R.5
Toolsets
The 27 toolset types of docker-agent 1.149.0, each with the tools it exposes, its options, and what it needs outside the agent file.
docker-agent toolsets printed 27 types on 2026-10-08 (our source record), and the type enum of the schema holds the same 27 names. The Tools column comes from the docs page of each type under tools/, and not documented marks a type with no page. Options are the keys of R.4 that the type reads, with the defaults the docs state. Needs says what the toolset reaches beyond the agent file: nothing, the host shell, the network, a credential, a binary, or Docker. The shared keys instruction, tools, readonly, model, defer, and toon apply to every type and are not repeated.
The 27 types
| Type | Tools | Options | Needs |
|---|---|---|---|
a2a | one tool per remote agent, named by name or from the agent card | url (required), name, headers, allow_private_ips | the network and the remote A2A server. A token in headers when the server was started with --auth-token |
api | one tool per api_config, named by api_config.name | api_config with name, endpoint, method (GET or POST in the docs, five verbs in the schema), instruction, args, required, headers, output_schema. timeout (30), allow_private_ips | the network. Tokens in headers through ${env.VAR} |
background_agents | run_background_agent, list_background_agents, view_background_agent, stop_background_agent | none | agents listed under sub_agents |
background_jobs | run_background_job, list_background_jobs, view_background_job, stop_background_job, wait_background_job (timeout default 60) | env, recall (false) | the host shell |
environment | not documented. The probe summary says it reports the OS and the resolved shell, read-only, with no arguments | none documented | nothing |
fetch | fetch with urls, format (text, markdown, html), timeout (1 to 300) | timeout (30), allowed_domains, blocked_domains, allow_private_ips (false), headers, escape_html (false) | the network. GET only. Non-public addresses are refused by default |
file | not documented. The probe summary says it reads, writes, and edits individual files | post_edit, allow_list, deny_list, which the schema names for filesystem and file | nothing |
filesystem | read_file, read_multiple_files, write_file, edit_file, list_directory, directory_tree, create_directory, remove_directory, search_files_content | ignore_vcs (true), post_edit (path, cmd), allow_list, deny_list | nothing |
git | git_status, git_log (limit default 20, path), git_branches, git_show (ref), git_blame (path required, rev) | none | nothing. It uses go-git and needs no git binary |
lsp | lsp_workspace, lsp_hover, lsp_definition, lsp_references, lsp_document_symbols, lsp_workspace_symbols, lsp_diagnostics, lsp_code_actions, lsp_rename, lsp_format, lsp_call_hierarchy, lsp_type_hierarchy, lsp_implementations, lsp_signature_help, lsp_inlay_hints | command (required), args, env, file_types, working_dir, version, lifecycle | a language server binary, installed from the aqua registry when absent |
mcp | the tools the server lists, filtered by tools | ref (docker:<name> or an mcps name), or command, args, env, version, working_dir, or remote with url, transport_type (streamable or sse), headers, oauth. config, lifecycle, allow_private_ips | ref: docker: needs the MCP Gateway and Docker. command needs the binary. remote needs the network and an OAuth login when the server asks for one |
mcp_catalog | search_remote_mcp_servers, enable_remote_mcp_server, list_remote_mcp_servers, disable_remote_mcp_server, reset_remote_mcp_server_auth | allowed_servers, blocked_servers | the network. OAuth for servers that require it. No gateway, because the catalog subset is streamable HTTP only |
memory | add_memory, get_memories, delete_memory, search_memories, update_memory | path (~/.cagent/memory/<config-name>/memory.db) | a SQLite file on disk |
model_picker | change_model (model required), revert_model | models (required) | credentials for the listed models |
open_url | one tool, open_url by default | url (required), name | a browser on the host, through open, xdg-open, or rundll32 |
openapi | one tool per operation of the document | url (required), headers, timeout (30), max_output_bytes (30000), allow_private_ips | the network, for the document and every call |
plan | write_plan, read_plan, list_plans, delete_plan, update_plan_from_file, export_plan_to_file, set_plan_status, get_plan_status | none | the store under ~/.cagent/plans/, shared by every agent with the type |
rag | one search tool named in rag_config.tool | rag_config with docs, strategies (chunked-embeddings, semantic-embeddings, bm25), results, respect_vcs (true), indexing_timeout | an embedding model, so a provider credential or Docker Model Runner, and a SQLite database per strategy |
scheduler | create_schedule (prompt, when required, name), list_schedules, cancel_schedule (id required) | none | a running session that supports recall. Schedules are not persisted |
script | one tool per entry under shell, named by the key | shell.<name>.cmd, description, args, required, env, working_dir | the host shell |
session_context | list_sessions, read_session | none | the session database |
shell | shell with cmd (required), cwd (.), timeout (30) | env, sudo_askpass (false), safer (deprecated and ignored) | the host shell. Every command is classified safe, destructive, or unknown before approval |
tasks | create_task, get_task, update_task, delete_task, list_tasks, next_task, add_dependency, remove_dependency | path (tasks.json) | a JSON file on disk |
think | one reasoning tool. The page names no tool | shared in the schema | nothing. No side effects |
todo | create_todo, create_todos, update_todos, list_todos | shared (false) | nothing |
user_prompt | user_prompt with message (required), title, schema | none | an elicitation handler, which the TUI and CLI provide and some MCP clients do not |
webhook | send_webhook with message | webhook_config with url (required), provider (generic by default, or slack, discord, ifttt, telegram, mattermost, rocketchat, googlechat, teams), headers, chat_id | the network. The URL is itself the credential on Slack and Mattermost |
Names that are not types
Two tools arrive without a toolsets entry. sub_agents injects transfer_task, and handoffs injects the tool of the same name (conflict C56). The docs built-in table lists both as types, and the schema enum and the probe exclude both.
| Name | Tool | Injected by | Needs |
|---|---|---|---|
transfer_task | transfer_task with agent, task, expected_output (all required), always auto-approved | sub_agents on the caller | the named sub-agent |
the tool of handoffs | one tool with agent (required) that moves the conversation to a local agent and opens no network connection | handoffs on the caller | the named agent in the same file |
session_plan | write_session_plan, read_session_plan, exit_plan_mode | the docs list it as a built-in type. The v1.149.0 enum and the probe do not name it, so the pinned binary does not accept it as a type | a per-session file under ~/.cagent/session_plans/ |
The docs name session_plan as a type, and the schema names 27 types without it. The schema ranks above the docs in this manual, so the manual treats session_plan as not available at the pin.
Docker Sandboxes (sbx) and Docker Agent (docker-agent) sbx 0.47.0, docker-agent 1.149.0 · bf4169c · 2026-10-07 · Edition 2026.10