Web tools

Generated from the built-in tools registry. Do not edit by hand.

web.* tools make a plain HTTP request to a public address and return what came back. Nothing is bound and nothing is set up: a task declares the tools it calls, like any other tool. They are the same for every enterprise and know no site.

They are not a browser. No JavaScript runs, and no cookies or credentials are sent. A product a member signs in to and clicks through is a Computer-Use binding, and a system with an MCP server is a vendor tool the enterprise binds.

A request reaches public addresses only. Private, local and internal addresses are refused, including a public name that resolves to one, and every redirect is checked again before it is followed.

Each result carries a sha256 the tool computed. web.read hashes the page’s visible text, so the hash changes when the words do and not when a deploy renames a script. Content too long for one result is refused or marked incomplete, never cut: a partial result is not the page.

web.read

Read one public web page as visible text, with a hash that changes only when the text does.

What the model reads:

Read one public web page as text. Pass url (http or https). Returns the page's visible text, with scripts, styles and markup removed and whitespace collapsed to single spaces, its title, and sha256: the hash of exactly that text. The same page gives the same sha256 until its words change, so use it to tell whether a page changed, and as a memory.train source revision. Only HTML is read here: use web.sitemap for a sitemap and web.request for JSON or plain text. A page whose text is too long for one result is refused as web_page_too_large, with its chars and sha256 and no text: that is not the page, so do not summarise it or train from it. A status outside 2xx is refused as web_status_not_ok. Follows up to 5 redirects. Private, local and internal addresses are refused. No JavaScript runs, and no cookies or credentials are sent.

No other fields are accepted.

• Effect: read.
• Retry: Safe: repeating the call changes nothing. A repeat sends the request again; a GET changes nothing.
• Called by: a run.
• Returns: { kind: "page", url, finalUrl, status, contentType, title, text, chars, sha256 }. finalUrl is where the redirects ended. title is null when the page has none, and is not part of text. chars is the length of text, and sha256 is 64 hex characters over exactly text.

Example:

{
  "url": "https://example.com/pricing"
}

web.sitemap

Read an XML sitemap and return its URLs as a list.

What the model reads:

Read an XML sitemap and return its entries. Pass url. A urlset returns kind sitemap with total and urls: each loc, and its lastmod when the sitemap gives one. A sitemap index returns kind sitemap_index with sitemaps: call web.sitemap again on each loc, because this tool does not follow them. complete is true when every entry is in the list. When the list is too long for one result, complete is false, total says how many entries there are, and no entries are returned: that is not an empty sitemap. Anything that is not a sitemap is refused as web_not_sitemap, and a status outside 2xx as web_status_not_ok. Private, local and internal addresses are refused.

No other fields are accepted.

• Effect: read.
• Retry: Safe: repeating the call changes nothing. A repeat sends the request again; a GET changes nothing.
• Called by: a run.
• Returns: { kind: "sitemap", url, finalUrl, complete, total, urls: [{ loc, lastmod? }] }, or { kind: "sitemap_index", url, finalUrl, complete, total, sitemaps: [{ loc, lastmod? }] }. Entries are in document order, exactly as the sitemap gives them. lastmod is left out when the sitemap gives none. When complete is false there is no list.

Example:

{
  "url": "https://example.com/sitemap.xml"
}

web.request

Send one GET to a public URL and return the text or JSON body, with its status and hash.

What the model reads:

Send one HTTP request to a public URL and return the response body as text. method is GET, the default and the only method today. Pass url, and headers only to set accept or accept-language. Never pass credentials: authorization, cookie and every other header are refused. Returns status, contentType, body, bytes and sha256 of the body bytes. A status outside 2xx is returned as a result, not an error: check status before you use body. Only text and JSON responses are returned: anything else is refused as web_not_text, and a body too long for one result as web_body_too_large, with its bytes and sha256 and no body. Follows up to 5 redirects. Private, local and internal addresses are refused. To read a page as text use web.read; for a sitemap use web.sitemap.

No other fields are accepted.

• Effect: read.
• Retry: Safe: repeating the call changes nothing. A repeat sends the request again; a GET changes nothing.
• Called by: a run.
• Returns: { url, finalUrl, status, contentType, body, bytes, sha256 }. body is the response as text. bytes is its size and sha256 is 64 hex characters over the body bytes, both after decompression.

Example:

{
  "url": "https://example.com/api/status.json"
}

Example, asking for JSON:

{
  "url": "https://example.com/feed",
  "method": "GET",
  "headers": {
    "accept": "application/json"
  }
}