# The tools catalog

Tools are the capabilities your agents act with. The catalog is read-only — a tool is executable code, so it isn't authored in the app. You connect new tools by linking MCP servers and apps; agents and skills then pick which ones to use.

## A read-only catalog

Open Workbench → Tools to browse every tool available to your agents, grouped by capability and searchable. You don’t create tools here — a tool is executable code. Instead, agents and skills select which tools to use, and you add capability by connecting MCP servers and apps.

## Where tools come from

Every tool in the catalog traces back to one of four sources:

- Built-in — Foxora’s first-party tools: web search and fetch, vision, planning (todo_write), skills (use_skill), orchestration (task, ask_user), memory, and browser/OS reach.
- Workspace — the jailed filesystem, search, shell, and code-intel tools from the Mastra workspace (read, edit, grep, bash…). Discovery runs through bash, so there’s no separate file-finder tool.
- MCP — tools exposed by any MCP server you connect.
- Connections — tools that appear when you link an app (Slack, GitHub, Notion…) in an agent’s Connections.

## Approval levels

Each tool carries an approval level that decides whether it can run on its own or needs your sign-off — this is what your autonomy setting acts on:

- Read — safe, no approval. Reading a file, searching, fetching a URL, inspecting symbols. These just observe.
- Write — changes files. write and edit render a diff and are gated when you’re on Ask first.
- Execute — runs commands or destructive actions: bash, delete_file, stopping a process, delegating a sub-task. The most guarded tier.

## Adding tools by connecting apps

Because the catalog is read-only, the way you give agents new powers is to connect them. Link an MCP server or an app from an agent’s Connections tab, and its tools flow into the catalog as live tools — ready for that agent to use, and grantable to your skills.

> Skills and tools, togetherWhen you author a custom skill, you grant it tools from this same catalog. Connect the app first, then grant the tool — the skill and the agent both see it.