Tools, and why an agent cannot exceed them

A tool is one thing an agent can do: read a table, call an endpoint, send a message. It has a name, a description and a schema saying exactly what arguments it takes.

Where tools come from

You do not write them. When you connect software, AgentOS reads what it exposes — endpoints, tables, MCP tools — and creates a tool for each capability. Adding a connection adds tools; removing one removes them.

Risk levels

Every tool has a risk level, and it is a floor rather than a suggestion:

• •Read — returns information, changes nothing.
• •Write — creates or updates something.
• •Destructive — deletes, or cannot be undone.

You can make a tool *more* restricted than its floor. You cannot make it less. A delete endpoint cannot be marked read-only, whatever anybody clicks.

Arguments are checked, not trusted

The model proposes arguments; the platform validates them against the tool's own schema before anything runs. Fields the schema does not declare are dropped, and the trace records that they were attempted.

Turning one off

You can disable a tool for an agent, or for the whole workspace. A disabled tool is not offered to the model at all — it does not know it exists, so it cannot suggest it and then be refused.