Skip to main content

Tools — External Capabilities for Agents

A Tool extends an agent's reach beyond pure language generation. Tools let agents run shell commands, read and write files, control a browser, or call any MCP-compatible server — locally or over HTTP.

Scenario: A "Web Researcher" agent is given a Playwright MCP tool and a Filesystem tool. It navigates to URLs, extracts content, and saves summaries to disk — all without writing a single line of integration code.

Tool types

Type Description
mcp_stdio Local MCP server spawned as a child process and communicated with via stdio. Typical examples: Playwright, filesystem access, git tooling.
mcp_http Remote MCP server accessed via HTTP/SSE. The server runs independently and FleetQ connects to it at a configured URL. Supports custom headers for authentication.
built_in Platform-provided tools that require no external server. Three kinds available: bash (shell execution), filesystem (read/write files), browser (web automation via Playwright).

Creating a tool

Navigate to Tools → New Tool in the UI, or use the API. The form fields depend on the tool type:

Common fields

  • Name — unique identifier within your team
  • Description — what the tool does; shown to the LLM when selecting tools
  • Typemcp_stdio, mcp_http, or built_in
  • Statusactive or disabled

Transport config — stdio

  • Command — executable to spawn (e.g. npx)
  • Args — argument list (e.g. ["@playwright/mcp"])
  • Env — optional environment variables injected into the process

Transport config — HTTP

  • URL — full base URL of the remote MCP server
  • Headers — key-value pairs sent with every request (e.g. Authorization)

To create a tool via API:

bash
curl -X POST https://fleetq.169.58.89.204.sslip.io/api/v1/tools \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "playwright-mcp",
    "description": "Browser automation via Playwright",
    "type": "mcp_stdio",
    "transport_config": {
      "command": "npx",
      "args": ["@playwright/mcp"],
      "env": {}
    },
    "status": "active"
  }'

Assigning tools to agents

Open an agent's detail page and use the Tools tab to attach tools. Each agent can have multiple tools with a priority ordering — lower numbers are preferred when the LLM must choose. Tools are stored in the agent_tool pivot table and resolved at execution time by ResolveAgentToolsAction.

Projects can restrict which tools an agent may use via allowed_tool_ids. Any tool not in that list is silently excluded for runs triggered by that project, even if it's attached to the agent.

MCP server discovery

FleetQ can auto-discover MCP servers running on the host machine or reachable via the network. Two MCP tools power this workflow:

  • tool_discover_mcp — scans for available MCP servers and returns a list with their capabilities.
  • tool_import_mcp — imports a discovered server as a new Tool record, ready to assign to agents.

Built-in tools

Built-in tools are provided by the platform and require no external server or configuration beyond enabling them.

Bash

Executes shell commands. The sandbox mode determines where commands run (set via AGENT_BASH_SANDBOX_MODE in .env), and the execution policy determines which commands are permitted.

Sandbox modes

Mode Behaviour
php Commands run in-process with CommandSecurityPolicy allowlist. Default for development.
docker Each command runs in a Docker container with --network none, --read-only, and a mounted workspace.
just_bash Commands run inside a persistent just-bash Node.js sidecar container. Recommended for cloud/production.

Execution policies

Policies are orthogonal to sandbox mode — they apply an allowlist/denylist to whatever is allowed through the sandbox.

Policy Behaviour
allow_all Any command is permitted. Use only in trusted, isolated environments.
allowlist Only explicitly listed commands may run.
denylist All commands permitted except those explicitly blocked.

Configure the policy via the tool_bash_policy MCP tool or from the tool detail page.

Filesystem

Reads and writes files within a set of allowed paths. Configure the permitted root directories in the tool's transport config. Attempts to access paths outside the allowlist are rejected.

Browser

Web automation powered by Playwright / patchright. Agents can navigate pages, click elements, fill forms, take screenshots, and extract content. The browser sandbox mode (AGENT_BROWSER_SANDBOX_MODE) controls how the browser runs:

Mode When to use it
disabled Browser tool returns a plan-upgrade prompt. Default — safest.
cloud Tasks delegated to the cloud browser sidecar (headless Chromium, fast, cheap).
headful (Xvfb) Runs a real Chromium + patchright inside an Xvfb virtual display. Combine with a proxy credential for Reddit/Cloudflare/anti-bot scenarios. Set headless="false" on the tool.

FleetQ's system prompt auto-injects a policy that tells agents when to reach for headful mode (sites with heavy bot detection) versus cloud mode (fast plain scraping).

The Bash and Browser tools grant significant system access. Always scope permissions carefully and prefer allowlist policy for the Bash tool in production environments.

SSH fingerprints

For tools that connect to remote servers over SSH, FleetQ supports fingerprint verification to prevent man-in-the-middle attacks. Retrieve known fingerprints via the tool_ssh_fingerprints MCP tool or the GET /api/v1/tools/ssh-fingerprints endpoint. Fingerprints are checked automatically when the tool initiates a connection.

Semantic tool selection (tool_search)

When a team has more than 15 active tools, loading all of them into every agent prompt wastes tokens and dilutes the LLM's focus. FleetQ solves this with semantic tool selection: tool descriptions are embedded with pgvector and the most relevant tools for the current task are retrieved per call.

  • Embeddings live in the tool_registry_entries table (cosine distance, HNSW index).
  • The tool_search MCP tool can be called directly by agents for explicit tool discovery.
  • Retrieval threshold is ≥ 0.75 cosine similarity; tools below that floor are excluded from the agent's toolbelt for that turn.

Activepieces auto-sync (660+ integrations)

Point FleetQ at a self-hosted Activepieces instance and every one of its 660+ "pieces" (Stripe, Slack, GitHub, HubSpot, Salesforce, Notion, OpenAI, Google Sheets, …) becomes available in FleetQ automatically as mcp_http Tool records.

  • Hourly sync job discovers new pieces and updates existing ones.
  • Optional piece_filter limits which pieces are imported.
  • SSRF-protected — the Activepieces URL is validated on every request.
  • Trigger a manual refresh with the activepieces_sync action on the integration_manage MCP meta-tool.

Popular tools

FleetQ ships with 16 popular tools pre-seeded covering common integrations (Playwright, filesystem, git, databases, Slack, and more). All are disabled by default to avoid unintended access. Enable the ones you need from the Tools page — no configuration required for most of them.

Tools that require API keys have placeholder values in their transport config. Fill them in before enabling.

MCP tools for tool management

The FleetQ MCP server exposes the following tools so agents and LLMs can manage tools programmatically:

MCP tool Description
tool_list List all tools with optional filtering by type or status.
tool_get Retrieve full details for a specific tool by ID.
tool_create Create a new tool with name, type, and transport config.
tool_update Update an existing tool's name, description, or transport config.
tool_delete Soft-delete a tool. Agents that reference it will lose access.
tool_activate Set a tool's status to active, making it available for agent use.
tool_deactivate Disable a tool without deleting it. Existing agent assignments are preserved.
tool_discover_mcp Auto-discover available MCP servers on the host or network.
tool_import_mcp Import a discovered MCP server as a new Tool record.
tool_ssh_fingerprints Retrieve SSH fingerprints for tools that connect to remote servers.
tool_bash_policy Get or set the execution policy (allow_all / allowlist / denylist) for the Bash built-in tool.

API endpoints

Method Path Purpose
GET /api/v1/tools List all tools (cursor paginated).
POST /api/v1/tools Create a new tool.
GET /api/v1/tools/{id} Retrieve a tool by ID.
PUT /api/v1/tools/{id} Update a tool.
DELETE /api/v1/tools/{id} Soft-delete a tool.
GET /api/v1/tools/ssh-fingerprints Retrieve SSH host fingerprints for remote tool connections.