COMMON TOOL CATEGORIES

WHY CATEGORIES HELP When you walk into a hardware store, the tools are grouped: hand tools, power tools, plumbing, paint. The grouping helps you find what you need and helps the store apply sensible rules, such as keeping sharp blades behind a counter. Agent tools can be grouped the same way, and each family has familiar uses and familiar dangers. Knowing the families lets you choose the minimum set of tools for a job and put the right guard on each. This chapter surveys six categories. CATEGORY ONE: WEB SEARCH AND WEB BROWSING Web search tools take a query and return a ranked list of results, typically with page titles, short snippets, and addresses called Uniform Resource Locators (URLs), the text you type into a browser's address bar. Fetch or browse tools take a Uniform Resource Locator (URL) and return the page's content, sometimes cleaned into plain text, and more advanced browsing tools can click, scroll, and fill out forms. Uses include answering questions about recent events, researching topics, and checking facts. Typical concerns. The content from web pages is untrusted. A page can contain hidden text that tries to give the agent instructions, an attack called prompt injection, which Chapter 38 covers. Web pages can also be wrong, outdated, or deliberately misleading, so agents should be taught to cite sources and cross-check. Browsing tools that submit forms or click buttons are action tools and need approval rules. Network allowlists limit which sites may be visited. CATEGORY TWO: CODE EXECUTION AND SHELL TOOLS These tools let the agent run code or commands. A shell is a text interface to a computer where you type commands, such as the command line on your laptop. A code execution tool might run a Python snippet to do math or analyze data. A shell tool might run a test suite, install a program, or search through files. Uses include coding agents, data analysis, and any task where computing an exact answer is better than guessing. Typical concerns. This is the most powerful and therefore the most dangerous category. Code can delete files, leak secrets, or use up machine resources. The strongest mitigation is the sandbox from Chapter 12, with limited files, no network by default, resource caps, and time limits. Command allowlists, approvals for risky commands such as deleting folders, and careful logging are also standard. CATEGORY THREE: FILE SYSTEM AND DOCUMENT TOOLS File system tools read, write, list, move, and delete files and folders. Document tools open and understand specific formats, such as Portable Document Format (PDF) files, spreadsheets, and word-processor documents, extracting their text or creating new ones. Uses include reading resumes, writing reports, editing code, and organizing data. Typical concerns. Path tricks that escape the allowed folder, overwriting or deleting important files, and reading files that contain secrets. Document files themselves can carry hidden instructions or malicious content, so document parsers deserve sandboxing, which is exactly why the lab isolates the resume parser. Mitigations include confining the agent to a working folder, read-only mounts, backups or version control so changes can be rolled back, and approval for deletions. CATEGORY FOUR: DATABASE AND API TOOLS Database tools let an agent query and sometimes change stored data. A database is an organized collection of information that programs can search quickly, and many are queried with a language called Structured Query Language (SQL). API tools call the services of other software, such as payment systems, weather services, or a company's internal systems. Uses include looking up customer records, checking inventory, and pulling data for reports. Typical concerns. An agent with a database connection might run a destructive query or read far more than it should. Mitigations include giving the agent a read-only database account, restricting it to specific tables, limiting the number of rows returned, using parameterized queries that keep user text from being treated as commands, setting query time limits, and logging every query. Keep API keys out of the model's sight and apply rate limits to avoid bills and bans. CATEGORY FIVE: COMMUNICATION TOOLS These tools send messages out: email, chat messages, text messages, calendar invitations, and posts. Uses include notifying people, scheduling meetings, and handling customer service. Typical concerns. Messages are public, fast, and cannot be called back. A mistaken email to the wrong person, or a flood of messages, harms real people and reputation. A reliable safety rail is to separate drafting from sending. A draft tool creates something for human review, while a send tool, which requires approval, actually dispatches it. Other safeguards include allowed-recipient lists, rate limits, and logs that record what was sent to whom. Be careful that outgoing messages never include private information the recipient should not see. CATEGORY SIX: SPECIALIZED DOMAIN TOOLS Domain tools are built for a particular profession or industry. Examples include a medical-coding lookup, a legal-citation checker, a financial-risk calculator, a geographic mapping tool, or a laboratory-instrument controller. Uses are the specialized tasks of that field, where general tools would be clumsy or inaccurate. Typical concerns. Domain tools often carry domain-level risk, such as health, legal, or financial consequences, so they need expert review, accuracy testing, and sometimes compliance controls. They are also unlikely to be reused elsewhere, so you should weigh whether building one is worth it or whether a general tool plus good instructions would do.