Platform Tools Overview

What are Platform Tools?

Platform tools are compiled into the runner. At session creation, the runner resolves the profile’s tools selectors into a session-scoped registry and exposes that registry through:

/runner/sessions/{id}/toolkit/*
/runner/sessions/{id}/mcp

Calling a tool outside the session scope returns 403.

Tool Selectors

Selector form	Example	Result
Exact name	`time_now`	Selects one tool
Glob	`web_*`	Selects matching tool names within one dot segment
Capability	`@fs`	Selects all tools with that capability
Default sentinel	`@default`	Splices in the default selector list

The default selector list is:

["@introspection", "@fs", "@pool", "time_now", "echo", "math_add"]

Because web_search and web_extract currently carry the introspection capability, they are selected by @introspection. They return a deterministic “not configured” tool error when TAVILY_API_KEY is unset.

Platform Skills

Every install seeds per-capability using-* skills such as using-introspection, using-fs, using-vfs, using-memory, using-web, using-sandbox, using-artifacts, using-pool, using-orchestration, using-profiles-admin, using-pools-admin, using-mcp, and using-skills. At run dispatch, capability selectors in tools auto-attach the matching platform skill after any explicit profile skills. An empty or omitted tools array is treated like @default, so default profiles receive the baseline using-* guidance. Auto-attached names that are missing from the catalog are skipped silently; explicit skills entries are validated when the profile is created or updated and confirmed unknown names return 400 Bad Request. Platform skills have source: "platform" in the skill catalog. In filesystem mode, Orca reconciles them at boot and records deletions in platform_skills_state.json. In Postgres mode, Orca reconciles them per tenant on the first skills-list or run-dispatch request and records deletions in tenant-scoped database tombstones. In both modes, deleting a platform skill through the normal skills API keeps it from being restored by a later seed pass. When a worker successfully runs activate_skill, it emits a progress run event with the message skill activated: <name>. The event is available in the live run stream and persisted run log for per-run auditing. Skills that bundle scripts/ resources can use run_skill_script during a session. The tool stages the selected script resource into the session sandbox and executes it there; it does not run skill code on the runner or worker host. The tool only appears in a session toolkit when the profile has active skills, and the skill’s allowedTools scalar permits Bash/script execution.

Capabilities

Capability	Default	Tools
`@introspection`	Yes	`time_now`, `echo`, `math_add`, `runner_info`, `session_info`, `profile_info`, `run_info`, `usage_info`, `list_profiles`, `list_sessions`, `list_mcp_servers`, `search_connected_app_tools`, `call_connected_app_tool`, `topology_info`, `web_search`, `web_extract`
`@fs`	Yes	`read_file`, `write_file`, `list_dir`, `delete_file`
`@pool`	Yes	`pool_info`, `pool_post`, `pool_inbox`
`@vfs`	No	`vfs_execute`, `vfs_grep`
`@sandbox`	No	Sandbox execution and file-transfer tools, including `run_skill_script` for active skill scripts
`@artifacts`	No	`save_artifact`, `get_artifact`, `list_artifacts`
`@memory`	No	`memory_save`, `memory_recall`, `memory_list`, `memory_delete`. Selecting this capability also enables automatic Memory Bank prompt injection — see Memory Bank
`@orchestration`	No	`delegate_run`, `get_run`, `stream_run_events`, `cancel_run`, `submit_workflow_run`, `get_workflow_run`, `wait_workflow_run`, `repair_workflow_run`, `cancel_workflow_run`

@orchestration tools are registered by default but still unavailable unless the profile selects them. Set AGENT_ORC_ORCHESTRATION_TOOLS=off on a runner to remove them from the registry entirely.

Common Profiles

Default plus web and files

{
  "tools": ["@default"]
}

Coordinator

{
  "tools": ["@default", "@orchestration"]
}

Strict read-only filesystem profile

{
  "tools": ["read_file", "list_dir"],
  "fs": {
    "read": ["/datasets/**"],
    "deny": ["/datasets/private/**"]
  }
}

Raw artifact access

{
  "tools": ["@default", "@artifacts"]
}

Long-lived memory

{
  "tools": ["@default", "@memory"]
}

Opting in to @memory both registers the four memory tools and enables a --- CONTEXT FROM MEMORY --- block prepended to every run’s prompt.

Runtime Dependencies

Tool group	Required environment
Web search/extract	`TAVILY_API_KEY` on the runner
Conductor-backed introspection	`CONDUCTOR_BASE_URL` on the runner
File and pool post/inbox tools	Optional `VFS_POSTGRES_DSN`, `VFS_REDIS_URL`, `VFS_S3_BUCKET`, and `VFS_S3_ENDPOINT`; with no VFS env they use an in-memory dispatcher
Artifact tools	`S3_BUCKET` plus AWS/S3 environment
Memory Bank	`S3_BUCKET` plus AWS/S3 environment for persistence; `ANTHROPIC_API_KEY` (and optional `ANTHROPIC_MEMORY_MODEL`) to enable LLM extraction in `memory_save`
Sandbox tools	A runner sandbox manager with a registered provider. Stock runner env wiring registers E2B from `E2B_API_KEY` / `E2B_KEY`, optional `E2B_BASE_URL`, `E2B_BRIDGE_URL`, and `E2B_DEFAULT_TEMPLATE`; it also registers Daytona from `DAYTONA_API_KEY`, with optional `DAYTONA_API_URL`, `DAYTONA_TOOLBOX_URL` (the toolbox proxy host root, without a trailing `/toolbox`), `DAYTONA_TARGET`, and `DAYTONA_DEFAULT_SNAPSHOT`. E2B registers first and remains the default provider when both are configured.
Orchestration tools	Profile selects `@orchestration`; set `AGENT_ORC_ORCHESTRATION_TOOLS=off` to disable registration
Delegation depth	`AGENT_ORC_MAX_DELEGATION_DEPTH` default `3`

Missing dependencies usually produce tool-level { "ok": false, "error": "..." } responses rather than profile-registration failures. For sandbox-enabled profiles, SANDBOX_IDLE_PAUSE controls when the runner idles an unused sandbox; the default is 60s, and 0 disables the idle scanner. On Daytona sandboxes where /pause is not supported, the runner falls back to Daytona stop/start while still exposing the lease as paused/resumable in Orca. That fallback preserves the sandbox filesystem but clears process memory. Daytona executes each sandbox command through the login shell listed by the snapshot image. The selected DAYTONA_DEFAULT_SNAPSHOT must include that shell binary; if the shell is missing, sandbox exec fails before the command starts and Orca returns a diagnostic naming the missing shell and pointing operators at a snapshot with a working login shell, such as daytona-small.

​What are Platform Tools?

​Tool Selectors

​Platform Skills

​Capabilities

​Common Profiles

​Default plus web and files

​Coordinator

​Strict read-only filesystem profile

​Raw artifact access

​Long-lived memory

​Runtime Dependencies