Tools
opencode-squad registers custom tools that help agents inspect projects, keep local working context, research external sources, and run commands in safer environments.
Tools are not all meant to be called directly by the user. Many exist so agents can do focused work with explicit permissions and clear safety boundaries.
Tool groups
| Group | Page | What it covers |
|---|---|---|
| Container execution | Container execution | sandbox_exec, chroot_exec, and runtime inspection. |
| External repositories | External repositories | Registering, searching, reading, and updating reference Git repositories. |
| Web search | Web search | SearXNG-backed web search through a local helper container. |
| Local state | Local state | Scratchpads, handoffs, and review context. |
| Utilities and internals | Utilities and internals | Diagnostics, file inspection, Configuru helpers, and Retitler support. |
Risk model
Tools are intentionally mixed by risk level:
- read-only tools inspect files, repositories, containers, or runtime metadata
- state tools write plugin-managed scratchpads, handoffs, and review context
- container tools may build or run helper containers
- execution tools can run commands in isolated or project-mounted environments
Agents receive tool permissions according to their role. For example, review-oriented agents are intentionally more restricted than implementation-oriented agents.
Practical rule
Prefer the least powerful tool that can answer the question:
- use read-only inspection before execution
- use
sandbox_execfor isolated experiments - use
chroot_execonly when project-mounted command execution is intentional - keep persistent state in plugin-managed tools instead of ad-hoc files when it is session or agent context
Configuration
Tool state paths and container asset overrides are governed by trusted global configuration. See Local paths for the path trust model.