p-research

Frontier Deepresearch: Tool Use

2026-08-19 · PRDT Deepresearch Series №3 · generated from the P-Research corpus pipeline Method: corpus retrieval + 90-day targeted arXiv sweep + GraphRAG communities + top-venue odds. All numbers are re-derivable from data/papers.jsonl; abstract-level evidence is a research signal, not a verified fact.

Lineage: Tsinghua’s tool-use line (recalled)

Year	Work	Contribution
2023	ToolLLM (Tsinghua)	16,000+ real APIs — the scaling milestone of tool learning
2023	AgentBench (Tsinghua; ICLR 2024)	made agent / tool use an evaluable object
2023	ToolBench (OpenBMB / Tsinghua circle)	large-scale tool-use evaluation and training sets

The Tsinghua line answered two questions: how models learn to use tools, and how tool use gets evaluated. The 2026 frontier is answering a third — how tool use becomes safe, auditable, and self-evolving. (Recalled historical context, kept for continuity with the program’s earlier framing.)

Key numbers

Metric	Value
Tool-use papers in the six-pillar corpus	6
90-day targeted arXiv sweep	25 papers, 4 frontier themes
Agentic-pillar query cap (before → after)	max 15 → 20
Terms added to the Agentic-pillar query	5 (tool learning · tool calling · toolkit · model context protocol · skill)
Real APIs covered by ToolLLM	16,000+
Palmyra x6 top-venue odds	0.619

Observation 0 — a corpus-coverage gap, not a research gap. The six-pillar corpus held only 6 tool-use papers, not because the topic is under-researched but because of a query-coverage gap: the Agentic pillar’s max:15 cap let the “agent” keyword crowd out tool-use papers (top-15 by date). The fix is pipeline-level and already applied: the Agentic-pillar query gained 5 terms (tool learning / tool calling / toolkit / model context protocol / skill) and its cap rose 15 → 20. (Re-derivable from data/papers.jsonl.)

Findings

1. Tool use × self-evolution — the training environment becomes the tool

• SPADE: self-play in synthetic executable environments — tool environments as the training ground.
• RTPO: reverse-turn policy optimization, stabilizing agentic training.
• Write, Execute, Refine: from skill follower to skill optimizer.
• Policy Iteration with Human Feedback (2608.16831): RL enters tool calling.

Trend (abstract-level): tools are no longer an add-on bolted onto a frozen model — they are the environment in which agents self-evolve. This is the direction most directly relevant to the program’s recursion theme.

2. Tool use × least privilege — safety as a design item

• Task-Conditioned Least-Privilege Learning: task-conditioned least-privilege learning.
• SkillEffect: checked lowering for memory-constrained agent tools.
• When Agents Act on Web3: an attack-surface survey of MCP / skills.

This echoes the program’s public ai-security track: least privilege is moving from an engineering principle to a formal research topic.

3. Tool use × auditability — the trace as evidence

• LEDGER: claim-to-evidence trace graphs for auditing LLM agents.
• Auditing Self-Evolution in Financial Agents: capability gains of financial agents, and their audit — the report flags this as the program’s precise three-way intersection: Quant × Tool × Recursion.

Trend (abstract-level): tool-call traces are becoming audit infrastructure. The frontier is converging on the same trace-as-evidence principle that the P-Research program’s harness practice has followed.

4. Compositional tool calling

• Looped Language Models Improve Compositional Tool Calling: the orchestration problem of multi-step tool chains.

Tool-use papers inside the corpus (6)

• Palmyra x6 — an agentic tool-use model; top-venue odds 0.619 (2608.16620)
• AgentScope 1.0 — a developer-centric framework (2508.16279)
• MCPVerse — a real-world agentic benchmark (2508.16260)
• ModelScope-Agent (2309.00986)
• VCE-Skill — version control for skill self-evolution (2608.16544)
• …

All six records are re-derivable from data/papers.jsonl; evidence is abstract-level unless full-text verified.

Implications for the P-Research program

Element	Frontier signal
Tool Use	self-evolving training environments + least-privilege learning + trace auditing
Planning	orchestration of compositional tool calling (Looped LM)
Eval	real-world benchmarks in the spirit of MCPVerse; auditing of financial agents
RAG / Memory	the tool–retrieval boundary (tools as a special case of retrieval)
Safety (shadow)	least privilege becoming a formal research direction

Program-position statements:

• The three dominant directions in this sweep — training-environment self-evolution, least privilege, and trace-based auditing — map onto the program’s existing recursion, ai-security, and harness practices. The program’s position is to keep those lines aligned with the frontier, not to follow any single paper.
• The corpus gap was a pipeline artifact, not a topic judgment: the corrected Agentic-pillar query (5 new terms, cap 15 → 20) makes tool use a first-class pillar topic for the series, and future tool-use digests will be read against it.
• The method behind this note — corpus retrieval, a 90-day targeted arXiv sweep, GraphRAG communities, and top-venue odds — is what surfaced these signals, and keeps every abstract-level claim auditable against data/papers.jsonl.

Open problems

1. Tool auditing for financial agents — a direct extension of Auditing Self-Evolution in Financial Agents. The program maintains both a tool-use line and a Quant × AI line, a position few groups hold.
2. Can the 46 tools of dsh-quant, the program’s open-source quant-indicator library, become a public testbed for tool-use research? Schema-first design, least privilege, and hand-computed baselines are already claims made by frontier papers.
3. How should skill self-evolution (the VCE-Skill class) align with the skill-learning component of PAT’s five elements?

One-line takeaway

In 2023, Tsinghua taught models to use tools; in 2026, the frontier is teaching agents to evolve safely, auditably, inside tools. The third phase is open, and the P-Research program intends to be on its roster.

This site is open source. Improve this page.