# Claude Managed Agents Tools Tools are attached to an [[Claude Managed Agents|agent]] at creation time; Claude decides when to call them during a session. Three kinds mix freely in the `tools` array: 1. **Built-in agent toolset**: the full file/shell/web kit, enabled via `agent_toolset_20260401` 2. **Custom tools**: your own tool contracts, executed client-side 3. **MCP toolsets**: third-party capabilities via [[Model Context Protocol (MCP)]] servers ## The built-in toolset One tool entry enables the whole kit: ```json {"type": "agent_toolset_20260401"} ``` | Tool | Purpose | |---|---| | `bash` | Shell commands in the container | | `read` / `write` / `edit` | File I/O with string-replace edits | | `glob` | Pattern-based file matching | | `grep` | Regex text search | | `web_fetch` | Retrieve URL content | | `web_search` | General web search | All are enabled by default when the toolset is included. Tool outputs over 100,000 characters (about 25,000 tokens) are written to a file in the sandbox; the model gets a truncated preview plus the path. ### Permission policies Each config entry (or `default_config`) can set a `permission_policy`: `always_allow` (the agent toolset default), `always_ask` (the MCP toolset default), or `auto` (the server evaluates each call and asks you only when it can't decide). Events show the result as `evaluated_permission`. See [[Claude Managed Agents Events]] for the confirmation flow. ### Restrict web search and web fetch domains Set `allowed_domains` or `blocked_domains` (not both) on the `web_search` and `web_fetch` entries; each covers subdomains. A disallowed `web_fetch` returns `url_not_allowed`; `web_search` drops the results. The environment's `networking` doesn't apply to these tools, which run on Anthropic's servers. Web search costs $10 per 1,000 searches. ### Disabling specific tools ```json { "type": "agent_toolset_20260401", "configs": [{"name": "web_fetch", "enabled": false}] } ``` ### Allowlist mode (everything off, enable only what you need) ```json { "type": "agent_toolset_20260401", "default_config": {"enabled": false}, "configs": [ {"name": "bash", "enabled": true}, {"name": "read", "enabled": true} ] } ``` ## Custom tools Same contract as [[Large Language Models (LLMs)|LLM]] client-executed tools in the Messages API. Claude emits a structured call; your code executes it; you reply with a `user.custom_tool_result` event. ```json { "type": "custom", "name": "get_weather", "description": "Get current weather for a location", "input_schema": { "type": "object", "properties": {"location": {"type": "string"}}, "required": ["location"] } } ``` ### Best practices - Write rich, specific descriptions (3-4+ sentences); this is the single biggest factor in tool-use quality - Consolidate related ops into one tool with an `action` parameter instead of creating many siblings - Namespace names when tools span services (`db_query`, `storage_read`) - Return only high-signal, stable fields; bloated responses waste context ## MCP toolsets Declare MCP servers on the agent by `name` + `url`; reference them via `mcp_toolset`. The `mcp_toolset` entry also takes `default_config` and `configs` (`name`, `enabled`, `permission_policy` only) to enable or disable individual server tools. ```json { "mcp_servers": [ {"type": "url", "name": "github", "url": "https://api.githubcopilot.com/mcp/"} ], "tools": [ {"type": "agent_toolset_20260401"}, {"type": "mcp_toolset", "mcp_server_name": "github"} ] } ``` Auth is supplied **per session** via `vault_ids`: credentials live in vaults, not in the agent definition, so reusable agent configs never contain secrets. MCP toolsets default to `always_ask` permission policy (user confirmation per call). Only **remote MCP servers** over HTTP are supported (streamable HTTP; SSE-only servers still work through an automatic fallback); no stdio. Private servers can be reached through MCP tunnels (research preview). With `limited` networking, the environment must allow the server's host or set `allow_mcp_servers: true`. CLIs are the other integration path: since June 2026, vault **environment-variable credentials** let CLIs in the sandbox call authenticated APIs without the agent ever seeing the key (see [[Claude Managed Agents]]). ## Skills ~~Attach up to 20 skills per session.~~ As of October 2026: up to **500 skills** per session, counted as the deduplicated set across every agent in the session. Pre-built Anthropic skills (e.g., `xlsx`, `pdf`, `pptx`, `docx`) or custom skills authored for your organization. They load on demand via progressive disclosure, keeping the context window lean. ```json { "skills": [ {"type": "anthropic", "skill_id": "xlsx"}, {"type": "custom", "skill_id": "skill_abc123", "version": "latest"} ] } ``` See [[AI Agent Skills]] for the general pattern. ## References - Tools: https://platform.claude.com/docs/en/managed-agents/tools - MCP connector: https://platform.claude.com/docs/en/managed-agents/mcp-connector - Skills: https://platform.claude.com/docs/en/managed-agents/skills - Permission policies: https://platform.claude.com/docs/en/managed-agents/permission-policies - Reference (supported MCP server types): https://platform.claude.com/docs/en/managed-agents/reference#supported-mcp-server-types - Environments (networking): https://platform.claude.com/docs/en/managed-agents/environments - Pricing (web search): https://platform.claude.com/docs/en/about-claude/pricing#claude-managed-agents-pricing ## Related - [[Claude Managed Agents]] - [[Claude Managed Agents Events]] - [[Model Context Protocol (MCP)]] - [[AI Agent Skills]] - [[Claude Managed Agents Environments]]