web_search returns ranked title, URL, and snippet results from
either the keyless duckduckgo backend or a self-hosted searxng instance
(which requires searxng_url and does not silently fall back). web_fetch
retrieves an http or https page and folds back cleaned, length-capped text, with
an SSRF guard that resolves the host and refuses loopback, private, link-local,
and reserved targets, re-checking the final URL after redirects. Both are
deferred tools gated by their own section (websearch and webfetch), and
disabling one means it is never registered rather than blocked at call time.
It will also cover the segregation rule: agents that run shell commands and write
files autonomously do not hold the web tools. That is what breaks the chain
from untrusted web content to autonomous execution. Read-only teammates fetch and
vet material, then hand it over through shared flavour memory.
This page is in progress. The shipped
websearch and webfetch sections are
fully commented and are the best reference until it lands. Legacy split
websearch_policy.yaml and webfetch_policy.yaml files still resolve.coder and analyst agents, Tools for deferred
tool discovery, and Configuration for how these sections
resolve.