Skip to main content
allowedTools controls the optional tools available to an agent. It is an allowlist, but two groups have special defaults:
  • vault_get, vault_list, register_outcome, http_fetch, and http_download are always registered. Vault tools are kept for legacy agent-scoped secrets; use Connections for new external API keys and integrations.
  • If allowedTools is omitted or empty, Polpo also registers the baseline coding tools: read, write, edit, bash, glob, grep, and ls.
  • If allowedTools is non-empty, include every coding tool the agent still needs. Optional tool categories and custom tools are never enabled implicitly.

​
Built-in catalog

Connections add explicit GitHub, Slack, Google Drive, remote MCP, channel, and API-key-backed tools. Project custom tools are enabled by their exact snake-case name.

​
Wildcards

The runtime expands these category wildcards:
Connection tools do not have a catalog wildcard. List them explicitly.
A wildcard grants every current tool in that category and may include new tools added in a later release. Use exact names where the grant must remain fixed.

​
Runtime tool router

Large tool palettes can be exposed progressively. When the runtime tool router is active, the model receives a small set of router tools instead of every schema upfront:
  • tool_list and tool_search discover available tools.
  • tool_read loads one exact tool schema on demand.
  • tool_call executes the selected tool with JSON arguments.
allowedTools remains the source of truth. The router can only discover and execute tools already granted to the agent; it does not expand permissions or expose secrets. Hosts can configure this with POLPO_TOOL_ROUTER=auto|on|off, POLPO_TOOL_ROUTER_THRESHOLD, and POLPO_TOOL_ROUTER_DIRECT_TOOLS.

​
Audio providers

Audio tools use the model configured on the agent. audio_transcribe reads transcribe_model; audio_speak reads tts_model. Both fields use the provider/model format. OpenAI, Deepgram, and ElevenLabs audio models call the provider directly and require the matching provider credential. Prefer managed routing or Connections where available; legacy direct-provider paths can still use the agent vault. edge/edge-tts runs in the agent sandbox and does not require a key. Audio traffic does not currently use the managed Model Gateway. For US English, start with deepgram/nova-3 for transcription and deepgram/aura-2-thalia-en for speech. Add a deepgram provider credential once; both tools reuse it.

​
Filesystem access

allowedPaths restricts filesystem tools to selected paths. Relative paths resolve from the agent working directory; in Polpo Cloud that directory is /home/daytona/project/workspace.
If allowedPaths is omitted, access defaults to the workspace. Paths do not grant tools: the agent still needs the corresponding entries in allowedTools.