Skip to main content
A bot in Cortex Bot is built around having a computer, so its tools are not a subset of what a chat gets. It receives its own catalog of 31 tools, plus a tool for every action of every connected app you assigned to that bot. The sections below group those 31 by what they touch: its files and command line, its screen, the browser and the web, you, its memory and schedule, and other bots. That grouping is for reading; it is not the split that decides which tools stop and ask you first, which is covered under Approvals and tool policy. This page lists the whole catalog, says which tools stop and ask for your consent before they run, and covers the three conditional groups: connected apps, MCP server tools and page tools. It is reference material; if you only want to know why a step stopped, read Approvals and tool policy.

​
Files and shell

Four tools for the bot’s own workspace and command line.

​
Computer use

The tools a bot uses while it is working at its screen. These are what make a bot different from a chat: it operates the applications in front of it instead of asking you to paste things into a conversation. The bot must not guess pixels. Clicking, typing into a field, scrolling and dragging all take a description of the control, and a separate grounding step turns that description into coordinates. A control the bot cannot describe is a control it cannot click.

​
Browser and web

For work that lives entirely in a web page, the catalog itself steers the bot towards browser rather than clicking pixels on the desktop, because a page reference is more reliable than a point on a screen.

​
Talking to you

Four tools, and they are the only way anything reaches your thread. Everything else the model writes is work and is not rendered. See Talking to a bot.

​
Memory, skills and scheduling

A bot can therefore put work on its own schedule and remember things between turns without asking. What it does with those tools is visible on the bot’s Bot memory and Routines panels, where you can read and remove anything it wrote.

​
Other bots and stored results

When a tool result is too big to carry, it is stored and replaced with a short stub and an art_… id. The bot then reads or searches it with the two artifact tools, which is why a bot can work through a huge log without the turn falling over.

​
What a subagent gets

A nested task runs the bot loop again as a child, and it does not get the full catalog. Children lose send_to_user, ask_user, secret_request, notify and task, which leaves 26 tools. They also get no connected apps and no MCP tools at all. The consequence is worth remembering: a child cannot talk to you, cannot ask you a question and cannot start children of its own. Only the parent bot speaks in the thread, and it reports what the child found. See Tasks and subagents.

​
Conditional tools

Three groups only exist when you have turned something on.

Connected apps

One tool per enabled action of each app you assigned to this bot.

MCP servers

One tool per allowed tool of each MCP server the account opted in, up to four servers with 24 tools each.

Page tools

Reading a page you are on and filling its fields, with the Cortex browser extension.
Connected apps reach a bot only when you assigned them to it. An app is off for a bot until you turn it on for that bot alone, and the tools appear in its catalog from the next turn. Mutating actions ask for approval, read-only calls pass, and an always-allow rule for a connected app has to name that exact tool: a grant for a whole app or a whole category is refused by design. Page tools come from the browser extension and appear on the Computer rail as Page context. Consent is per group of fields rather than per site, and every fill is confirmed before it is written.

​
Which tools stop and ask

Read the Always asks column as one sentence: anything that changes a file, runs a command, or moves the mouse or keyboard asks first. Looking, waiting, remembering and talking do not. Eleven tools always ask, twenty never do, and a tool on neither list runs. That is the shipped default, and it sits under the rules you write. Your own always-allow rules and the ceilings Cortex sets for a deployment are both consulted before every call, so the table above is where a tool starts rather than the last word. See Approvals and tool policy.
Bot’s names are its own. shell here is what other Cortex surfaces call bash, and there is no raw pixel-coordinate tool on a bot at all. Do not expect a Chat or Code tool list to match this one.