Every tool the agent can use, its canonical name, and how to restrict an agent's toolbox.

Everything an agent can do it does through a tool, and every tool has one canonical name. This page is the complete list — these names (and the toolset group names in bold) are what you use to control an agent's toolbox.

Controlling the toolbox

An agent's tool policy lives on the agent, so it applies everywhere that agent answers — every channel, every schedule:

agents:
  support:
    model: claude-haiku-4-5
    toolsets: [files, web]        # allow-list: only these (omit = everything)
    disabled_toolsets: [shell]    # remove these; deny always wins

Entries can name a toolset (files), a single tool (edit_file), or a trailing-star wildcard (browser_*). Names you know from elsewhere work too: OpenClaw IDs (exec, read, edit, group:fs) and Hermes toolset names (file, terminal, clarify) resolve to their memcode equivalents — only where the meaning maps exactly; a name for a capability memcode doesn't have is rejected with a message, never silently narrowed. Or just tell memcode admin: "the support agent gets read and web tools only, no shell."

Two rules that always hold:

Policy shapes the toolbox; it never loosens safety. Every command from every remaining tool is still risk-checked, and in gateway mode dangerous commands are denied outright — an agent with shell enabled still cannot be talked into a destructive command by a chat message.
A hidden tool fails closed. The model never sees tools outside the policy, and a call to one is refused even if the model invents it.

The tools

files — reading and editing files in the project

Tool	What it does
`read_file`	Read a file
`list_dir`	List a directory
`glob`	Find files by name pattern
`ripgrep`	Search file contents
`git_diff`	See uncommitted changes
`edit_file`	Edit one file
`apply_patch`	Multi-file, all-or-nothing edits

shell — executing commands (each still risk-gated per action)

Tool	What it does
`bash`	Run a shell command
`script`	Save and replay reusable command sequences
`run_tests`	Run the repo's tests, structured results
`trace`	Trace data across pipeline stages to find where it's lost

code — understanding code

Tool	What it does
`code_query`	"Where does X live" — ranked evidence in one call
`code_nav`	Go-to-definition, find-references, types (LSP)
`diagnostics`	Compile/type errors for a file or the repo
`repo_map`	Ranked symbol map of the codebase

web — the public internet

Tool	What it does
`web_search`	Search the web
`fetch`	Fetch a URL's text
`github`	PRs, issues, and CI via GitHub
`artifact`	Publish a hosted HTML page (gated)

browser — driving a real Chrome browser

browser_navigate, browser_click, browser_type, browser_wait, browser_screenshot, browser_eval, browser_text, browser_scroll, browser_press_key, browser_hover, browser_select, browser_upload, browser_resize, browser_back, browser_forward, browser_console, browser_new_tab, browser_switch_tab, browser_close_tab, browser_list_tabs

Worth knowing:

Screenshots come back as images the model sees (vision), size-capped so one capture can't flood the context.
JavaScript dialogs (alert, confirm) are handled automatically — they can never hang the agent; what the dialog said lands in browser_console.
browser_wait settles single-page-app navigation (wait for a selector to appear or disappear) instead of racing it.
browser_upload only accepts files inside the project — paths are resolved through symlinks, and anything resolving outside is refused.
Chrome is found automatically, or pin the binary with the CHROME_PATH environment variable. The browsing profile is ephemeral: no logins or cookies carried over from your own browser.
In gateway mode the browser is an explicit opt-in: list browser in the agent's toolsets: and its jobs get a headless Chrome on the gateway machine (Chrome must be installed there). browser_eval is unavailable in gateway jobs — it requires a human approval that a channel job can't ask for, so it isn't offered.

Not currently supported (deliberately, not silently): iframe targeting, drag & drop, cookie/storage editing, network interception, device emulation profiles.

mcp — connected MCP servers

Tool	What it does
`mcp`	Discover and call tools on your MCP servers
`mcp_resource`	Read MCP resources (docs, schemas, runbooks)
`mcp_prompt`	Use MCP prompt templates
`mcp_code_exec`	Orchestrate MCP servers from a script

memory — what the agent knows

Tool	What it does
`memcode`	The agent's own intelligence: context, sessions, history
`todo`	The agent's work-tracker checklist
`knowledge`	Baseline facts and idioms for your stack
`preference_signal`	Remember a durable preference you expressed
`policy`	Read or change how memcode behaves for you — which model does what, whether plans get reviewed — when you ask

skills — installed skills

Tool	What it does
`skill`	Find and load an installed skill's guidance (gated)

delegation — spawning sub-agents

Tool	What it does
`explore`	Read-only sub-agent to investigate one question
`dispatch`	Hands-off background sub-agent for a block of work
`agent`	Run a task on a chosen model tier, report back
`reasoning`	Adjust thinking depth, or delegate a hard sub-problem

planning — plan mode

Tool	What it does
`enter_plan`	Research and propose a plan for approval
`execute_plan`	Execute the approved plan
`cancel_plan`	Abandon plan mode
`recall_plan`	Retrieve a previously saved plan

interaction — talking to you

Tool	What it does
`ask_user`	Ask a clarifying question at a critical fork

Recipes

A public Q&A bot that can read your docs and search the web, nothing else:

agents:
  support:
    toolsets: [files, web, memory, skills]
    disabled_toolsets: [edit_file, apply_patch, artifact]

A monitoring agent that may run checks but never edit anything:

agents:
  watchdog:
    toolsets: [shell, files, web]
    disabled_toolsets: [edit_file, apply_patch]

Migrating? memcode hermes migrate carries your toolsets/disabled_toolsets over and memcode claw migrate your tools.allow/deny — entries keep your original spelling where it resolves here. Tools memcode doesn't have (vision, image generation, home automation, per-sender overrides) are listed in the migration notes with what to do instead — never silently dropped, never pretended.

Tools

On this page