam, with step-wise gains strongest up the exploitation chain.
• Abliterated refusal layer. Red-team and eval loops stop losing turns to false refusals; the policy profiles are your actual governance, per key, versioned.

Next: give those tools real reach with MCP servers.