Built-in tools
Every tool the Hubzoid 1.0.1 runtime gives an agent, with arguments, limits, which surfaces receive it, and what the MCP server leaves out.
Every Hub starts with the tools on this page. They are built for the Hub they run in, so file paths resolve inside the Hub folder and chat tools resolve to the current conversation. Your own tools from tools_local/ and restricted/, and tools from MCP servers, are added on top.
Summary
| Tool | What it does |
|---|---|
read_file | Read a text file inside the Hub folder. |
list_files | List Hub files matching a glob. |
write_artifact | Save a file the user can download, and return a download link. |
list_artifacts | List files saved in this chat. |
read_upload | Preview a file the user attached in this chat. |
read_upload_full | Read an attached text file in full. |
list_knowledge | List knowledge documents. |
read_knowledge | Read one knowledge document. |
list_skills | List skills. |
load_skill | Load one skill's instructions. |
grep_data | Search raw_data/ for a pattern. |
http_get | Fetch a URL. |
web_search | Search the web. |
current_time | Current date and time in a timezone. |
render_jinja | Render a Jinja2 template with JSON values. |
remember | Save a learning into the Hub's knowledge, for people with Save shared knowledge (curator). |
call_jev | Typed decisions from Jev, for people with Call Jev (jev). Experimental. |
my_management_scope | List the agents you manage and what you can grant. Optional. |
propose_access_change | Propose a grant or removal for one person, to confirm in the Console. Optional. |
propose_new_account | Propose a new account with access, to confirm in the Console. Optional. |
connect_account | Send a personal link to connect an app. Optional. |
run_git | Read or sync a Git checkout. Scheduled markdown tasks only. |
write_hub_file | Write inside a task's declared paths. Scheduled markdown tasks only. |
publish_artifact | Publish a file the run wrote as a private artifact. Markdown tasks that opt in. |
send_email | Email the account the run acts as. Markdown tasks that opt in. |
Where each tool is available
| Tool | Chat surfaces and /v1 | Markdown tasks | Code workflow agent calls, evals, hubzoid test | MCP server |
|---|---|---|---|---|
| File, knowledge, skill, search, web and utility tools | yes | yes | yes | yes |
write_artifact, list_artifacts, read_upload, read_upload_full | yes | yes | yes | no |
remember, call_jev | with the capability | with the capability | with the capability | no |
| Management tools, when turned on | for people who manage access, not in Slack | no | no | for people who manage access |
run_git, write_hub_file | no | yes | no | no |
publish_artifact, send_email | no | when the task opts in | no | no |
Your tools_local/ tools | yes | yes | yes | yes |
Your restricted/ tools | with the permission | with the permission | with the permission | with the permission |
Delegates (handover_<name>) | yes | yes | yes | no |
Tools from connectors/.mcp.json and the shared browser | yes | yes | yes | no |
Chat surfaces are the web chat, Slack, WhatsApp, Telegram and the OpenAI-compatible API. The MCP server leaves out the four chat-scoped tools because an MCP call has no conversation to save files into or read attachments from. It also leaves out remember, call_jev and delegates, and it does not relay the Hub's own MCP servers. connect_account is covered below.
Markdown tasks and code workflow agent calls run without a chat, so write_artifact saves into output/<session>/ and reports a local path, and the upload tools have nothing to read. Evals run each case in its own chat, eval-<case>.
Files and uploads
read_file
Read a UTF-8 text file under the Hub folder.
Prop
Type
Without a limit, results over 25,000 characters are cut, and the full text is saved to an overflow file whose path the result names, so the agent can continue with offset and limit. Paths outside the Hub and anything under restricted/ are refused.
list_files
List files under the Hub folder that match a glob.
Prop
Type
Returns up to 100 paths, with a note to narrow the glob when there are more. Files under restricted/ are never listed.
write_artifact
Save a text file for the user and return a download link.
Prop
Type
The file goes to .hubzoid/chats/<chat>/artifacts/. The link is signed, so a browser can open it without an API key, and it is built from HUBZOID_PUBLIC_URL, then WEBUI_URL, then the bridge's loopback address. The runtime also shows the link to the user even when the model does not repeat it. Links expire only when HUBZOID_ARTIFACT_LINK_TTL is set. The built-in dashboard skill uses this tool to deliver single-file HTML dashboards. These chat downloads are separate from published artifacts, which workflows create with hub.publish_artifact and people open in the artifact viewer.
list_artifacts
List the files saved in this chat so far, with their sizes. Takes no arguments.
read_upload
Preview a file the user attached in this chat. The preview depends on the file type.
Prop
Type
| File type | Preview |
|---|---|
| Text | The first 200 lines, or the whole file when it is shorter. |
| JSON | A structural summary and the start of the formatted document. |
| CSV | The header, the first 20 rows and the row count. |
| Extracted text of the first 5 pages, or the pages you ask for. | |
| Image | Metadata only. With HUBZOID_VISION on, the model sees attached images directly. |
| Other binary | A hex preview of the first bytes. |
Text previews start with the file's path on disk, so the agent can pass the file to a tool that takes a path.
read_upload_full
Read an attached text file in full, up to 500,000 characters.
Prop
Type
Refuses images and other binary files. Use it after read_upload when the preview says more is available.
Knowledge and skills
list_knowledge
List every document in knowledge/ as name: description. Takes no arguments.
read_knowledge
Return the body of one knowledge document.
Prop
Type
Both knowledge tools read the folder from disk on each call, so edits and documents saved with remember are visible immediately.
list_skills
List every skill as name: description. Takes no arguments.
load_skill
Return the instructions of one skill.
Prop
Type
Skills include skills/, sub-agents loaded as skills, and on chat surfaces the built-in dashboard skill. The skill list is read when the Hub starts. See Hub files.
Search and web
grep_data
Search inside the Hub for a regular expression or plain string. Uses rg (ripgrep) when it is installed and a Python search otherwise, with the same output.
Prop
Type
Returns path:line:content lines grouped by file, most matches first. Limits: 100 matches in total, 30 per file, 300 characters per line and 25,000 characters per result, with notes on how to narrow the search. Folders such as .git, node_modules, .venv, dist and build are skipped, as are files over 5 MB in the Python search. The tool needs a raw_data/ folder, and refuses paths outside the Hub or under restricted/.
http_get
Fetch a URL and return the status and body as text. No JavaScript runs and no credentials are sent.
Prop
Type
Follows redirects, times out after 15 seconds, and cuts bodies at 50,000 characters. With HTTP_ALLOWLIST set, only the listed hosts and their subdomains are fetched. HUBZOID_DISABLE_HTTP_GET=true removes the tool.
web_search
Search the web through DuckDuckGo's HTML results. No API key is needed.
Prop
Type
Returns a list of titles, links and snippets. HUBZOID_DISABLE_WEB_SEARCH=true removes the tool.
Utilities
current_time
Return the current date and time as ISO 8601, for example 2026-05-20T14:32:01+05:30.
Prop
Type
render_jinja
Render a Jinja2 template with values from a JSON object. Undefined variables are an error rather than empty text.
Prop
Type
Learning
remember
Save a learning as a knowledge document. The tool tells the model to call it only when the user explicitly asks it to remember something.
Prop
Type
The document is written to knowledge/_learned/<slug>.md with the author and time in its frontmatter, and the previous version is kept as <slug>.md.bak. Content is limited to 100,000 bytes. Every person using the Hub can read the result through read_knowledge.
remember is on every Hub but works only for a caller who holds the curator permission, shown in the Console as Save shared knowledge, on a surface allowed to use restricted tools. On a Hub whose access is managed in the Console, grant it there or with hubzoid grant <email> curator. On a Hub with group-based access, membership of a web chat group named curator gives the same access. Until someone holds it, the tool is hidden and every call is refused. A Hub tool named remember replaces this one.
Decisions
call_jev
Ask Jev, TypeSafe's decision model, typed questions about a piece of text through OpenRouter. It returns answers with probabilities instead of prose. Experimental.
Prop
Type
| Type | Asks | Answer |
|---|---|---|
noul | Does it hold? | The probability of yes. Criteria are optional. |
choice | Which label fits? | One of two or more labels given in criteria, with probabilities. |
score | Where on a scale? | A score from 0 to the last of two or more levels in criteria, lowest first. |
call_jev is on every Hub but works only for a caller who holds the jev capability, shown in the Console as Call Jev, on a surface allowed to use restricted tools. Nobody holds it by default, and the Console shows "Jev key missing" until JEV_OPENROUTER_API_KEY is set. The tool uses only that key, never OPENROUTER_API_KEY or the Hub's model. Each call writes a usage row. A failure comes back as readable text. A Hub tool named call_jev replaces this one. Workflows use the same adapter as hub.call_jev. See the workflow API.
Management tools
With HUBZOID_MANAGEMENT_TOOLS=true on a Hub whose access is managed in the Console, the agent gets three tools that propose people and access changes. They only propose. Nothing changes until the same person opens the link the tool returns, signs in to the Console on the web and confirms the exact change.
| Tool | Arguments | What it does |
|---|---|---|
my_management_scope | none | Lists the agents the caller manages and the capabilities they can grant in each, with Console labels and ids. Read only. |
propose_access_change | person (email), hub, optional grant and revoke lists of capability ids | Proposes granting or removing capabilities for one person in one agent. Removing use_hub removes all of that person's access there. |
propose_new_account | email, name, hub, optional grant list | Proposes a new chat account with access to one agent. Chat access is included. The password is set on the confirmation page, never in chat. |
- The acting person is always the signed-in caller. No tool takes an actor, and no tool accepts or returns a password.
- They work on the web chat, the API, MCP, WhatsApp and Telegram. They refuse anonymous callers, scheduled work and every Slack surface, and are hidden from people who manage nothing.
- A proposal is checked against the caller's own access, can be used once, and expires after
HUBZOID_CHANGE_REQUEST_TTLseconds (900 by default). At most 20 can wait per person. Each proposal, confirmation, rejection and expiry is recorded in the access log with its surface.
Personal connections
connect_account
Start a connection journey for the caller's own account in an app, for example Gmail. Present on every runtime only when HUBZOID_CONNECT_JOURNEY=true.
Prop
Type
Returns either a note that the app is already connected or a personal link to /portal/connect/<id>, which works only for the person who asked while signed in and expires after HUBZOID_CONNECT_TTL seconds. The caller needs the app's connector_<app> capability, and the app must be an OAuth 2.1 MCP server registered in the web chat with OWUI_NATIVE_MCP=true. See tools and connectors.
Scheduled task tools
A markdown task run receives two more tools, and two others when its frontmatter opts in. They are never available in chat.
run_git
Run a read or sync Git command in a checkout inside the Hub.
Prop
Type
Allowed verbs are pull, fetch, log, diff, show, status, rev-parse, ls-files, branch, shortlog, describe and the read-only forms of remote. Flags that could write files or run commands, such as --output, --upload-pack, -c and --git-dir, are refused. Each call times out after 300 seconds, and output is cut at 60,000 characters. Hubzoid itself commits the task's commit: paths after the run.
write_hub_file
Create or overwrite a file inside the task's writable paths.
Prop
Type
Writable paths are the task's commit: and write: paths plus its scratch folder, .hubzoid/schedule/<task>/. The schedule/ folder and any .git/ folder are never writable, even under a broad commit: path. See markdown tasks.
publish_artifact
Publish a file the run wrote as a private artifact owned by the account the run acts as. Offered only when the task sets publish_artifacts: true.
Prop
Type
Returns the artifact's id and its viewer link, /portal/artifacts/<id>. Only the owner can open it until they share it. Files that hold secrets, such as .env files and databases, are refused. See the HTTP endpoints for the viewer.
send_email
Email the account the run acts as, the only possible recipient, with optional links to artifacts published in the same run. Offered only when the task sets send_email: true.
Prop
Type
At most five emails per run. Only an accepted result means the SMTP server took the message, and even then it does not confirm delivery to the inbox. It uses the HUBZOID_SMTP_* settings, or writes to a preview outbox with HUBZOID_EMAIL_DELIVERY=preview. See configuration.
Tools from other sources
- Delegates. A sub-agent that runs on its own model becomes a tool named
handover_<name>on the OpenAI Agents and Codex runtimes, and a Claude subagent onclaude-local. See Hub files. - MCP servers. Each server in
connectors/.mcp.jsonadds its tools. See tools and connectors. - The shared browser.
HUBZOID_BROWSER=trueadds the Playwright tools, such asbrowser_navigate,browser_clickandbrowser_snapshot, as an MCP server namedplaywright. - Personal MCP connections. With
OWUI_NATIVE_MCP=true, servers a person connected in the web chat are added for that person's turns on every runtime. On a Console-managed Hub each one also needs the person'sconnector_<app>capability. See tools and connectors.
Names on each backend
On the OpenAI Agents and Codex runtimes tools keep the names above, and tools from MCP servers keep their own names. On claude-local, Hubzoid's tools are served to Claude as an in-process MCP server, so the model sees mcp__hubzoid__read_file, external servers appear as mcp__<server>__<tool>, and personal servers as mcp__owui_<name>__<tool>. Eval checks such as expect_tools match the short name on every runtime. On claude-local, Claude Code's own tools (shell, file editing and the rest) are switched off, so the agent only has the tools on this page and the ones you add. The one exception is Claude's subagent tool, which is enabled when the Hub has delegates. On codex-local, Codex's own shell, file, browser and web search tools are switched off in the same way, and Hubzoid runs every tool the agent calls.
On every runtime the agent sees only the controlled tools (restricted/ tools, remember, call_jev) the caller may use, and the management tools only when the caller manages access.
Change the tool set
| To | Do this |
|---|---|
Remove http_get or web_search | Set HUBZOID_DISABLE_HTTP_GET=true or HUBZOID_DISABLE_WEB_SEARCH=true. |
Limit http_get to known hosts | Set HTTP_ALLOWLIST=example.com,api.example.com. |
| Replace a built-in | Add a tools_local/ tool with the same name. |
| Require a permission for a tool | Put it in restricted/<permission>.py. See restrict tools. |
| Limit a delegate's tools | List them in the sub-agent's tools:. |
Next steps
Workflow API
Reference for Hubzoid code workflows. The @workflow and @step decorators, the hub object, the account a run acts as, workflow state, artifacts, email, the schedule grammar, settings and exceptions.
HTTP endpoints
Every HTTP route Hubzoid 1.0.1 serves on the edge, bridge, MCP server, Console API, artifact viewer and webhook receiver, with method, authentication and purpose.