Skip to main content
Open an agent’s Tools page to see what it can use. Connected tools contains its connected service accounts, including accounts that are off or need attention. Built-in tools contains Workspace, Web search, Read web pages, and Browser. Status badges distinguish On, Off, Needs setup, and connection problems. Unconfigured services appear in Add tool, separately from connected accounts. Choose Manage to open a tool’s settings, or Add tool to search the library. The library identifies services that are already connected. Use Add another account when the same agent needs a separate account at an existing MCP server. The previous setup page has been removed; old ?tools=legacy bookmarks open the current Tools page. All acting accounts belong to the selected agent. See the identity guardrail. Connecting another agent requires that agent’s own external account; a new token for the same account does not create a new identity. Infrastructure defaults and server definitions may be shared; acting identities cannot be inherited.

​
GitHub and GitLab

Choose the service in Add tool, then supply this agent’s own credential. Configuration fields and supported operations come from the package descriptor. Choose Save changes to make configured tools available. Existing connections can be managed without re-entering their credentials. A blank credential field keeps the saved value, and secret values are never read back. All supported operations are on by default. Open Manage tools to turn off specific operations; saved exclusions survive credential rotation. API and coding operations are individually selectable and labeled. Under Coding account access, the agent’s own GitHub or GitLab PAT is usable in its own sandbox by default. Turn off delivery there if needed. Existing explicit opt-outs stay off. Permission changes and token rotation invalidate active sandboxes, including continuation-held ones. A default repository does not restrict a shell to that repository. See sandbox credential delivery for revocation and long-lived-token limitations, and GitLab coding for supported credentials and workflows. Native saves validate configuration and credential presence, not live provider access. The page reports when credentials are stored but access is untested. Operations are saved individually. If a later operation fails, earlier saves may have succeeded; return to Tools and choose Refresh before retrying.

​
MCP servers

Choose a service in Add tool. Known services supply their server URL and recommended authentication, so setup normally needs only sign-in or an API key. When both are supported, the form offers an alternative authentication action. Connection details contains the editable account name and server URL; OAuth client registration is an advanced setting. Use Add custom MCP server for a hosted server that is absent from the library. Supply its URL, a connection name, and its supported authentication. OAuth returns to this agent’s Tools page. Start with the provider’s own hosted MCP server when one is available. Copy its HTTPS server URL from the provider’s documentation, rather than a dashboard URL or a local server command. Formation connects to remote servers; this form does not launch local MCP processes. A missing library entry does not mean a service is unsupported. If the provider offers no hosted MCP server, use Add REST API with its API base URL and this agent’s token. See REST API connections. During new-agent setup, Tools is optional. Continue agent setup returns to the saved wizard after connecting a service, including after an OAuth sign-in. Start with one tool for one concrete task, then add more as needed. After the agent is connected to a conversation channel, ask it to perform that task and check its reply; a saved connection alone does not verify provider permissions. Connecting discovers and activates every supported tool, including writes. There is no second activation or Read/Write classification step. Discovery checks communication and definitions; the server’s account permissions determine which operations can succeed. If discovery fails, credentials stay saved, connection health explains the failure, and Formation retries automatically. Use Manage tools to turn individual tools off, then Save tool preferences. Saving an empty selection is allowed. Exclusions survive catalog refreshes, changed definitions, removed/reappearing tools, credential rotation, and OAuth reconnection. New tools turn on automatically. Turn off stops the whole connection immediately without contacting the server. Reconnecting keeps an explicit turn-off until you choose Turn on. Version checks reject stale edits.

​
Tool discovery and offline installs

Formation bundles a library of server definitions. Instance owners can enable online discovery in Settings → Tool discovery and configure their registry URL. An instance may also supply a local catalog for private or offline environments. The library shows which source supplied its definitions and retains a usable fallback if discovery fails. Custom MCP setup remains available. Definitions contain names, descriptions, URLs, and supported authentication methods. They contain no connected accounts or credentials, and updating a library does not change an existing connection or its permissions. Adding metadata for a supported transport needs no service-specific setup form.

​
Built-in tools

Instance owners configure search, page reading, and browser providers in Settings → Web access. Each capability needs its own selected provider and the credential that provider requires. These connections are separate from model credentials. Follow the selected provider’s setup instructions and links, then Save and enable. Provider usage runs against your provider account. Saving does not test access; Test saved browser connection starts a provider session and may consume provider allowance. Finish by asking an agent to try a small web task. Agent operators can customize their agent’s provider connection or ask an instance owner to set up the shared default. Search, page reading, and browser interaction use instance infrastructure defaults automatically. Choose Manage → Customize for an agent override, Turn off for an explicit opt-out, or Use instance settings to restore inheritance. Settings show effective provider, credential source, availability, and request limits. Saving configuration does not run a paid query or browser session to test it. Workspace uses the effective instance or agent runtime. Each agent has its own sandbox even when agents share an instance’s execution-provider billing key. Browser → Website logins · Advanced imports an existing Playwright storage-state JSON profile and manages stored sessions. Interactive website sign-in is not available in this form. Cookies and local storage remain private to this agent; IndexedDB and session storage are not carried between runs. A shared browser execution key never shares website logins.

​
Linear

Linear is available through MCP. The native Linear package has been retired. Choose Add tool → Linear and connect this agent’s own account. Credentials are not transferred automatically. Existing MCP accounts continue to work. Agents with saved native setup see a migration notice. Remove old Linear setup deletes that agent’s obsolete native grants, settings, and saved credential after explicit confirmation. MCP connections and historical runs are preserved. Linear migration explains behavioral changes, export metadata, and recovery.

​
Compatibility

The UI uses the connection management API. Package-less registry tools remain visible and use their existing agent-scoped enablement API. They are not fabricated server connection records. Sandbox delivery records automatic defaults separately from operator choices and preserves existing permission rows. New agents automatically use configured instance model credentials and assignments. Choose Customize models in agent setup for a separate provider or billing key. Resuming an existing agent keeps its saved provider choice.