web_search returns ranked title, URL, and snippet results from
either the keyless duckduckgo backend or a self-hosted searxng instance
(which requires searxng_url and does not silently fall back). web_fetch
retrieves an http or https page and folds back cleaned, length-capped text, with
an SSRF guard that resolves the host and refuses loopback, private, link-local,
and reserved targets, re-checking the final URL after redirects. Both are
deferred tools gated by their own policy file, and disabling one means it is
never registered rather than blocked at call time.
It will also cover the segregation rule: agents that run shell commands and write
files autonomously do not hold the web tools. That is what breaks the chain
from untrusted web content to autonomous execution. Read-only teammates fetch and
vet material, then hand it over through shared flavour memory.
This page is in progress. The shipped
websearch_policy.yaml and
webfetch_policy.yaml files are fully commented and are the best reference
until it lands.coder and analyst agents, Tools for deferred
tool discovery, and Configuration for how these policy
files resolve.