Agent Tools

The Foxl desktop agent comes with a set of built-in tools organized into profiles, plus a few capability-gated tools (like generate_image) that register automatically when their credentials are available. Which built-ins are loaded is decided by the tool profile (Full by default - see below), not per message; skill-provided tools and your own custom tools are added on top of whichever profile is active.

Browser

Code & Files

Shell & System

Web

Memory

Scheduling

Agent

Integrations

Integration tools are only available after you connect the corresponding account in Settings > Connect > Integrations.

These tools use OAuth user tokens - they act as you, not as a bot. Connect them under Settings > Connect > Integrations.

Channels

Media

Image editing and composition

Pass one or more existing image paths as inputImages to switch from text-to-image into edit / compose mode. When you drag images into the chat, Foxl auto-persists them to attachments/ inside your workspace and injects the absolute paths into your message, so the agent can reference them without base64 round-tripping through the model's tool-call args.

Examples the agent can drive end-to-end:

Up to 10 input images per call. Output PNG lives at a date-stamped filename with a slug derived from the prompt, in a generated/ subfolder to keep your workspace root clean.

Tool Profiles

Foxl uses tool profiles to control how many tools are loaded, saving tokens in the system prompt. A tool definition costs roughly 200 tokens, so the profile is a direct trade of capability against every turn's input:

The agent runs in Full profile by default. Switch profiles on the System tab of Settings > Connect > Integrations to save tokens on simpler tasks; the same tab lists every built-in and lets you switch one off. generate_image lives in the media category and is included in Default, Standard, and Full; Minimal omits it to preserve its token budget.

Integration tools (outlook, slack), skill-provided tools and your own custom tools are not counted above and are not filtered by the profile - a tool you connected or wrote is available whichever profile you are on.

Git operations route through exec (e.g. exec git status, exec git push). There is no dedicated git tool - piping and custom flags work better from exec anyway, and exec's own approval rule covers them.

The same tools in Foxl Notes

The same tools serve Foxl Notes. Ask the Notes assistant something and it can open your files, search your code and notes, fetch a link or run a command - whatever the System tab has switched on, custom tools and MCP servers included - and it lists the tools it used under the answer. The floating meeting panel's ask bar runs on the same engine, and questions asked there and in the main window land on one thread. One switch governs both, Settings > Notes > AI features > Use Foxl Agent tools, on by default; with it off the assistant reasons about the transcript alone. It needs Foxl running on your computer. The automatic work - the post-meeting summary, the auto title, live translation and dictation clean-up - deliberately uses no tools, so nothing you were not waiting for got slower.

Custom tools

Beyond the built-ins you can add your own on the Custom tab of Settings > Connect > Integrations, which also lists your MCP servers. Six kinds:

A file tool's blocked-path list is applied to the path it actually opens, not to the template - so ~ is expanded first (a ~/notes.md template works), and /etc/passwd spelled //etc/passwd, reached through .., or under macOS's /private/etc is covered.

Permission rules accept hyphens in a tool name. A custom tool called deploy-prod keeps its name, and every MCP tool is exposed as <server>__<tool> where the right half usually has one, so a rule written with an argument pattern like deploy-prod(rm *) matches instead of being stored under a name no tool is ever called.

MCP servers

Foxl is an MCP client. It speaks the current 2026-07-28 revision and every older one, and asks each server which revisions it supports so the newest one both sides know is used:

There is nothing to configure either way. The server's row on the Custom tab shows which revision was agreed, so a server on the new stateless protocol is visibly different from one on an older one.

Starting a local server asks first, once. An mcp_local row is a program on your computer, so the first time its command is started - when you save the row, re-check it, open it in the inspector, or the agent first uses one of its tools - Foxl shows the command it is about to run and asks. The answer is kept for that row until its command, arguments or environment change; an approved server starts silently from then on, and calls to its tools are not prompted. This is asked even with auto-approve all tools switched on, because that switch is about tool calls rather than about starting programs, and if nobody answers, nothing is started. Servers you configured before this rule show as needing approval, and the agent does not see their tools until you press the re-check button beside each one and approve the command it shows. An mcp_remote row is a URL - nothing is started, so nothing is asked.

Two things worth knowing:

• A long tool list is read in full. Servers may hand their catalog over in pages; Foxl walks every page rather than reading the first one and treating it as the whole list.
• A slow tool is not called twice. When a tool took longer to answer than the app was willing to wait, the app used to assume its guess about the protocol was stale, reconnect, and send the same request again - so a tool that sends mail sent it twice while the agent saw one call and one error. It now retries only when nothing can have reached the server, or when the request is a read that cannot have an effect.

Skills

Beyond built-in tools, Foxl supports skills - installable capability packages that extend what the agent can do. See Skills for the full catalog.