Tools and agents

Tools let a model do something other than write text. With tools on, a model can take several steps in one reply: search, read a result, then answer.

The tools

Tool	What it does	Needs
Web search	Returns titles, addresses and snippets for a query.	A search service: Brave Search, Tavily or a SearXNG instance.
Read a web page	Fetches a public page and returns its text.	Nothing extra.
Save to memory	Stores one short fact about you for later chats.	Memory turned on.
Create a file	Makes a text-based file you can download.	Nothing extra.

Turning tools on

Tools are off in new conversations. Click the wrench button next to the message box to turn them on for the current chat. The button is disabled when the selected model or provider does not support tools, for example Perplexity and AI21.

Permissions

Each tool has a permission under Settings, Tools and agents:

• Off. The model is never offered the tool.
• Ask every time. The reply pauses and shows what the model wants to do. Nothing runs until you press Allow.
• Allow without asking. Available for search and page reading only.

Tools that change your stored data, which are memory and file creation, cannot be set to Allow. They always ask.

When a reply pauses, each pending action shows its details, such as the search query or a preview of the file. Decide each one. Declined actions are reported to the model, which carries on without them. Sending a new message declines anything still waiting.

Setting up web search

Search needs an outside service because Max Harness does not crawl the web itself. There are two places to configure one:

• For everyone: an administrator enters a service under Admin, Settings.
• For yourself: add your own key under Settings, Tools and agents. Your own setting takes priority.

Brave Search and Tavily need an API key from their websites. SearXNG needs the address of an instance with JSON output enabled.

Limits and safety

• A reply can use at most eight tool steps. After that the model has to answer or you send another message.
• Page reading only follows public addresses. Requests to private network ranges, including through redirects, are blocked. Pages are capped at about 30,000 characters.
• There is no shell, no code execution and no file access on the server. An agent cannot reach other accounts.
• Text a tool brings back is passed to the model as data. Web pages can still contain misleading instructions, so read what an agent proposes before approving it.

What is shared when tools run

Search queries go to the search service you configured. Page requests go from your server to the website being read. The results are then sent to your AI provider as part of the conversation.