Use built-in tools

Built-in tools cover file reading, search, editing, shell execution, images, browser work, notebooks, tasks, todos, and user questions. Optional plugins and Model Context Protocol (MCP) servers can add more.

How does Python execute?

The Python tool sends code to a managed gateway and kernel, captures text plus supported Multipurpose Internet Mail Extensions (MIME) results, and returns normalized output to the session. Interpreter and kernel configuration are independent of the model provider.

Treat the gateway environment as executable code authority: restrict dependencies, working directories, and credentials at the process boundary.

How do I reduce the tool boundary?

Use --no-tools for a text-only turn or --tools read,grep for an inspection-only run. Add --no-mcp and --no-extensions when discovery must not expand the set.

Which tools require extra care?

Shell and edit can change the filesystem; browser can change remote state; task agents can perform several tool calls. Read and grep are normally observational, but can still expose sensitive file contents to the selected model.

Begin a sensitive task with --no-tools, then enable only the tool set the prompt requires. File and shell tools can change the workspace; Python execution can retain kernel state; web or tenant tools can cross a network boundary. Inspect every tool request before approval. Afterward, verify the affected file, process, or remote object directly and close retained kernels or background processes that the task created.