Tools your agents can reach
An agent is only as useful as what it can touch. A tool server is registered once by an administrator and becomes available to every client on the platform — with the credential injected server-side, the arguments policy-scanned, and each call audited under the identity of the person it acts for.
Platform self-service
Answers "why am I getting a 429" with the asker's own limits, their own denials and their own spend — instead of a definition. Reads through purpose-built database views that cannot see prompt or response bodies at all.
Skills library
A git-backed store of reusable agent instructions, with one commit per save and the author taken from the caller's verified identity. Can mirror skills from public registries so they keep working with no internet connection.
Calendar
Create, find, move and cancel meetings in the caller's own work calendar. Every call is made as that person, so the calendar service enforces their real permissions — the platform never holds a shared mailbox key.
Read, search, file and send mail as the signed-in person, from their own address. Message lists deliberately fetch previews only; the body is a separate, explicit call.
Chat delivery
How an agent tells a person something. Conversation identifiers are never exposed to the model — it is handed an opaque key scoped to the person it is acting for, so a prompt-injected agent cannot message a conversation it was not given.
Support tickets
Open, read, comment, reassign and resolve support tickets. Every state change carries its explanation in the same request, so a customer-visible record never changes without a reason beside it — and the note names who it was done for.
Expenses
A photographed receipt becomes a validated expense record and reaches the right approver. The database has the last word, not the application: a trigger freezes an approved record against any ordinary actor.
Document search
Search a PDF corpus and get the filename and the page number with every result. Extraction is per page, never concatenated, which costs a little recall and buys a citation that is always exactly right. Pages that yielded no text are reported, not hidden.
Course search
Cross-course search over the whole training catalogue — which courses cover a topic, whether a subject has an exercise, what a given course says about it. Results say whether the reader is enrolled.
Document conversion
Turns a PDF, Office file, web page or spreadsheet into clean Markdown. It refuses to read the filesystem, refuses private network addresses on every redirect hop, and its transcription converter is removed at boot and the removal asserted.
Network devices
Read configuration and run operational commands on network hardware, with per-device permission: view, operate, or administer. A device nobody granted you is indistinguishable from a device that does not exist.
Weather and marine
Point forecasts anywhere on earth, including wave height, period and sea temperature. Every record is labelled MODEL in the data itself, because a numerical forecast is not an official bulletin and the reader is a language model that would otherwise flatten the two.
Maritime safety
Official navigational warnings and safety messages. The rule it exists to enforce: "stale" and "unavailable" are never reported as "there is no warning" — a fetch that succeeds but parses to zero records is recorded as a fault, not as an empty result.
Places and routes
Find places and draw the route between them. It works with no mapping contract at all, using open data — and the planning-draft disclaimer is burned into the image pixels, because a picture travels and the caveat beside it does not.
Chat archive
Read-only search over archived group conversations. Read-only is enforced three ways, including a source assertion that fails the build if a write call appears anywhere — because the account belongs to a real person sitting in rooms full of people who never agreed to a robot posting for them.
And the ones your teams register
The remaining servers on this platform were registered by teams for their own systems — log search, security analytics, network fabric management, documentation and code intelligence. They are not listed here by name because several carry a customer's or a colleague's. Registering one is a form and a credential; nothing about it needs a deployment.
What registering a server actually changes
- Clients never learn the address or the secret. They call the platform; the platform calls the server.
- Each call's arguments are scanned by the same policy engine that scans prompts, and refused on the same terms.
- Every call is written to the audit trail with the tool, the arguments and the result, under the identity it ran for.
- A server can be limited to certain teams, require a real end user, or be granted person by person — and a server you may not use is indistinguishable from one that does not exist.
