MCP tools

Model Context Protocol — the standard the agent uses to call tools. Built-in tools plus your own.

What is MCP

Model Context Protocol is an open standard for exposing tools (functions) to LLMs. KrowForge speaks MCP both as a host (for the agent) and as a client (for third-party MCP servers).

Practically: you can plug any MCP server into KrowForge and the agent gets new tools.

Built-in tools

Always available. No config needed.

Tool	What it does
`read_file(path)`	Reads a file from the workspace.
`write_file(path, content)`	Stages a write for the changes panel.
`list_dir(path)`	Lists a directory.
`search_files(pattern)`	Glob/text search across the workspace.
`run_shell(cmd)`	Executes a shell command (subject to autonomy + guards).
`brave_search(query)`	Web search. Requires Brave API token.
`fetch_url(url)`	Fetches a URL (subject to allowlist).
`browser_open(url, script)`	Headless browser navigation + scripting.

Tool registry

GET /api/mcp returns the full registry of available tools — name, description, parameters. The agent receives this same list as part of its system prompt.

Adding tokens

Many tools need API tokens (Brave, OpenAI for fallback, etc.). Manage them in Settings → MCP → Tokens.

Tokens are encrypted per-workspace.
Stored in the workspace's secret store (Fernet AES-128-CBC + HMAC).
Never sent to the browser after they're set.

Adding custom MCP servers

Drop a server config into mcp_servers.json in the workspace root:

{
  "servers": [
    {
      "name": "github",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "$GITHUB_TOKEN" }
    }
  ]
}

Restart the workspace. The new tools appear in the registry and the agent can call them.

Browser tool

The browser_open tool launches a real headless browser inside an isolated VM, navigates to a URL, optionally runs a JS script, and returns the screenshot or page text.

See Browser tool for the full spec, allowlist, and limits.

Limits

Tool call output is capped at 256 KB per call.
A run can make up to 50 tool calls before requiring re-confirmation.
Network tools are subject to the egress allowlist.