Tools
Tools let sub-agents take action beyond generating text. A tool is a named, callable function — the sub-agent decides when to call it based on the conversation, Anter executes it, and the result comes back into the sub-agent's context.
Tool types
Anter supports three tool types:
| Type | What it is |
|---|---|
| HTTP | A webhook — you provide a URL and an input schema. When called, Anter posts the sub-agent's chosen inputs to that URL |
| MCP | A tool exposed by a connected MCP server. Managed via MCP servers, not created here |
| Composed | A multi-step pipeline that chains other tools together |
HTTP tools are the most common starting point. If you're connecting a third-party service that doesn't have an MCP server, an HTTP tool is the right choice.
Toolsets
Beyond individual tools, Anter bundles tools into toolsets — collections a sub-agent subscribes to as a unit instead of wiring up each tool by hand. There are two kinds:
| Toolset | What it is | Where it comes from |
|---|---|---|
| Builtin toolset | Anter-maintained platform tools, versioned and organized into groups | Ships with Anter — no setup required |
| MCP toolset | The tool catalog of a connected MCP server, subscribed to as a group | You connect the server in MCP servers |
Both are managed in the sub-agent editor, and both honor the same risk-category and per-tool permission rules described below.
Builtin toolsets
Anter ships a curated, versioned catalog of builtin tools — capabilities your agents can use without connecting an external MCP server (there's no "Anter Internal MCP" to add). They're organized into groups so you can grant a related set at once. The groups available to your agents are:
| Group | Tools | Use it for |
|---|---|---|
| General agent tools | generate_document, extract_uploaded_file_content, context_retrieval, web_fetch, web_search | Producing formatted Markdown/DOCX documents, reading uploaded files verbatim, knowledge-base lookup, fetching known URLs, and finding web sources |
| Messaging | send_message, list_messaging_targets | Sending messages to Slack and Telegram on the agent's own initiative — see Messaging |
Builtin toolset versions are immutable — once published, a version's tool set never changes, so an agent stays consistent over time. New or updated builtins ship in new versions.
web_fetch reads URLs you already know. web_search finds relevant pages from a query and returns
titles, URLs, snippets, and available publication metadata. Before using web_search, configure a
Tavily API key for the active project under Search in Agent Builder. Anter does not use a shared
fallback key; an unconfigured or inactive provider produces a tool error the agent can explain.
By default, a sub-agent you haven't configured uses Anter's safe default (the general agent tools). You stay in control: open the Builtin Toolsets selector to enable or restrict the available tools, set per-tool permissions, or turn builtin toolsets off entirely for that sub-agent.
Some builtins aren't manageable here
A couple of builtin capabilities are deliberately not shown as toggles in the Builtin Toolsets
selector. Skill loading (load_skill) is wired up automatically whenever a sub-agent has
skills attached — it's part of how skills work at run time, not a capability you switch on (see
Skills). And the cookbook & spec tools (listCookbookTemplates,
getCookbookTemplate, emitAgentSpec) power Anter's own agent-building (meta-agent) experience
and aren't available to grant to your own sub-agents.
MCP toolsets
An MCP toolset grants a sub-agent the tools published by a connected MCP server. You connect and manage servers in the MCP servers section; then, per sub-agent, you choose a server and decide whether the agent gets the full catalog or an allowlist. See MCP servers.
Managing toolsets
Open the sub-agent editor by selecting a node on the canvas. Alongside the tool list you'll find two selectors — Builtin Toolsets (above) and MCP Toolsets (below). Each opens a modal where you can:
- toggle whole groups on or off,
- drill into a group to enable or disable individual tools, and
- set a per-tool permission override (allow / ask / deny) — the same semantics as the Per-tool permission overrides below.
Disabling a tool removes it from the run entirely — the model never sees it, so it can't be triggered even if the conversation suggests it.
Creating an HTTP tool
Tools are created and managed at the organization level in the Tools section of the Agent Builder sidebar. Create a tool once — reuse it across any sub-agent in any flow.
Each HTTP tool requires:
Name and description — the name is what Anter passes to the model (e.g., send_slack_message). The description tells the model what the tool does and when to use it. Write the description from the sub-agent's perspective: "Sends a message to a Slack channel. Use when the user requests a notification or update."
Input schema — a JSON Schema definition of the inputs the tool accepts. The sub-agent uses this schema to construct its call. Be precise — a well-defined schema produces better tool calls.
Output schema — optional, but helps the sub-agent interpret the response correctly.
URL — the endpoint Anter will POST to when the tool is called. The request body is the JSON the sub-agent constructed from the input schema.
Secrets — API keys and authentication headers are stored encrypted and injected into the request at execution time. The sub-agent never sees secret values.
Risk categories
Every tool has a risk category that determines how carefully the permission system treats it:
| Category | What it means | Default behavior |
|---|---|---|
read_only | No side effects — queries, lookups, reads | Runs automatically in Ask for actions mode |
destructive | Creates, updates, or deletes data | Pauses for approval in Ask for actions mode |
open_world | Crosses your organization's boundary — third-party APIs, email, payments | Pauses for approval in Ask for actions mode |
Set the risk category when you create the tool. If you leave it unset, it defaults to destructive — the safer assumption.
Per-tool permission overrides
The risk category interacts with the flow's permission mode, but you can override it for individual tools. A tool-level override takes precedence over the agent-level setting.
| Override | Effect |
|---|---|
| Allow | Always runs without approval, regardless of permission mode |
| Ask | Always pauses for approval, even in autonomous mode |
| Deny | Never runs — calls to this tool are blocked entirely |
Use Ask to protect specific high-stakes tools even when the rest of the flow runs autonomously. Use Deny to block tools from running in certain agents while keeping them available in others.
Attaching tools to a sub-agent
Open the sub-agent editor by selecting a node on the canvas. Tools assigned through the sub-agent editor are available to that sub-agent specifically — not to other sub-agents in the flow.
For Anter's builtin tools or a connected MCP server's catalog, use the Builtin Toolsets and MCP Toolsets selectors instead — see Managing toolsets.
Narrow the tool list per sub-agent
A sub-agent performs more reliably when it has access only to the tools relevant to its domain. A billing specialist doesn't need a Slack notification tool. Assigning fewer tools reduces ambiguity and makes tool-call decisions more accurate.
Coming from Claude Managed Agents
If you've configured tools for a Claude Managed Agent before, Anter's model will look familiar — the reference shape is deliberately similar.
| Claude Managed Agents | Anter |
|---|---|
agent_toolset_20260401 (dated, versioned, immutable) | anter_builtin_toolset with a dated anter_toolset_YYYYMMDD version (dated, versioned, immutable) |
default_config + per-tool configs[] overrides | Same shape: default_config + per-tool configs[] overrides |
mcp_toolset (a separate tool type from the agent toolset) | mcp_toolset — same reference/override shape as a builtin toolset; both resolve through the same enable/permission engine |
permission_policy: always_allow | Permission override: Allow |
permission_policy: always_ask | Permission override: Ask |
| (no equivalent — remove the tool to block it) | Permission override: Deny — blocks the tool without removing it from the config |
One difference worth calling out: Anter's builtin tools are business and
knowledge-work oriented — document generation, file extraction, knowledge-base
retrieval, web research. There's no sandboxed bash/read/write/edit/
glob/grep equivalent, since Anter isn't a coding-sandbox agent platform.
For that kind of capability, wire up an HTTP or MCP tool against your own
infrastructure instead.