> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure agent tools

> Review workspace tool configuration, attach permitted tool identifiers to an agent, and keep credentials and action boundaries separate.

Tools describe actions or integrations an agent may use. Review a tool's purpose, inputs, credentials, and access before attaching it. Saving a tool definition does not prove that its external service or agent execution is available.

Use [Integrations](/agents-platform/configure/integrations/overview) for native provider connections and [MCP servers](/agents-platform/configure/integrations/mcp-servers) for custom server configuration. Use [auth connections](/agents-platform/configure/authentication/auth-connections) and [workspace secrets](/agents-platform/configure/authentication/secrets) for supported credential storage.

<Frame caption="Recording pending: Review and attach a tool. Follow the written guide below.">
  <img src="https://mintcdn.com/threetonelabs-c2efc9c8/RV32i5440UZIaFHA/images/tutorials/recording-pending.webp?fit=max&auto=format&n=RV32i5440UZIaFHA&q=85&s=55f66d2eef49d8c92c9ac46f84bace35" alt="Recording pending for Review and attach a tool. No playable video is available yet." width="1600" height="900" className="w-full h-auto aspect-video" loading="lazy" noZoom data-path="images/tutorials/recording-pending.webp" />
</Frame>

## Before you begin

Use a signed-in dashboard session with permission to manage the workspace's tools and edit the target agent. Have a documented action, its input schema, and any approved external integration ready.

<Note>
  Tool management currently rejects API-key credentials in the documented implementation. Use the authenticated dashboard workflow for tool management. An endpoint in the API reference does not mean a personal API key can call it.
</Note>

## Review and attach

<Steps>
  <Step title="Open the workspace tool">
    Open [Tools](https://threetone.in/app/agents/tools). Select an existing webhook or client tool to inspect its configuration. This procedure assumes the workspace already has an approved tool to attach.

    The tool detail view shows its configuration. Keep the tool identifier and confirm that it belongs to the intended workspace.
  </Step>

  <Step title="Define the action">
    Give the tool a clear name and description. Identify which inputs are required, what a successful result contains, and how errors should be handled. Keep one tool focused on one understandable action.
  </Step>

  <Step title="Review access and credentials">
    Confirm that the workspace can access the resource and that its credentials are stored through the supported integration workflow. Do not put secrets into the prompt, a tool description, or an example input.

    Decide which actions require user confirmation and enforce access in the service that owns the data or mutation. Prompt instructions are not an authorization boundary.

    If you edit a webhook or client tool, select **Save**, then reopen the tool to check its persisted definition. Saving that shared resource is separate from publishing an agent's attachment list.
  </Step>

  <Step title="Attach the intended identifiers">
    Open the intended agent, select its **Tools** page, then choose **Add tool**. Search for the reviewed tool and select it. Confirm that it appears in the attached tools list. Published references use `conversation_config.agent.prompt.tool_ids`.

    MCP references use `mcp_server_ids` or `native_mcp_server_ids`. These fields identify resources; they do not establish that a server is connected, trusted, or ready to execute.
  </Step>

  <Step title="Review the agent version">
    Review the attachment list and prompt together. Save a complete server draft for durable review. For an eligible managed text-only configuration, select **Publish** and confirm the branch and diff in **Review Changes**, then read the saved version back. Voice and custom-model publication remain unavailable.
  </Step>
</Steps>

<Frame caption="Screenshot pending: An approved sample tool attached to the agent configuration.">
  <img src="https://mintcdn.com/threetonelabs-c2efc9c8/-FnvNeuT_PFanG1t/images/placeholders/screenshot-pending.svg?fit=max&auto=format&n=-FnvNeuT_PFanG1t&q=85&s=b29809bcbd6979cc43ace35853669b46" alt="Screenshot pending for An approved sample tool attached to the agent configuration. This illustration is not a product screenshot." width="1600" height="1000" className="w-full h-auto" loading="lazy" noZoom data-path="images/placeholders/screenshot-pending.svg" />
</Frame>

## Keep instructions and enforcement separate

The prompt should explain when the tool is relevant and how to respond when it fails. The external service should validate inputs, check access, and enforce confirmations where required. Do not let an agent's generated arguments decide which workspace or user is authorized.

For a tool that changes data, define how to handle a repeated request or an uncertain result before runtime testing. A retry must not silently create a second action.

## Review checklist

| Check | Evidence to keep |
| - | - |
| Purpose and inputs | A clear description and validated input schema. |
| Workspace access | The intended resource and the account permitted to use it. |
| Credentials | A supported secret-storage reference, with no secret in authored content. |
| Failure behavior | Expected timeout, unavailable-service, and invalid-input responses. |
| Agent attachment | The saved tool or MCP identifiers in the reviewed version. |

## Troubleshooting

If a tool is unavailable in the dashboard, confirm the active workspace and resource access. If a tool-management API request returns `403`, check whether it used an API key: that credential type is currently rejected for these operations. Do not bypass the restriction by putting dashboard credentials into application code.

Check [current availability](/agents-platform/overview#current-availability) before planning live tool execution. The [API reference](/api-reference/introduction) exposes the current schemas; [versions and drafts](/agents-platform/deploy/versioning) explains how attachments become part of a saved configuration.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I manage tools with a personal API key?" id="faq-tool-credential">The documented tool-management path rejects API-key credentials. Use the supported authenticated dashboard workflow.</Accordion>
  <Accordion title="Does saving a tool publish its agent attachment?" id="faq-tool-save-attachment">No. Saving the shared tool definition and publishing an agent attachment list are different actions. Read both resources back.</Accordion>
  <Accordion title="Can the prompt grant permission to use a tool?" id="faq-tool-authorization">No. The owning service must enforce access and validate inputs. Instructions are not an authorization boundary.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.