Everything in an agent’s MCP tool list is one of two kinds. Meta-tools are fixed, and every agent has them. Authored tools are what Graft’s model wrote for you, and each agent sees exactly the ones promoted into its working set.

​
The meta-tools

Beside these is a low-level authoring set (write_file, read_file, run_command, wait_for_process, read_web_page, check_tool, publish_tool, read_tool_source) and one execute__<connection id> tool per connection in scope. acquire drives these itself; they stay available for a person running a strong model who wants their own agent to hold the pen.

​
Authored tools

An authored tool is a small TypeScript module making one call against one vendor: the fields this task needs, no pagination, no client for the rest of the API. It reaches the vendor through ctx.fetch with a vendor-relative path, or through an official SDK bound to the proxy. It never holds a credential and never names a host. On the wire it is <vendor>__<name>: two kebab-case halves joined by a double underscore, github__list-issues. It carries a real input schema, so the harness validates every call, and two annotations:
  • readOnlyHint is true when the module’s calls are all GET or HEAD.
  • destructiveHint is true when it uses DELETE.
Any other method is a write, and so is every SDK call and any method that is not a literal. The static check derives both from the code; nothing the model says about the tool changes them. These annotations are what decide whether a call asks you first. See How approvals work. The tool’s description is written by the agent’s model. Wherever the console shows it, it is marked as the agent’s account of what the tool does, not a person’s.

​
The toolbox

The toolbox is your store of authored tools, one per person, every version kept. Republishing a tool under the same name writes the next version and moves the pointer; a run already on the old version finishes on it. Nothing is ever deleted by the system. A demoted tool, a tool whose connection was revoked, a version that was superseded: all still there. find_tool searches the whole of it, promoted or not, and answers each tool’s vendor and name, whether it is in the working set, and its two hints. A tool that is not promoted is one promote call from appearing in the list, and run_tool runs it without promoting it. The console shows the toolbox from two sides: each connection card under Connections lists the tools authored against its vendor, and each agent’s page shows which of them are in that agent’s working set.

Promote and demote

Moving tools in and out of a working set by hand.

Reading a tool's source

What read_tool_source returns and how to read a module.

​
Try it