Agent tools

Every tool Multilo's agent can use, what it does, whether it asks first, and the name to use in permission rules.

The agent works by calling tools: reading a file, running a command, searching the web. This page lists every tool, what it does, and whether it waits for your yes in Approve mode. Use the names here in permission rules and hooks.

In Autopilot, routine tools run without asking. A few things still ask in every mode except Bypass permissions: commands that delete files, changes to the agent’s own settings folders, writing outside your open folders, and the first visit to a new website. See Permission modes.

Files

Tool	What it does	Asks first
`Read`	Reads a file: text, PDF pages, images, notebooks, and transcripts of audio and video	No. Yes outside your open folders.
`Write`	Creates a file, or replaces a whole file	Yes
`Edit`	Changes part of a file	Yes
`apply_patch`	Changes one or more files with a patch	Yes
`notebookEdit`	Changes cells in a Jupyter notebook	Yes
`listDir`	Shows a folder’s contents	No
`Glob`	Finds files by name, such as `*/.csv`	No
`Grep`	Searches inside files	No

Depending on the model, the agent edits with either Edit or apply_patch, never both. A permission rule for Edit(…) covers Edit, Write, apply_patch and notebookEdit.

Commands

Tool	What it does	Asks first
`Bash` (`PowerShell` on Windows)	Runs a command in your shell	Yes, except commands that only read and commands in the sandbox. Deleting files always asks.
`Monitor`	Watches the output of a command running in the background	Yes, except commands that only read and sandboxed ones
`write_stdin`	Types input into a command that’s running	No
`TaskStop`	Stops a background command or agent	No

On Windows with Git for Windows installed, the agent gets both PowerShell and Bash.

Web and browser

Tool	What it does	Asks first
`WebSearch`	Searches the web	No
`WebFetch`	Reads a web page and answers from it	Yes, unless the site is allowed
`openBrowserPage`, `navigatePage`, `readPage`, `clickElement`, `typeInPage`, `hoverElement`, `dragElement`, `screenshotPage`, `handleDialog`, `readNetworkRequests`	Use pages in Multilo’s built-in browser: open, go to, read, click, type, hover, drag, take a screenshot, answer a dialog, list network requests	The first time on each website, in each chat
`runPageScript`	Runs JavaScript in a page	Yes, every time
`listBrowserPages`, `closeBrowserPage`	Lists or closes the browser’s pages	No

Allowing a website once allows it for all the browser tools in that chat.

Research and writing

Tool	What it does	Asks first
`librarySearch`	Searches your library of papers	No
`citeSuggest`	Suggests sources to cite	No
`citeVerify`	Checks that citations are real and say what’s claimed	No
`citeInsert`	Puts a citation into your document	No
`problems`	Lists the problems shown for your files, such as errors and warnings	No

Working with you

Tool	What it does	Asks first
`AskUserQuestion`	Asks you a question with choices	No
`TodoWrite`	Keeps the task’s checklist	No
`EnterPlanMode`	Switches to planning before changing anything	No
`ExitPlanMode`	Shows you the plan to approve	No. Your answer to the plan is the approval.
`Skill`	Runs a skill	No
`memory`	Reads and updates the agent’s memory files, when memory is on	No
`ToolSearch`	Loads a tool that isn’t loaded yet	No

Other agents and schedules

Tool	What it does	Asks first
`Agent`	Starts another agent to do part of the work	No
`SendMessage`	Sends a message to an agent that’s running	No
`CronCreate`, `CronList`, `CronDelete`	Schedules a prompt to run later, lists schedules, or cancels one	No

MCP servers

Each tool of a connected MCP server becomes an agent tool. It asks first, unless the server marks it as read-only. Two more tools work with the servers’ resources: ListMcpResourcesTool and ReadMcpResourceTool, which don’t ask.

In permission rules, name MCP tools like this:

Rule	Matches
`mcp__github`	Every tool of the server named `github`
`mcp__github__*`	The same
`mcp__github__get_issue`	One tool

Tools loaded when needed

To keep the agent fast, some tools aren’t loaded at the start. The agent loads them with ToolSearch when it needs them. These include listDir, SendMessage, the plan tools, problems, librarySearch, the citation tools, the schedule tools, Monitor, write_stdin, notebookEdit, the browser tools and MCP tools. This doesn’t change what they can do or whether they ask.

Names in permission rules

Rule	What it matches
`Read(path)`	Reading a file or folder. A deny also blocks editing it and hides it from `listDir`.
`Edit(path)`	Changing a file with `Edit`, `Write`, `apply_patch` or `notebookEdit`
`Bash(command *)`	Shell commands that start with `command`
`WebFetch(domain:example.org)`	Reading pages on one website
`browser`	All the browser tools
A tool’s name, such as `WebSearch`	Every use of that tool

See Permissions for how Allow, Ask and Deny rules work.

PermissionsApproval cards and Allow, Ask and Deny rules.Permission modesApprove, Autopilot and Bypass permissions.SandboxRun commands without asking.HooksRun your own checks before or after a tool.