Agent tools

Capabilities V10M can use during a conversation. Live tools are wired and audited. Scaffolded tools have stable endpoints and are tracked in STATUS.md.

web_fetch

LIVE

POST /api/tools/web_fetch

SSRF-safe HTTP GET. Rejects RFC1918, loopback, link-local, CGNAT after DNS resolution. http(s) only.

web_search

LIVE

GET /api/tools/web_search?q=

DuckDuckGo HTML results, no API key required.

run_code

SCAFFOLD

POST /api/tools/run_code

JavaScript sandbox. v1 ships the contract; isolated-vm wiring is a v2 hardening step.

spawn_subagent

SCAFFOLD

POST /api/agents/spawn

Background sub-agent runner. v2: backed by a queue + transcripts in data/subagents/.

schedule

SCAFFOLD

POST /api/cron/schedule

Persisted cron jobs. v2: data/cron.json + a node-cron worker.

memory

SCAFFOLD

POST /api/memory/{save,recall,list}

Vector memory backed by SQLite + sqlite-vec. v2: ships with embedding pipeline.

SCAFFOLD

POST /api/telegram/send

Outbound + inbound webhook bridge. v2: configure token in settings.

files

SCAFFOLD

POST /api/files/{read,write,list}

Workspace files scoped to data/workspace/.

youtube_transcript

SCAFFOLD

GET /api/tools/youtube_transcript?id=

Transcript fetch + caption extraction.