MotebitTools
Built-in tools, MCP integration, and the trust model.
Tools give the motebit agency — the ability to read files, search the web, execute commands, and interact with external services. Every tool call passes through the policy gate before execution.
Built-in tools
Motebit ships with seven built-in tools:
| Tool | Risk | Description |
|---|---|---|
readFile | Read | Read a file from allowed paths |
writeFile | Write | Write a file (requires approval) |
shellExec | Execute | Execute a shell command (requires approval) |
webSearch | Read | Search the web |
readUrl | Annotate | Fetch and read a URL |
recallMemories | Read | Query the agent's memory graph |
listEvents | Read | Browse the agent's event log |
MCP integration
Model Context Protocol (MCP) lets your motebit connect to external tool servers. Configure MCP servers in ~/.motebit/config.json:
{
"mcp_servers": [
{
"name": "filesystem",
"transport": "stdio",
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/home/user"],
"trusted": true
},
{
"name": "github",
"transport": "stdio",
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": { "GITHUB_TOKEN": "ghp_..." },
"trusted": false
}
]
}| Field | Type | Description |
|---|---|---|
name | string | Server identifier (used in tool namespacing) |
transport | "stdio" | Transport type (stdio only for now) |
command | string | Command to launch the server |
args | string[] | Command arguments |
env | object | Environment variables for the server process |
trusted | boolean | If false, all tools require per-call approval |
MCP tools are namespaced to avoid collisions — format: {serverName}__{toolName} (e.g., filesystem__read_file, github__create_issue).
Trust model
Trusted vs untrusted servers
- Trusted (
"trusted": true) — Tools execute without per-call approval (still subject to risk level and operator mode) - Untrusted (
"trusted": false) — Every tool call requires explicit user approval
Trust is managed per-server. In the CLI:
/mcp list # Show connected servers and trust status
/mcp trust github # Trust the github server
/mcp untrust github # Remove trustRisk levels still apply
Even trusted MCP tools go through risk classification. A trusted server's write_file tool still requires operator mode because it's classified as a write operation. Trust skips the per-call approval prompt, not the policy gate.
Content sanitization
All tool results — built-in and MCP — are checked for prompt injection patterns. External data is wrapped in boundary markers that delineate the trust boundary between internal and external content. If suspicious content is detected, the system flags it and notifies you.