Tools

Knowledge lets an agent answer. Tools let it look something up, or do something.

The difference from a document

A document tells the agent what your refund policy is. A tool lets it check whether thiscustomer's order is eligible. Anything that changes between customers, or between yesterday and today, wants a tool rather than a page describing it.

You describe a tool; the model decides when to use it. There is no rule you write for “if the visitor asks about an order” — the description is the rule, which is why a vague one is the usual reason a tool never gets called.

The six kinds

Each sits at a level, and levels are ordered by how much damage the tool could do if it went wrong — not by how clever it is. Your plan sets which levels you may use.

UI event · level 1	Makes something happen in the page — open a form, scroll to a section. Reaches nothing outside the visitor's browser.
RAG filter · level 1	Narrows which of your documents a question may be answered from. Reads your own material and nothing else.
Workflow gate · level 1	Pauses and requires a human decision before continuing.
API action · level 2	Calls your systems with credentials you supplied. The first level that can reach outside Tigerbase, and the first that can change something of yours.
MCP server · level 3	Connects to a Model Context Protocol server — tools we did not write, with a schema we did not define, on a host you name.
Custom script · level 4	Runs code you wrote. Highest level because it is the least constrained.

Custom scripts are not available

The type exists and plans can allow it, but execution is refused: it currently runs without a real sandbox, and shipping that would mean tenant-authored code running unconstrained on our side. It stays disabled until that is fixed.

What MCP is

MCP — the Model Context Protocol — is an open standard for describing tools so any model can use them. If a service you already run exposes an MCP server, you point Tigerbase at it, we import the tools it advertises, and each one becomes available to your agent without you describing it by hand.

Tigerbase is on both sides of it: it can connect out to your MCP servers, and it exposes your agent as an MCP server so other tools can drive it.

We check where an MCP server lives

A server address you save is resolved and checked before we connect, and private or internal addresses are refused — so a mistyped or malicious URL cannot be used to reach inside our network. Redirects are not followed.

How a tool gets used

text

Visitor   "where's my order 4471?"
              │
Agent     reads the tool descriptions, picks lookup_order
              │
Tigerbase calls your endpoint with { orderId: "4471" }
              │
Your API  { "status": "shipped", "eta": "Thursday" }
              │
Agent     "It shipped — it should reach you Thursday."

The visitor never sees the tool call. If your endpoint is down, the agent says it cannot check right now rather than inventing a status — and the failure is in the agent's logs.

What your plan controls

Level	The highest kind of tool you may use. Everything at or below it is allowed.
Exceptions	Individual tools can be allowed above your level, or denied below it. A denial always wins.
Count	How many tools one agent may have enabled at once.

Changing plan does not disturb a running agent: the terms are frozen when a subscription starts, so an edit to a plan reaches you at your next term rather than mid-month.

Plans and limits — what the numbers mean