Zero HumanVersion 0.2.313Pricing

Built-in tools

Every operation the OS answers for a task itself, with its inputs, effects, gates, retry safety and errors.

Generated from the built-in tools registry. Do not edit by hand.

A task calls two kinds of tool. Vendor tools come from the MCP servers an enterprise binds on the Tools page: GitHub, Slack, Sentry and the rest. Built-in tools are answered by the OS itself: os.*, workspace.*, memory.* and web.*, the CEO chat’s own tools, and the verbs of a Computer-Use binding.

This reference lists every built-in tool. It is generated from the same definitions the model is served, so what you read here is what a run sees.

Declaring a tool

A task can call only the tools it declares, by exact name, in its tools:

{
  "tools": [
    "workspace.read_file",
    "workspace.edit",
    "workspace.git_commit",
    "os.set_execution_name"
  ]
}
  • A name in a built-in namespace (os., workspace., memory., web.) that is not listed here is refused when the task is saved (tool_unknown). So is a tool only the CEO chat offers (tool_not_run_callable): a run never answers one.
  • A task can pin a field to particular values: <tool>#<field>=<value>,<value>. The model is offered only those values, and a call carrying any other is refused.
  • The model calls a tool with its dots replaced: workspace.read_file is workspace__read_file.
  • Agents can read this reference as data: GET /v1/tools/built-in and GET /v1/tools/built-in/:name, with a session or an API token scoped tools:read.

The tools

Family Tools Page
Workspace workspace.read_file, workspace.list_dir, workspace.write_file, workspace.delete_file, workspace.edit, workspace.search, workspace.run_command, workspace.git_commit, workspace.git_push Workspace tools
Memory memory.ask, memory.train Memory tools
Execution labels os.set_execution_name, os.add_execution_link OS tools
Gate summary os.set_gate_summary OS tools
CEO questions os.ask_ceo OS tools
Self-improvement os.list_recommendations, os.get_recommendation, os.decide_recommendation OS tools
Mail os.mail_list, os.mail_read, os.mail_reply, os.mail_send OS tools
Mail triage os.mail_set_label, os.mail_set_handled, os.mail_set_many OS tools
Mail follow-ups os.mail_quiet_threads, os.mail_mark_chased, os.mail_snooze OS tools
Escalations os.escalate_mail, os.mail_reply_draft OS tools
KPIs os.list_kpis, os.record_kpi_reading, os.get_enterprise_kpis, os.set_enterprise_kpis, os.get_team_kpis, os.set_team_kpis, kpi.record_reading, kpi.list_readings, role.list_kpis, role.define_kpi, role.edit_kpi OS tools
Context os.set_context, os.get_context, os.delete_context OS tools
Company state os.inspect_enterprise, os.directory, os.list_blockers, os.list_open_gates OS tools
Unblocking runs os.retry_run, os.route_run, os.clear_run, os.escalate_run OS tools
Planning os.read_enterprise, os.search_catalog, os.list_tool_bindings, os.list_built_in_tools, os.read_task, os.assess_impact, os.write_plan, os.read_plan OS tools
Briefs os.file_daily_brief OS tools
Chat threads os.chat_list, os.chat_read, os.chat_write, os.chat_open OS tools
Chat os.list_tasks, os.start_task, os.get_run, os.hand_off_task_brief, os.list_runs, os.kpi_board, os.list_enterprise_kpis Chat tools
Computer use <prefix>.navigate, <prefix>.click, <prefix>.type, <prefix>.screenshot, <prefix>.extract, <prefix>.download, <prefix>.upload Computer-Use tools
Web web.read, web.sitemap, web.request Web tools

Read and write

Read tools change nothing. Write tools change something: a file, a label, a decision, a note in memory. A run credential can write only if its task declares an os.* tool that writes.

Write tools: workspace.write_file, workspace.delete_file, workspace.edit, workspace.run_command, workspace.git_commit, workspace.git_push, memory.train, os.set_execution_name, os.add_execution_link, os.set_gate_summary, os.ask_ceo, os.decide_recommendation, os.mail_reply, os.mail_send, os.mail_set_label, os.mail_set_handled, os.mail_set_many, os.mail_mark_chased, os.mail_snooze, os.escalate_mail, os.mail_reply_draft, os.record_kpi_reading, os.set_enterprise_kpis, os.set_team_kpis, os.set_context, os.delete_context, kpi.record_reading, role.define_kpi, role.edit_kpi, os.retry_run, os.route_run, os.clear_run, os.escalate_run, os.write_plan, os.file_daily_brief, os.chat_write, os.chat_open, os.start_task, os.hand_off_task_brief, <prefix>.click, <prefix>.type, <prefix>.upload.

A few reads have a side effect, listed on the tool:

  • os.list_recommendations: View issues refreshes issueOutcome on recommendations whose issue was still open, and returns what ended since the last call as settled.
  • os.mail_read: Marks the message read for the member, the same as opening it in the portal.
  • os.chat_read: Over the API and the MCP server, marks the thread read, the same as opening it in the portal. In a run, nothing.

Gates and grants

A task can put a gate on a tool it declares, in its gates, and the call then waits for the CEO. The exception is a workspace.* or memory.* tool: the OS answers those calls before it reads the task’s gates, so a gate on one is saved but never waits. Some built-in tools carry gates or grants of their own:

  • os.ask_ceo is always gated, whatever the task declares, and the run ends on the CEO’s decision.
  • os.mail_reply is always gated, whatever the task declares, and the run ends on the CEO’s decision.
  • os.mail_send is always gated, whatever the task declares, and the run ends on the CEO’s decision.
  • os.escalate_mail is always gated, whatever the task declares, and the run ends on the CEO’s decision.
  • os.set_gate_summary must be called before github.merge_pull_request, os.mail_reply, which is handed back until it is. A task that declares one must declare the other.
  • memory.train: task is always allowed. member and role only on an original task, never a clone. team and enterprise only when this version grants that layer and the source event id starts with the granted prefix; a clone cannot use the grant. Reserved event ids (team: and gate:) stay refused.

What else a tool needs (a repo input, an assigned member, a binding) is on its own entry.

Retry safety

A call can be sent twice: a response lost on the way back, a retried run. Each tool says what a repeat does:

Retry Meaning Tools
safe Safe: repeating the call changes nothing. workspace.read_file, workspace.list_dir, workspace.search, memory.ask, os.list_recommendations, os.get_recommendation, os.mail_list, os.mail_read, os.mail_quiet_threads, os.mail_mark_chased, os.mail_snooze, os.list_kpis, os.get_enterprise_kpis, os.get_team_kpis, os.get_context, kpi.list_readings, role.list_kpis, os.inspect_enterprise, os.directory, os.list_blockers, os.list_open_gates, os.read_enterprise, os.search_catalog, os.list_tool_bindings, os.list_built_in_tools, os.read_task, os.assess_impact, os.read_plan, os.chat_list, os.chat_read, os.list_tasks, os.get_run, os.list_runs, os.kpi_board, os.list_enterprise_kpis, <prefix>.navigate, <prefix>.screenshot, <prefix>.extract, <prefix>.download, web.read, web.sitemap, web.request
idempotent Idempotent: a repeat of the same call acts once, or leaves the same state. workspace.write_file, workspace.git_push, memory.train, os.set_execution_name, os.add_execution_link, os.set_gate_summary, os.ask_ceo, os.decide_recommendation, os.mail_set_label, os.mail_set_handled, os.mail_set_many, os.record_kpi_reading, os.set_enterprise_kpis, os.set_team_kpis, os.set_context, os.delete_context, role.edit_kpi, os.retry_run, os.route_run, os.clear_run, os.escalate_run, os.write_plan, os.start_task, os.hand_off_task_brief
unsafe Not retry-safe: a repeat acts again. workspace.delete_file, workspace.edit, workspace.run_command, workspace.git_commit, os.mail_reply, os.mail_send, os.escalate_mail, os.mail_reply_draft, kpi.record_reading, role.define_kpi, os.file_daily_brief, os.chat_write, os.chat_open, <prefix>.click, <prefix>.type, <prefix>.upload

Errors

A failed call comes back one of three ways:

Handling What happens
Handed back (hand_back) Refused and handed back: nothing ran, and the model gets another turn
Tool error (tool_error) A tool error: the model reads it as the result and carries on
Run fails (fail) The run fails

Any tool call can come back with these, before the tool itself is reached:

Error When What happens
tool_not_on_task The tool exists, but the task does not declare it. The run fails
unknown_tool_name No tool anywhere has that name: a typo. The model is told the task's closest tools. Refused and handed back: nothing ran, and the model gets another turn
unknown_tool_repeated Three unknown names were already handed back in this run, and it called another. The run fails
bare_tool_name The call named a whole vendor catalog (github) instead of one of its tools. Refused and handed back: nothing ran, and the model gets another turn
tool_value_not_declared The task pinned a field (<tool>#<field>=<value>) and the call carried another value. Refused and handed back: nothing ran, and the model gets another turn
tool_value_refused The same, where the task marked the field fatal (<tool>#!<field>=<value>). The run fails

Each tool lists its own errors on its entry.