Tools

Tools give the motebit agency — the ability to read files, search the web, execute commands, and interact with external services. Every tool call passes through the policy gate before execution.

Built-in tools

Motebit registers ten tools by default (apps/cli/src/runtime-factory.ts). Risk is not declared on the tool — the policy gate infers it from the tool's name and description, so these all classify as read-only except rewrite_memory, a governed memory write:

Tool	Description
`read_file`	Read a file from allowed paths
`current_time`	The current date and time (proprioception, never guessed)
`web_search`	Search the web (Brave → DuckDuckGo fallback)
`read_url`	Fetch and read a URL
`recall_memories`	Query the agent's memory graph
`search_conversations`	Keyword search across every past message
`rewrite_memory`	Supersede a stale memory with corrected content
`recall_self`	Look up the agent's own interior knowledge (self-description)
`list_events`	Browse the agent's event log
`self_reflect`	Structured reflection over recent interior state

delegate_to_agent is registered only when interactive delegation is enabled (enableInteractiveDelegation in @motebit/runtime), not by default.

Additional tools (write_file, undo_write, shell_exec) exist in @motebit/tools but are not registered by default. They require operator mode and explicit per-call approval — see Daemon Mode & Approvals for the three-band governance thresholds that gate them.

MCP integration

Model Context Protocol (MCP) lets your motebit connect to external tool servers. Configure MCP servers in ~/.motebit/config.json:

{
  "mcp_servers": [
    {
      "name": "filesystem",
      "transport": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/home/user"],
      "trusted": true
    },
    {
      "name": "github",
      "transport": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "ghp_..." },
      "trusted": false
    }
  ]
}

Field	Type	Description
`name`	string	Server identifier (used in tool namespacing)
`transport`	`"stdio"` \| `"http"`	Transport type
`command`	string	Command to launch the server
`args`	string[]	Command arguments
`env`	object	Environment variables for the server process
`trusted`	boolean	If false, all tools require per-call approval

MCP tools are namespaced to avoid collisions — format: {serverName}__{toolName} (e.g., filesystem__read_file, github__create_issue).

Trust model

Trusted vs untrusted servers

Trusted ("trusted": true) — Tools execute without per-call approval (still subject to risk level and operator mode)
Untrusted ("trusted": false) — Every tool call requires explicit user approval

Trust is managed per-server. In the CLI:

/mcp list          # Show connected servers and trust status
/mcp trust github  # Trust the github server
/mcp untrust github  # Remove trust

Risk levels still apply

Even trusted MCP tools go through risk classification. A trusted server's write_file tool still requires operator mode because it's classified as a write operation. Trust skips the per-call approval prompt, not the policy gate.

Content sanitization

All tool results — built-in and MCP — are checked for prompt injection patterns. External data is wrapped in boundary markers that delineate the trust boundary between internal and external content. If suspicious content is detected, the system flags it and notifies you.