FlowGenX Co-Worker

Tools & Connected Systems

The built-in capabilities every co-worker carries, the connected apps and MCP servers it reaches through, and how sensitive actions are approved.

A skill tells a co-worker what to do. Tools are how it does it. Every co-worker carries a built-in tool surface, and reaches your systems through the same connectors, MCP servers, and A2A agents the rest of the platform uses.

Built-in capabilities

GroupWhat it covers
MemorySave, search, and delete the facts it keeps. See Context
SkillsSearch skills by topic, load one by name, save a new one
RetrievalSearch the organization knowledge base and its own conversation history
WebSearch the web and fetch a page
BrowserDrive a real browser: navigate, click, type, select, upload, extract, screenshot, and work across tabs
Files and workspaceRead, write, edit, and list files in the run workspace, search them, and publish one as a fetchable URL
CodeRun Python, JavaScript, or TypeScript in a sandbox and poll for the result
DataFetch, profile, and query a dataset
Media and designGenerate images, video, and speech, analyze media, and save or search design assets
Routines and watchersSave a playbook, run it now or on a schedule, and watch a condition in the background
CredentialsList the credentials available on the account and use one without ever seeing its value
Human inputAsk a person a question mid-task

Two of these deserve a note.

Credentials are used, not read. The co-worker can see which credentials exist and invoke one, but the secret itself is never exposed to the model.

Asking a person is a real option. A co-worker running interactively can stop and ask rather than guess. In unattended runs that path is closed, which is a deliberate tradeoff covered in Channels and proactive work.

Connected systems

Built-in tools cover the general case. Your systems arrive through the platform's existing connectivity:

The co-worker inherits the account's connections. There is no separate connector setup inside Co-Worker Studio, and no way to give a co-worker a connection the account does not have. Scoping a co-worker therefore starts with scoping the account that owns it.

Approvals for sensitive actions

Some tools are marked sensitive because they act rather than observe.

When the co-worker is running in a mode that asks before acting, a sensitive tool always requires explicit approval. That prompt cannot be turned off by a general auto-approve setting, and a decision you make on it applies to the current session only. It does not persist into the next one, so an approval granted once for convenience cannot quietly become a standing grant.

In auto mode, tool calls proceed without prompting. Choose the mode to match the surface: auto for work you have already reviewed the shape of, ask for anything that writes to a system of record for the first time.

Tools the co-worker deliberately does not get

Two capabilities are withheld from the co-worker chat surface on purpose:

  • Full inventory listings. Dumping every memory or every skill into context floods the run and measurably drives repeat fetches. The co-worker gets an index plus search instead, and a call to a listing tool is redirected to the search tool with an explanation.
  • Routine management during unattended runs. A scheduled run executes a playbook. It does not get to author or edit playbooks while it runs.

There is also a hard gate on the co-worker's context tools. While the co-worker is disabled, conversation history and knowledge base access are withheld from the declared tool list and blocked at execution, so a model that tries to call them anyway gets a refusal rather than data. See Governance and control.