Guides

Custom Tools

Connect an authenticated HTTP endpoint or MCP server, define its input schema, and grant it to an agent.

HTTP tool endpoint

Your endpoint receives the model-validated arguments and returns bounded JSON. Keep credentials in the tool's encrypted secret headers, never in its schema or description.

typescript

app.post('/tools/check-order', requireInternalAuth, async (req, res) => {
  const orderId = String(req.body.order_id ?? '');
  if (!orderId) return res.status(400).json({ error: 'order_id is required' });

  const order = await db.orders.findById(orderId);
  if (!order) return res.status(404).json({ error: 'order not found' });

  res.json({ status: order.status, eta: order.estimated_delivery });
});

Configure and assign

1. Open Tools and choose HTTP/Webhook or MCP.

2. Set the HTTPS URL, method, timeout, description, and JSON parameter schema.

3. Put authorization values in secret headers and run the real connection test.

4. Grant the tool to the intended agent and publish that agent.

Runtime guarantees

The canonical worker enforces tenant capability grants, SSRF protection, encrypted credentials, a 1–30 second timeout, bounded responses, safe error text, and execution audit records. There is no polling agent SDK or raw tool WebSocket to host.