> ## Documentation Index > Fetch the complete documentation index at: https://docs.formation.texturehq.com/llms.txt > Use this file to discover all available pages before exploring further. # Add and manage tools > Connect an agent's accounts, manage its tools, and customize built-in access. Open an agent’s **Tools** page to see what it can use. **Connected tools** contains its connected service accounts, including accounts that are off or need attention. **Built-in tools** contains Workspace, Web search, Read web pages, and Browser. Status badges distinguish **On**, **Off**, **Needs setup**, and connection problems. Unconfigured services appear in **Add tool**, separately from connected accounts. Choose **Manage** to open a tool's settings, or **Add tool** to search the library. The library identifies services that are already connected. Use **Add another account** when the same agent needs a separate account at an existing MCP server. The previous setup page has been removed; old `?tools=legacy` bookmarks open the current Tools page. All acting accounts belong to the selected agent. See the [identity guardrail](https://github.com/TextureHQ/formation/blob/main/docs/roadmap.md#agent-owned-acting-identities). Connecting another agent requires that agent’s own external account; a new token for the same account does not create a new identity. Infrastructure defaults and server definitions may be shared; acting identities cannot be inherited. ## GitHub and GitLab Choose the service in **Add tool**, then supply this agent’s own credential. Configuration fields and supported operations come from the package descriptor. Choose **Save changes** to make configured tools available. Existing connections can be managed without re-entering their credentials. A blank credential field keeps the saved value, and secret values are never read back. All supported operations are on by default. Open **Manage tools** to turn off specific operations; saved exclusions survive credential rotation. API and coding operations are individually selectable and labeled. Under **Coding account access**, the agent’s own GitHub or GitLab PAT is usable in its own sandbox by default. Turn off delivery there if needed. Existing explicit opt-outs stay off. Permission changes and token rotation invalidate active sandboxes, including continuation-held ones. A default repository does not restrict a shell to that repository. See [sandbox credential delivery](/runtime/workspace-credentials.md) for revocation and long-lived-token limitations, and [GitLab coding](https://github.com/TextureHQ/formation/blob/main/docs/runtime/gitlab-coding.md) for supported credentials and workflows. Native saves validate configuration and credential presence, not live provider access. The page reports when credentials are stored but access is untested. Operations are saved individually. If a later operation fails, earlier saves may have succeeded; return to Tools and choose **Refresh** before retrying. ## MCP servers Choose a service in **Add tool**. Known services supply their server URL and recommended authentication, so setup normally needs only sign-in or an API key. When both are supported, the form offers an alternative authentication action. **Connection details** contains the editable account name and server URL; OAuth client registration is an advanced setting. Use **Add custom MCP server** for a hosted server that is absent from the library. Supply its URL, a connection name, and its supported authentication. OAuth returns to this agent's Tools page. Start with the provider's own hosted MCP server when one is available. Copy its HTTPS server URL from the provider's documentation, rather than a dashboard URL or a local server command. Formation connects to remote servers; this form does not launch local MCP processes. A missing library entry does not mean a service is unsupported. If the provider offers no hosted MCP server, use **Add REST API** with its API base URL and this agent's token. See [REST API connections](/runtime/rest-api-connections.md). During new-agent setup, Tools is optional. **Continue agent setup** returns to the saved wizard after connecting a service, including after an OAuth sign-in. Start with one tool for one concrete task, then add more as needed. After the agent is connected to a conversation channel, ask it to perform that task and check its reply; a saved connection alone does not verify provider permissions. Connecting discovers and activates every supported tool, including writes. There is no second activation or Read/Write classification step. Discovery checks communication and definitions; the server's account permissions determine which operations can succeed. If discovery fails, credentials stay saved, connection health explains the failure, and Formation retries automatically. Use **Manage tools** to turn individual tools off, then **Save tool preferences**. Saving an empty selection is allowed. Exclusions survive catalog refreshes, changed definitions, removed/reappearing tools, credential rotation, and OAuth reconnection. New tools turn on automatically. **Turn off** stops the whole connection immediately without contacting the server. Reconnecting keeps an explicit turn-off until you choose **Turn on**. Version checks reject stale edits. ### Tool discovery and offline installs Formation bundles a library of server definitions. Instance owners can enable online discovery in **Settings → Tool discovery** and configure their registry URL. An instance may also supply a local catalog for private or offline environments. The library shows which source supplied its definitions and retains a usable fallback if discovery fails. Custom MCP setup remains available. Definitions contain names, descriptions, URLs, and supported authentication methods. They contain no connected accounts or credentials, and updating a library does not change an existing connection or its permissions. Adding metadata for a supported transport needs no service-specific setup form. ## Built-in tools Instance owners configure search, page reading, and browser providers in **Settings → Web access**. Each capability needs its own selected provider and the credential that provider requires. These connections are separate from model credentials. Follow the selected provider's setup instructions and links, then **Save and enable**. Provider usage runs against your provider account. Saving does not test access; **Test saved browser connection** starts a provider session and may consume provider allowance. Finish by asking an agent to try a small web task. Agent operators can customize their agent's provider connection or ask an instance owner to set up the shared default. Search, page reading, and browser interaction use instance infrastructure defaults automatically. Choose **Manage → Customize** for an agent override, **Turn off** for an explicit opt-out, or **Use instance settings** to restore inheritance. Settings show effective provider, credential source, availability, and request limits. Saving configuration does not run a paid query or browser session to test it. Workspace uses the effective instance or agent runtime. Each agent has its own sandbox even when agents share an instance's execution-provider billing key. **Browser → Website logins · Advanced** imports an existing Playwright storage-state JSON profile and manages stored sessions. Interactive website sign-in is not available in this form. Cookies and local storage remain private to this agent; IndexedDB and session storage are not carried between runs. A shared browser execution key never shares website logins. ## Linear Linear is available through MCP. The native Linear package has been retired. Choose **Add tool → Linear** and connect this agent's own account. Credentials are not transferred automatically. Existing MCP accounts continue to work. Agents with saved native setup see a migration notice. **Remove old Linear setup** deletes that agent's obsolete native grants, settings, and saved credential after explicit confirmation. MCP connections and historical runs are preserved. [Linear migration](https://github.com/TextureHQ/formation/blob/main/docs/runtime/linear-migration.md) explains behavioral changes, export metadata, and recovery. ## Compatibility The UI uses the [connection management API](/runtime/connection-management.md). Package-less registry tools remain visible and use their existing agent-scoped enablement API. They are not fabricated server connection records. Sandbox delivery records automatic defaults separately from operator choices and preserves existing permission rows. New agents automatically use configured instance model credentials and assignments. Choose **Customize models** in agent setup for a separate provider or billing key. Resuming an existing agent keeps its saved provider choice. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.