Tools & MCP
internal/tools holds the internal tools, the plugins and the MCP servers in one
registry. The registry limits each tool to a workspace directory. The code is complete and
tested, and the dashboard and the delegation code use parts of it. But no code today runs
its own agent tool loop (RunAgentLoop). The removed stage runner did that.
Today you get multi-turn agent work when you
delegate to a vendor CLI. That CLI has its own tool loop.
The workspace
The default workspace is ~/.glider/workspace. The setting is orchestration.tools.workspace. Do not set it to .
runs/<run-id>/ work/ ← clones, temporary files, intermediate files out/ ← final files
A path with no prefix goes into the work/ directory of the current run. The function is ScopeRel. An internal tool cannot write outside of the workspace root directory.
The 17 internal tools
These are each tool, and the input of each one. A name in bold is necessary.
| Tool | Input | Function |
|---|---|---|
fs_read | path | Reads a text file in the workspace. |
fs_write | path, content | Writes a UTF-8 file. Glider makes the parent directories. For a run, prefer artifact_write. |
fs_list | path | Lists a directory. |
fs_search | pattern | Finds a file by a glob on its name. |
code_grep | query | Finds text in the files of the workspace. |
git_status | — | The status of the repository in the workspace. |
git_diff | stat | The changes. stat gives the short form. |
git_log | n | The most recent n commits. |
git_clone | url, dir | Clones into the workspace. The default directory is repo. targetDir is another name for dir. |
shell_exec | command | Runs a command. It is off when you start. Refer to the limits. |
web_search | query, limit | Searches. Refer to the providers. |
web_fetch | url | Reads a page as text. |
http_fetch | url | A raw GET. |
artifact_write | kind, path, content | Writes into runs/<id>/work or /out. kind is work or out. |
context_query | turn_id, query, key, kind, prov, path, neigh | Queries contextgraph. Refer to Context. The text form also accepts explain=, communities= and limit=. |
datetime | — | The time now, UTC, in RFC 3339. |
calculator | expr | One operation: a+b, a-b, a*b or a/b. |
What limits a tool
| Setting | Default | Effect |
|---|---|---|
orchestration.tools.workspace | ~/.glider/workspace | No tool reads or writes outside this root. |
orchestration.tools.allow_shell | false | shell_exec does nothing until you turn it on. |
orchestration.tools.shell_allowlist | — | The commands that shell_exec can run. |
orchestration.tools.allow_hosts | each host | Limits http_fetch and web_fetch. |
The configuration reference gives each of
these settings, and each setting of web_search.
MCP
Glider configures two servers when it starts, and the two are GitHub: the Copilot MCP server through HTTP, and the same server in Docker through stdio.
Today you cannot add a server of your own from the config or the API.
internal/mcp.Manager supports each stdio server and each Streamable HTTP server,
and ServerConfig has the fields for one — an id, a transport, a command with its
arguments and environment, or a URL, the authorization, and the toolsets. But no key of the
config reads it, and the endpoints under /api/mcp/servers only connect,
disconnect, reconnect and refresh a server that already exists. To add one needs a change in
the code, at the call to Configure in cmd/glider.
Authorization. Do not put auth.token in the config file.
export GITHUB_PERSONAL_ACCESS_TOKEN=ghp_... # or GITHUB_TOKEN / GH_TOKEN
You can also use the MCP page of the dashboard. Push Sign in with GitHub to start the browser OAuth procedure. If there is no client secret, Glider uses the device procedure. Push Paste PAT to write the token to ~/.glider/credentials/github_token with mode 0600.
The Streamable HTTP client sends MCP-Protocol-Version and X-MCP-Toolsets with each request. This includes the initialize request. The client keeps the Mcp-Session-Id from the reply and sends it with each subsequent request. After a 401 error or a 403 error, the client removes the session, sends initialize one more time, and then tries the request again.
The MCP page of the dashboard shows the servers. You can connect, disconnect, reconnect and refresh each server. The page shows the tools of a connected server. If no server is connected, the page shows a recorded list of tools. For the full list of endpoints, refer to API · MCP.
How to set up web search
# .env.local BRAVE_SEARCH_API_KEY= TAVILY_API_KEY= SERPAPI_KEY= SEARXNG_URL=http://127.0.0.1:8080
The auto provider tries each service in sequence. If no key is available, it uses the DuckDuckGo HTML page. If you select a service that needs a key, and the key is empty, Glider shows an error. Glider does not make false results.