Give agents tools
Without tools an agent can only talk. With them it can look something up, file a ticket, run a script, or write a file you can download. Tools are what turn a conversation into work.
Granting one is a single line - add the tool set's name to the agent's toolsets array:
toolsets = ["web", "memory", "blob", "sandbox-local"]Those are set names, not tool names: the agent gets every tool the set provides. Individual
tool names (web_search, save_memory) belong somewhere else - intent.toml's [autonomy],
[tool_loading] pinned, and a workflow tool node. axl tools prints both lists.
To take a set without one of its tools, narrow it in place:
toolsets = [
"memory",
{ name = "microsoft", except = ["microsoft_send_mail"] },
]Exactly one of only or except may be given. Narrowing is a grant: it decides what the agent
has, where [autonomy] decides what it may do with what it has.
A tool set has to be registered by the server and listed on the agent. Both halves are required, which means an agent cannot quietly acquire a capability just because someone deployed a new tool.
Where tools come from
| Source | What you get | Guide |
|---|---|---|
| Built in | Capabilities the AXL server ships: web, memory, blobs, media, cron, browser, Microsoft Graph | Use built-in tools |
| MCP | Anything an external MCP server exposes, including your own internal systems | Connect an MCP server |
| Sandboxes | A workspace where the agent can run shell commands and edit files | Choose a sandbox |
MCP has its own section, covering server connections, per-user auth, and interactive MCP apps.
Grant the smallest set that works
Every tool widens what a confused or manipulated run can do. Two things keep that in proportion, and they work together rather than as alternatives:
- Grant narrowly. Start with the tools the agent needs for the task in front of it, and test the exact action through the agent before adding more.
- Gate what matters. The agent's autonomy level decides whether an action runs without a person confirming it, and middleware can cap how many writes a single run performs or require approval only when the arguments look risky.
Approval in AXL is driven by autonomy. An agent set to require_approval asks before acting; one
set to full does not, regardless of the tool.