Tools and integrations
Every tool — built in, MCP, plugin, web or desktop control — goes through one governed path.
Guide · Tasks and subthreads · Agora · Tool contract
A tool call is validated against its schema and scope, checked against your sandbox level and rules, recorded as a durable attempt, run by a bounded handler and closed with a receipt. MCP tools, plugin commands, web services, image services and Computer Use take the same path. An approval permits an action; it is not proof the action succeeded.
Limits
Section titled “Limits”- Approval is permission, not evidence; receipts record effects, not correctness.
- Installing a plugin never activates its hooks.
- A local MCP server that mislabels a tool can run it without a prompt.
- The Marketplace lists what you have installed; packages still install from a local folder, and there is no public catalog or publisher trust yet; see the ECC compatibility backlog.
- WebScrape defaults to 20 pages, depth 2 and 120 seconds (ceilings: 50 pages, depth 4, 16 MiB). Crawls honor robots rules; retrieval never submits forms, uses signed-in profiles, solves CAPTCHAs or rotates proxies.
- SearXNG is AGPL-licensed; its source stays with each installation (Licensing).
- Computer Use OS grants, local web-tool installation and Windows journeys remain to be accepted on real Windows systems.
Related
Section titled “Related”- Agora — in-app browser and tab control
- Tasks and subthreads · Operations
- Tool execution contract
Decisions behind this page: 0144, 0187, 0192, 0193, 0211, 0214, 0215, 0217, 0225, 0232, 0236, 0255, 0256, 0260, 0261, 0262, 0265, 0269, 0270, 0271, 0272 — see the decisions index.