> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex.foundation/llms.txt
> Use this file to discover all available pages before exploring further.
# Bot tools
> The catalog a bot receives: files and shell, the desktop verbs, browser and web, memory and skills, messaging, tasks, other bots, and your connected apps.
A bot in **Cortex Bot** is built around having a computer, so its tools are not a subset of what a chat gets. It receives its own catalog of 31 tools, plus a tool for every action of every connected app you assigned to that bot. The sections below group those 31 by what they touch: its files and command line, its screen, the browser and the web, you, its memory and schedule, and other bots. That grouping is for reading; it is not the split that decides which tools stop and ask you first, which is covered under [Approvals and tool policy](/bot/approvals).
This page lists the whole catalog, says which tools stop and ask for your consent before they run, and covers the three conditional groups: connected apps, MCP server tools and page tools. It is reference material; if you only want to know why a step stopped, read [Approvals and tool policy](/bot/approvals).
## Files and shell
Four tools for the bot's own workspace and command line.
| Tool | Always asks | What it does |
| ------- | ----------- | ------------------------------------------------------------------------------------------------- |
| `read` | no | Read a file on the bot's own computer |
| `write` | yes | Write a file on the bot's own computer |
| `edit` | yes | Replace one occurrence of some text with other text in a file |
| `shell` | yes | Run a shell command on the bot's own computer, as a real command rather than typing into a window |
## Computer use
The tools a bot uses while it is working at its screen. These are what make a bot different from a chat: it operates the applications in front of it instead of asking you to paste things into a conversation.
| Tool | Always asks | What it does |
| ---------------- | ----------- | ------------------------------------------------------------------------------------------------------------------ |
| `screenshot` | no | Capture the whole screen for the bot to look at. This is for the bot, not for you; the live rail is what you watch |
| `grounded_click` | yes | Click a control the bot describes in a full sentence. A separate call resolves that sentence to a point on screen |
| `type` | yes | Type text. It can click a named field first, clear what is there, and press Return |
| `hotkey` | yes | Press a key combination instead of hunting through menus |
| `scroll` | no | Scroll at a named control |
| `drag` | yes | Drag from one named control to another, each resolved separately |
| `wait` | no | Pause so the interface can settle. Capped at 10,000 ms |
| `open_app` | yes | Open an application or a file on the desktop |
| `switch_app` | yes | Focus a window that is already open, by name |
| `save_note` | no | Remember a short fact for the rest of this turn, such as a value it copied |
| `code_agent` | yes | A bounded shell and Python loop on the bot's computer for bulk file or formula work |
The bot must not guess pixels. Clicking, typing into a field, scrolling and dragging all take a description of the control, and a separate grounding step turns that description into coordinates. A control the bot cannot describe is a control it cannot click.
## Browser and web
| Tool | Always asks | What it does |
| ------------ | ----------- | ------------------------------------------------------------------------- |
| `browser` | yes | A page-level browser action: navigate, snapshot, click by reference, fill |
| `web_search` | no | Search the public web |
| `web_fetch` | no | Fetch a public URL and return readable text |
For work that lives entirely in a web page, the catalog itself steers the bot towards `browser` rather than clicking pixels on the desktop, because a page reference is more reliable than a point on a screen.
## Talking to you
Four tools, and they are the only way anything reaches your thread.
| Tool | Always asks | What it does |
| ---------------- | ----------- | ------------------------------------------------------------------------------------------------------ |
| `send_to_user` | no | One short visible bubble. Called again for another bubble, never for tool output or an inner monologue |
| `ask_user` | no | A visible question. It blocks the composer until you answer |
| `secret_request` | no | Ask for a secret out of band. The value never goes in the conversation |
| `notify` | no | A short notice, for a status you should see |
Everything else the model writes is work and is not rendered. See [Talking to a bot](/bot/conversations).
## Memory, skills and scheduling
| Tool | Always asks | What it does |
| --------------- | ----------- | ------------------------------------------------------------------------ |
| `update_memory` | no | Write a memory as a profile line, a dated log line or a fast-fading note |
| `skill` | no | List the skills that are enabled, or read one recipe by name |
| `routine` | no | Create, update, pause, resume or delete a standing routine |
| `task` | no | Dispatch a subagent |
A bot can therefore put work on its own schedule and remember things between turns without asking. What it does with those tools is visible on the bot's [Bot memory](/bot/memory) and [Routines](/bot/routines) panels, where you can read and remove anything it wrote.
## Other bots and stored results
| Tool | Always asks | What it does |
| ---------------- | ----------- | ----------------------------------------------------------- |
| `send_to_agent` | no | Message another bot you own, waking it |
| `create_agent` | no | Create another bot for you |
| `create_channel` | no | Create a group channel with bots you own as members |
| `read_artifact` | no | Read a character range from a stored tool result, by its id |
| `grep_artifact` | no | Search a stored tool result for a literal substring |
When a tool result is too big to carry, it is stored and replaced with a short stub and an `art_…` id. The bot then reads or searches it with the two artifact tools, which is why a bot can work through a huge log without the turn falling over.
## What a subagent gets
A nested task runs the bot loop again as a child, and it does not get the full catalog. Children lose `send_to_user`, `ask_user`, `secret_request`, `notify` and `task`, which leaves 26 tools. They also get no connected apps and no MCP tools at all.
The consequence is worth remembering: a child cannot talk to you, cannot ask you a question and cannot start children of its own. Only the parent bot speaks in the thread, and it reports what the child found. See [Tasks and subagents](/bot/tasks).
## Conditional tools
Three groups only exist when you have turned something on.
One tool per enabled action of each app you assigned to this bot.
One tool per allowed tool of each MCP server the account opted in, up to four servers with 24 tools each.
Reading a page you are on and filling its fields, with the Cortex browser extension.
Connected apps reach a bot only when you assigned them to it. An app is off for a bot until you turn it on for that bot alone, and the tools appear in its catalog from the next turn. Mutating actions ask for approval, read-only calls pass, and an always-allow rule for a connected app has to name that exact tool: a grant for a whole app or a whole category is refused by design.
Page tools come from the browser extension and appear on the Computer rail as **Page context**. Consent is per group of fields rather than per site, and every fill is confirmed before it is written.
## Which tools stop and ask
Read the **Always asks** column as one sentence: anything that changes a file, runs a command, or moves the mouse or keyboard asks first. Looking, waiting, remembering and talking do not. Eleven tools always ask, twenty never do, and a tool on neither list runs.
That is the shipped default, and it sits under the rules you write. Your own always-allow rules and the ceilings Cortex sets for a deployment are both consulted before every call, so the table above is where a tool starts rather than the last word. See [Approvals and tool policy](/bot/approvals).
Bot's names are its own. `shell` here is what other Cortex surfaces call `bash`, and there is no raw pixel-coordinate tool on a bot at all. Do not expect a Chat or Code tool list to match this one.
## Related
* [Approvals and tool policy](/bot/approvals) - the three choices and the rules behind them.
* [Computer](/bot/computer) - the machine the desktop verbs run on.
* [Bot skills](/bot/skills) - the recipes the `skill` tool reads.
* [Tasks and subagents](/bot/tasks) - what `task` dispatches and its limits.
* [Connected apps and secrets](/bot/plugins) - assigning an app to one bot.