Agent tools

A toolToolCông cụ (tool)Something an agent can do besides writing text: search knowledge, search the web, read a file, create an artifact, or act in a connected app.Open in glossary description is the only instruction the model reads before it decides to call a tool. So each description is written against the failure it prevents, and several spend more words on when not to call than on what the call does.

Key rules

1. Scope comes from the turn. Every tool resolves what it may reach on the backend, so nothing the model writes can widen it.
2. The allowlist decides. An agent that declares no tools is offered no optional tools.
3. Some tools are always on. Clarification, suggestions, arithmetic, read_tool_result and read_transcript widen nothing, so every turn gets them.
4. A tool never offered is refused. Calling it returns a refusal that names the tool and discloses nothing else.
5. A rule travels with its tool. Guidance about a tool reaches the prompt only on turns where that tool is registered.

Tool catalog

Tool	Family	Offered when	Reads / writes	Key limits
list_files, search_files, read_file	Workspace	Every turn (workspace set)	Read	search_files: up to 5 strings, up to 3 context lines each side
write_file, edit_file, delete_file	Workspace	Every turn (workspace set)	Write	write_file: up to 3 files per batch; whole-file replace refused past a few thousand characters
run_code	Code	Allowlisted	Reads and writes the workspace	No network, no credentials, no package installs; up to 3 toolResults refs
Calculator	Arithmetic	Always	Read	Answers rounded to 12 significant digits
read_tool_result	Stored results	Always	Read	Up to 3 refs per call; maxChars 4,000 default (1,024–20,000)
read_transcript	Earlier turns	Always	Read	6,000 characters default, at most 20,000
Clarification	Pause	Always	—	At most one recommended answer
suggest_next_actions	Suggestions	Always	—	—
Memory search, write, forget	Memory	Memory switch on and embedding model catalogued	Search reads; write and forget write	Search returns fewer hits than document search
Knowledge search	Documents	Agent binds knowledge and embedding model catalogued	Read	—
read_document	Documents	Agent binds knowledge, or the conversation holds a document attachment	Read	At most 40,000 characters per call
search_attachments	Documents	The conversation holds an attachment (needs the embedding model)	Read	Only files attached in this conversation
Budget check	Budget	Its own switch	Read	Calendar month in UTC
Past-conversation search	History	Its own switch	Read	Matches words people wrote only
research_web and page reading	Public web	An approved provider is enabled	Read	research_web reads at most 3 pages; page reading has the lowest per-call cap in the set
create_artifact, rewrite_artifact, update_artifact	Artifacts	Allowlisted	Write	Visual files need inspection before saving
inspect_artifact, measure_layout, print_pdf	Artifact review	Travel with available artifact tools	Read (print_pdf writes a workspace PDF)	10 pages per inspection
Skill loader	Skills	A published skill is bound	Read	One skill name per call
update_tasks	Task list	Built into the runtime (calls no portal route)	Runtime-only state	Up to 20 tasks, one in progress
search_tools, list_tools, get_tool_schema	Tool discovery	Portal catalogue	Read	search_tools: at most 5 queries per call

Application (MCP) tools come from your organisation’s allowlist on top of this set — see Applications and MCP.

Registration

The tool list is fixed before the loop starts. At the start of every turn:

Budget and past conversations each get their own switch, because money and chat history are different risks.

What the tools add to the prompt

Every paragraph of the runtime’s guidance is paid for on every model call of every turn. So a rule about one tool travels with that tool: a turn with no artifact tool carries no paragraph about saving artifacts. What stays in the shared guidance is what holds whatever tools a turn was given.

• Paragraphs are collected where registration already happens, so a paragraph cannot drift away from its tool.
• Repeats are dropped — the three searches share one paragraph about queries that never ran.
• Order follows registration order, because the prompt is a cached prefix that a set would reorder between turns.

Tool definitions are paid for the same way, under two ceilings:

Measure	Figure
Widest catalogue a turn can get	40,122 characters over 27 tools
Part every turn pays (the six workspace tools and four beside them)	13,456 of those characters
One measured deck-building turn	System prompt + definitions = 13,281 tokens, 43% of everything read across 11 model calls

A tool that pushes either ceiling arrives as a failing test; whoever adds it raises the ceiling in the same change or spends fewer words.

Prompt context

The turn’s own message opens with who the model is talking to and what time it is:

• name, department and organisation (no identifier);
• the current time in the caller’s zone, and the zone’s name.

This sits in the turn message, not the system prompt, because the clock is written to the minute. A system prompt that changed every minute would be a new prefix on every turn, and the cache every later call reads from would be rewritten at full price. Who pays is a separate block of opaque ids shown to nobody.

The browser reports its zone when it starts a turn; the turn keeps it and a resume renders the same zone. A turn with no zone reads as UTC — which, for somebody in UTC+7 after five in the afternoon, names yesterday.

Explore the tool families