Built-in tools
Shell, files, web, git, code intelligence and planning tools, switched on by one option each.
Every built-in tool is turned on by an agent option. Nothing is offered to the model unless you configure it, and asking for a tool your setup can't support (git without a sandbox, for example) is a setup error rather than a tool that silently does nothing.
const coder = agent({
instructions: "Fix failing tests and open a pull request.",
model,
sandbox: e2b(), // bash, read, write, edit, ls, glob, grep, notebook_edit
web: { fetch: true, search: exa(secret("EXA_API_KEY")) }, // web_fetch, web_search
git: { credential: secret("GITHUB_TOKEN") }, // git_clone, git_fetch, git_push, open_pull_request
lsp: { languages: ["typescript", "python"] }, // lsp
});exa comes from @threads/core in TypeScript and threads.search in Python.
What turns on each tool
| Tools | Turned on by | Notes |
|---|---|---|
read_tool_result | Always | Reads back long tool output that was trimmed from the conversation |
todo_write | Always | The agent's own task list. Read it with the thread's todos() |
bash, read, write, edit, ls, glob, grep, notebook_edit | sandbox | Run inside the sandbox, never on your machine |
web_fetch | web: { fetch: true } | Runs on the host. Private and internal addresses are blocked |
web_search | web: { search: exa(key) } | Backends: exa, brave, tavily. Each takes a secret() |
git_clone, git_fetch, git_push, open_pull_request | git: { credential } plus a sandbox | The token stays on the host; the sandbox never sees it |
lsp | lsp: { languages } plus a sandbox | typescript, python, go, rust. The sandbox image needs python3 on its PATH and each language server in /usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin or /bin. Only those six directories are searched, and they are the server's whole PATH, so a server's interpreter (node for typescript-language-server and pyright-langserver) must be there too. For a server or interpreter installed elsewhere (/workspace/node_modules/.bin, /opt/...), link it into /usr/local/bin in the image |
computer, computer_screenshot | computer: true plus a sandbox with a desktop | None of the bundled sandbox providers has a desktop yet |
save_memory, search_memory, forget_memory | memory | See Memory |
search_knowledge | knowledge | See Knowledge base |
load_skill | skills | See Skills |
spawn_agent | subagents | See Subagents |
send_message, team_task_create, team_task_claim, team_task_update | subagents | See Teams |
handoff | handoffs | See Handoffs |
Web content is reference, not instructions
Pages from web_fetch and hits from web_search reach the model marked as untrusted reference. A redirect to another host is not followed; the model gets the new URL and decides whether to fetch it.
Git without leaking the token
The git tools run git on the host with your token, then move the result into the sandbox as a plain bundle. The clone inside the sandbox has no credential, so code running there can't read or reuse it. open_pull_request targets GitHub by default.
In TypeScript, git also takes forgeUrl and apiUrl for a GitHub Enterprise host. Python's git option takes only credential.
Approvals
In the default permission mode, read-only tools run freely and everything else asks first: bash, file edits, git_push, and web tools included. Switch to accept_edits to let file edits in the workspace through, or add allow rules for specific tools.
Long output
Large tool results are stored in full but shown to the model trimmed, with a head and a tail. The model can page through the rest with read_tool_result, so a huge log never floods the context.