Tools & Connected Systems
The built-in capabilities every co-worker carries, the connected apps and MCP servers it reaches through, and how sensitive actions are approved.
A skill tells a co-worker what to do. Tools are how it does it. Every co-worker carries a built-in tool surface, and reaches your systems through the same connectors, MCP servers, and A2A agents the rest of the platform uses.
Built-in capabilities
| Group | What it covers |
|---|---|
| Memory | Save, search, and delete the facts it keeps. See Context |
| Skills | Search skills by topic, load one by name, save a new one |
| Retrieval | Search the organization knowledge base and its own conversation history |
| Web | Search the web and fetch a page |
| Browser | Drive a real browser: navigate, click, type, select, upload, extract, screenshot, and work across tabs |
| Files and workspace | Read, write, edit, and list files in the run workspace, search them, and publish one as a fetchable URL |
| Code | Run Python, JavaScript, or TypeScript in a sandbox and poll for the result |
| Data | Fetch, profile, and query a dataset |
| Media and design | Generate images, video, and speech, analyze media, and save or search design assets |
| Routines and watchers | Save a playbook, run it now or on a schedule, and watch a condition in the background |
| Credentials | List the credentials available on the account and use one without ever seeing its value |
| Human input | Ask a person a question mid-task |
Two of these deserve a note.
Credentials are used, not read. The co-worker can see which credentials exist and invoke one, but the secret itself is never exposed to the model.
Asking a person is a real option. A co-worker running interactively can stop and ask rather than guess. In unattended runs that path is closed, which is a deliberate tradeoff covered in Channels and proactive work.
Connected systems
Built-in tools cover the general case. Your systems arrive through the platform's existing connectivity:
Connected apps
Authorize an app once on the account and the co-worker can act in it. 200+ connectors are available in the gallery.
MCP servers
Native, external, and OpenAPI-backed MCP servers expose their tools to the co-worker.
Your own APIs
Import an API spec and turn its endpoints into callable actions with schema detection and parameter mapping.
A2A agents
Reach other agents over the A2A protocol through Agent Fabric.
The co-worker inherits the account's connections. There is no separate connector setup inside Co-Worker Studio, and no way to give a co-worker a connection the account does not have. Scoping a co-worker therefore starts with scoping the account that owns it.
Approvals for sensitive actions
Some tools are marked sensitive because they act rather than observe.
When the co-worker is running in a mode that asks before acting, a sensitive tool always requires explicit approval. That prompt cannot be turned off by a general auto-approve setting, and a decision you make on it applies to the current session only. It does not persist into the next one, so an approval granted once for convenience cannot quietly become a standing grant.
In auto mode, tool calls proceed without prompting. Choose the mode to match the surface: auto for work you have already reviewed the shape of, ask for anything that writes to a system of record for the first time.
Tools the co-worker deliberately does not get
Two capabilities are withheld from the co-worker chat surface on purpose:
- Full inventory listings. Dumping every memory or every skill into context floods the run and measurably drives repeat fetches. The co-worker gets an index plus search instead, and a call to a listing tool is redirected to the search tool with an explanation.
- Routine management during unattended runs. A scheduled run executes a playbook. It does not get to author or edit playbooks while it runs.
There is also a hard gate on the co-worker's context tools. While the co-worker is disabled, conversation history and knowledge base access are withheld from the declared tool list and blocked at execution, so a model that tries to call them anyway gets a refusal rather than data. See Governance and control.
Skills
Named playbooks a co-worker loads and follows. Equip them from the library, write your own, or let the co-worker save a route that worked so the next run is short.
Channels & Proactive Work
Reach your co-worker from Slack and Google Chat, keep thread continuity across turns, and let it act on events and schedules when nobody is watching.