Tools — External Capabilities for Agents
A Tool extends an agent's reach beyond pure language generation. Tools let agents run shell commands, read and write files, control a browser, or call any MCP-compatible server — locally or over HTTP.
Scenario: A "Web Researcher" agent is given a Playwright MCP tool and a Filesystem tool. It navigates to URLs, extracts content, and saves summaries to disk — all without writing a single line of integration code.
Tool types
| Type | Description |
|---|---|
| mcp_stdio | Local MCP server spawned as a child process and communicated with via stdio. Typical examples: Playwright, filesystem access, git tooling. |
| mcp_http | Remote MCP server accessed via HTTP/SSE. The server runs independently and FleetQ connects to it at a configured URL. Supports custom headers for authentication. |
| built_in | Platform-provided tools that require no external server. Three kinds available: bash (shell execution), filesystem (read/write files), browser (web automation via Playwright). |
Creating a tool
Navigate to Tools → New Tool in the UI, or use the API. The form fields depend on the tool type:
Common fields
- Name — unique identifier within your team
- Description — what the tool does; shown to the LLM when selecting tools
- Type — mcp_stdio, mcp_http, or built_in
- Status — active or disabled
Transport config — stdio
- Command — executable to spawn (e.g. npx)
- Args — argument list (e.g. ["@playwright/mcp"])
- Env — optional environment variables injected into the process
Transport config — HTTP
- URL — full base URL of the remote MCP server
- Headers — key-value pairs sent with every request (e.g. Authorization)
To create a tool via API:
curl -X POST https://fleetq.169.58.89.204.sslip.io/api/v1/tools \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "playwright-mcp",
"description": "Browser automation via Playwright",
"type": "mcp_stdio",
"transport_config": {
"command": "npx",
"args": ["@playwright/mcp"],
"env": {}
},
"status": "active"
}'
Assigning tools to agents
Open an agent's detail page and use the Tools tab to attach tools. Each agent can have multiple tools with a priority ordering — lower numbers are preferred when the LLM must choose. Tools are stored in the agent_tool pivot table and resolved at execution time by ResolveAgentToolsAction.
MCP server discovery
FleetQ can auto-discover MCP servers running on the host machine or reachable via the network. Two MCP tools power this workflow:
- tool_discover_mcp — scans for available MCP servers and returns a list with their capabilities.
- tool_import_mcp — imports a discovered server as a new Tool record, ready to assign to agents.
Built-in tools
Built-in tools are provided by the platform and require no external server or configuration beyond enabling them.
Bash
Executes shell commands. The sandbox mode determines where commands run
(set via AGENT_BASH_SANDBOX_MODE in .env), and the execution policy
determines which commands are permitted.
Sandbox modes
| Mode | Behaviour |
|---|---|
| php | Commands run in-process with CommandSecurityPolicy allowlist. Default for development. |
| docker | Each command runs in a Docker container with --network none, --read-only, and a mounted workspace. |
| just_bash | Commands run inside a persistent just-bash Node.js sidecar container. Recommended for cloud/production. |
Execution policies
Policies are orthogonal to sandbox mode — they apply an allowlist/denylist to whatever is allowed through the sandbox.
| Policy | Behaviour |
|---|---|
| allow_all | Any command is permitted. Use only in trusted, isolated environments. |
| allowlist | Only explicitly listed commands may run. |
| denylist | All commands permitted except those explicitly blocked. |
Configure the policy via the tool_bash_policy MCP tool or from the tool detail page.
Filesystem
Reads and writes files within a set of allowed paths. Configure the permitted root directories in the tool's transport config. Attempts to access paths outside the allowlist are rejected.
Browser
Web automation powered by Playwright / patchright. Agents can navigate pages, click elements,
fill forms, take screenshots, and extract content. The browser sandbox mode
(AGENT_BROWSER_SANDBOX_MODE) controls how the browser runs:
| Mode | When to use it |
|---|---|
| disabled | Browser tool returns a plan-upgrade prompt. Default — safest. |
| cloud | Tasks delegated to the cloud browser sidecar (headless Chromium, fast, cheap). |
| headful (Xvfb) | Runs a real Chromium + patchright inside an Xvfb virtual display. Combine with a proxy credential for Reddit/Cloudflare/anti-bot scenarios. Set headless="false" on the tool. |
FleetQ's system prompt auto-injects a policy that tells agents when to reach for headful mode (sites with heavy bot detection) versus cloud mode (fast plain scraping).
SSH fingerprints
For tools that connect to remote servers over SSH, FleetQ supports fingerprint verification to prevent man-in-the-middle attacks. Retrieve known fingerprints via the tool_ssh_fingerprints MCP tool or the GET /api/v1/tools/ssh-fingerprints endpoint. Fingerprints are checked automatically when the tool initiates a connection.
Semantic tool selection (tool_search)
When a team has more than 15 active tools, loading all of them into every agent prompt wastes tokens and dilutes the LLM's focus. FleetQ solves this with semantic tool selection: tool descriptions are embedded with pgvector and the most relevant tools for the current task are retrieved per call.
- Embeddings live in the
tool_registry_entriestable (cosine distance, HNSW index). - The
tool_searchMCP tool can be called directly by agents for explicit tool discovery. - Retrieval threshold is
≥ 0.75cosine similarity; tools below that floor are excluded from the agent's toolbelt for that turn.
Activepieces auto-sync (660+ integrations)
Point FleetQ at a self-hosted Activepieces
instance and every one of its 660+ "pieces" (Stripe, Slack, GitHub, HubSpot, Salesforce, Notion,
OpenAI, Google Sheets, …) becomes available in FleetQ automatically as mcp_http Tool records.
- Hourly sync job discovers new pieces and updates existing ones.
- Optional
piece_filterlimits which pieces are imported. - SSRF-protected — the Activepieces URL is validated on every request.
- Trigger a manual refresh with the
activepieces_syncaction on theintegration_manageMCP meta-tool.
Popular tools
FleetQ ships with 16 popular tools pre-seeded covering common integrations (Playwright, filesystem, git, databases, Slack, and more). All are disabled by default to avoid unintended access. Enable the ones you need from the Tools page — no configuration required for most of them.
MCP tools for tool management
The FleetQ MCP server exposes the following tools so agents and LLMs can manage tools programmatically:
| MCP tool | Description |
|---|---|
| tool_list | List all tools with optional filtering by type or status. |
| tool_get | Retrieve full details for a specific tool by ID. |
| tool_create | Create a new tool with name, type, and transport config. |
| tool_update | Update an existing tool's name, description, or transport config. |
| tool_delete | Soft-delete a tool. Agents that reference it will lose access. |
| tool_activate | Set a tool's status to active, making it available for agent use. |
| tool_deactivate | Disable a tool without deleting it. Existing agent assignments are preserved. |
| tool_discover_mcp | Auto-discover available MCP servers on the host or network. |
| tool_import_mcp | Import a discovered MCP server as a new Tool record. |
| tool_ssh_fingerprints | Retrieve SSH fingerprints for tools that connect to remote servers. |
| tool_bash_policy | Get or set the execution policy (allow_all / allowlist / denylist) for the Bash built-in tool. |
API endpoints
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/tools | List all tools (cursor paginated). |
| POST | /api/v1/tools | Create a new tool. |
| GET | /api/v1/tools/{id} | Retrieve a tool by ID. |
| PUT | /api/v1/tools/{id} | Update a tool. |
| DELETE | /api/v1/tools/{id} | Soft-delete a tool. |
| GET | /api/v1/tools/ssh-fingerprints | Retrieve SSH host fingerprints for remote tool connections. |