Platform Tools Overview

What are Platform Tools?

Platform tools are compiled into the runner. At session creation, the runner resolves the profile’s tools selectors into a session-scoped registry and makes that registry available to the agent through a session-scoped tool interface. Calling a tool outside the session scope returns 403.

Tool Selectors

Selector form	Example	Result
Exact name	`time_now`	Selects one tool
Glob	`web_*`	Selects matching tool names within one dot segment
Capability	`@fs`	Selects all tools with that capability
Default sentinel	`@default`	Splices in the default selector list

The default selector list is:

["@introspection", "@fs", "@pool", "time_now", "echo", "math_add"]

Because web_search and web_extract currently carry the introspection capability, they are selected by @introspection. They return a deterministic “not configured” tool error when TAVILY_API_KEY is unset.

Platform Skills

Every install seeds per-capability using-* skills such as using-introspection, using-fs, using-vfs, using-memory, using-web, using-sandbox, using-artifacts, using-pool, using-orchestration, using-profiles-admin, using-pools-admin, using-mcp, and using-skills. At run dispatch, capability selectors in tools auto-attach the matching platform skill after any explicit profile skills. An empty or omitted tools array is treated like @default, so default profiles receive the baseline using-* guidance. Auto-attached names that are missing from the catalog are skipped silently. Explicit skills entries are not validated when the profile is created or updated: an unknown skill name is accepted, and only surfaces later, through the profile’s readiness response (ready: false naming the missing skill) and a profile_not_ready refusal at run-create time. Platform skills have source: "platform" in the skill catalog. In filesystem mode, Orca reconciles them at boot and records deletions in platform_skills_state.json. In Postgres mode, Orca reconciles them per tenant on the first skills-list or run-dispatch request and records deletions in tenant-scoped database tombstones. In both modes, deleting a platform skill through the normal skills API keeps it from being restored by a later seed pass. On the claude runtime, when a worker successfully runs activate_skill, it emits a progress run event with the message skill activated: <name>, available in the live run stream and persisted run log for per-run auditing. The pi runtime (the platform default) and the vercel runtime’s skill tools do not emit this event. Skills that bundle scripts/ resources can use run_skill_script during a session. The tool stages the selected script resource into the session sandbox and executes it there; it does not run skill code on the runner or worker host. The tool is auto-registered in a session toolkit whenever the profile has active skills, and separately whenever the profile selects @sandbox, regardless of skills. Its allowedTools check runs inside the tool itself, against the specific skill named in each call, not against toolkit membership.

Capabilities

Capability	Default	Tools
`@introspection`	Yes	`time_now`, `echo`, `math_add`, `runner_info`, `session_info`, `profile_info`, `run_info`, `usage_info`, `list_profiles`, `list_sessions`, `list_mcp_servers`, `list_models`, `platform_catalog`, `search_connected_app_tools`, `call_connected_app_tool`, `topology_info`, `web_search`, `web_extract`
`@fs`	Yes	`read_file`, `write_file`, `list_dir`, `delete_file`
`@pool`	Yes	`pool_info`, `pool_post`, `pool_inbox`
`@vfs`	No	`vfs_execute`, `vfs_grep`
`@sandbox`	No	Sandbox execution and file-transfer tools, including `run_skill_script` for active skill scripts
`@artifacts`	No	`save_artifact`, `get_artifact`, `list_artifacts`
`@memory`	No	`memory_save`, `memory_recall`, `memory_list`, `memory_delete`. Selecting this capability also enables automatic Memory Bank prompt injection. See Memory Bank.
`@orchestration`	No	`delegate_run`, `get_run`, `stream_run_events`, `cancel_run`, `submit_workflow_run`, `get_workflow_run`, `wait_workflow_run`, `repair_workflow_run`, `cancel_workflow_run`
`@profiles`	No	`create_profile`, `update_profile`, `delete_profile`, `attach_skill`, `detach_skill`
`@pools.admin`	No	`create_pool`, `update_pool`, `delete_pool`, `add_pool_member`, `remove_pool_member`
`@mcp`	No	`add_mcp_server`, `update_mcp_server`, `delete_mcp_server`, `test_mcp_connection`
`@skills`	No	`list_skills`, `describe_skill`
`@notify`	No	`email_me`

@orchestration tools are registered by default but still unavailable unless the profile selects them. Set AGENT_ORC_ORCHESTRATION_TOOLS=off on a runner to remove them from the registry entirely.

Notifications (`@notify`)

@notify is opt-in: it is not part of @default and must be added explicitly to a profile’s tools. Selecting it registers one tool, email_me, which lets the agent send a short notification email, for example “your draft pull request is ready” with a link. email_me takes:

Argument	Required	Notes
`subject`	Yes	Max 200 characters
`body`	Yes	Plain text, max 4000 characters; a blank line starts a new paragraph
`linkUrl`	No	Absolute `http(s)` URL rendered as the email’s action button
`linkText`	No	Max 60 characters; defaults to `Open`

There is no recipient argument. The email goes to the workspace owner, falling back to an admin and then any member with an email on file; the address is resolved server-side from the tenant’s memberships, so neither the agent nor a prompt injection can redirect it elsewhere. The body renders into a fixed transactional template; at most one email_me send is delivered per run, and each tenant has a daily send limit (five per day if no explicit limit is configured for the workspace). The email sent at the daily limit says explicitly that it was the last one for the day. A workspace admin turns these emails on or off for the whole workspace through PUT /api/notify/settings (GET /api/notify/settings reads the current state); there is no dashboard control for this yet, so the setting is API-only. The surface also depends on the deployment having outbound email configured; without it, calls to email_me succeed but report that no email was sent.

Common Profiles

Default plus web and files

{
  "tools": ["@default"]
}

Coordinator

{
  "tools": ["@default", "@orchestration"]
}

Strict read-only filesystem profile

{
  "tools": ["read_file", "list_dir"],
  "fs": {
    "read": ["/datasets/**"],
    "deny": ["/datasets/private/**"]
  }
}

Raw artifact access

{
  "tools": ["@default", "@artifacts"]
}

Long-lived memory

{
  "tools": ["@default", "@memory"]
}

Opting in to @memory both registers the four memory tools and enables a --- CONTEXT FROM MEMORY --- block prepended to every run’s prompt.

Runtime Dependencies

Tool group	Required environment
Web search/extract	`TAVILY_API_KEY` on the runner
Conductor-backed introspection	`CONDUCTOR_BASE_URL` on the runner
File and pod post/inbox tools	Optional `VFS_POSTGRES_DSN`, `VFS_REDIS_URL`, `VFS_S3_BUCKET`, and `VFS_S3_ENDPOINT`; with no VFS env they use an in-memory dispatcher
Artifact tools	`S3_BUCKET` plus AWS/S3 environment
Memory Bank	`INTERNAL_S3_BUCKET` (preferred, plus its own AWS/S3 environment) for persistence, falling back to `S3_BUCKET` only when `INTERNAL_S3_BUCKET` is unset (single-bucket dev/CI); `ANTHROPIC_API_KEY` (and optional `ANTHROPIC_MEMORY_MODEL`) to enable LLM extraction in `memory_save`
Sandbox tools	A runner sandbox manager with a registered provider. Stock runner env wiring registers E2B from `E2B_API_KEY` / `E2B_KEY`, optional `E2B_BASE_URL`, `E2B_BRIDGE_URL`, and `E2B_DEFAULT_TEMPLATE`; it also registers Daytona from `DAYTONA_API_KEY`, with optional `DAYTONA_API_URL`, `DAYTONA_TOOLBOX_URL` (the toolbox proxy host root, without a trailing `/toolbox`), `DAYTONA_TARGET`, and `DAYTONA_DEFAULT_SNAPSHOT`. E2B registers first and remains the default provider when both are configured.
Orchestration tools	Profile selects `@orchestration`; set `AGENT_ORC_ORCHESTRATION_TOOLS=off` to disable registration
Delegation depth	`AGENT_ORC_MAX_DELEGATION_DEPTH` default `3`
`email_me`	`RESEND_API_KEY` and `RESEND_FROM` on the conductor, plus notifications enabled for the workspace via `/api/notify/settings`. Without these, `email_me` reports that no email was sent rather than failing.

Missing dependencies usually produce tool-level { "ok": false, "error": "..." } responses rather than profile-registration failures. For sandbox-enabled profiles, SANDBOX_IDLE_PAUSE controls when the runner idles an unused sandbox; the default is 60s, and 0 disables the idle scanner. On Daytona sandboxes where /pause is not supported, the runner falls back to Daytona stop/start while still exposing the lease as paused/resumable in Orca. That fallback preserves the sandbox filesystem but clears process memory. Daytona executes each sandbox command through the login shell listed by the snapshot image. The selected DAYTONA_DEFAULT_SNAPSHOT must include that shell binary; if the shell is missing, sandbox exec fails before the command starts and Orca returns a diagnostic naming the missing shell and pointing operators at a snapshot with a working login shell, such as daytona-small.

​What are Platform Tools?

​Tool Selectors

​Platform Skills

​Capabilities

​Notifications (@notify)

​Common Profiles

​Default plus web and files

​Coordinator

​Strict read-only filesystem profile

​Raw artifact access

​Long-lived memory

​Runtime Dependencies