Tools & integrations

The tools an Agent can use depend on how its turn starts. Check this before moving a workflow from local chat to Telegram, a schedule, or remote access.

Which tools can this turn use?

A local operator turn is a direct web or CLI chat while BAZILION_PUBLIC_ORIGIN is unset. It uses your configured tools and shell mode. A protected turn is started by Telegram, a trigger, inbox delivery, or an approved delivery. Setting BAZILION_PUBLIC_ORIGIN also makes HTTP chat use protected execution, including requests made from the same machine.

On a narrow screen, scroll the table sideways to compare both turn types.

Capability	Local operator turn	Protected normal turn
Coding	Pi host tools by default; Docker bash when selected	Docker bash; no host coding tools
Docker required	Only when configured	Always, even if BAZILION_BASH_SANDBOX=off
Web fetch	Configured fetch integrations	Uncredentialed, SSRF-guarded fetch
Credentialed web search / Firecrawl	When configured	Unavailable
Playwright browser / MCP	When enabled	Unavailable
Team memory, mailbox, guarded context, Agent home tools	Available	Available through scoped tools
File delivery	Available	Available from the Team workspace
Provider credentials	Configured runtime	Only the selected provider’s validated credential fields

Reviewed learning uses a separate restricted review surface; it does not get the normal Agent toolset. See Daily operations.

Enabling a browser or MCP server does not add it to protected turns. A failed protected preflight stops the turn; it never falls back to host execution.

Prepare Docker for protected work

On the daemon host, install and start a local Docker engine and ensure the user running Bazilion can access its Unix socket. Prepare the default image yourself:

docker context show
docker info
docker pull debian:bookworm-slim
docker image inspect debian:bookworm-slim
bazilion doctor

Bazilion uses --pull never: it will not download a missing image during a turn. Use BAZILION_BASH_SANDBOX_IMAGE in the daemon environment to select a different locally installed compatible image, then restart. Images with declared volumes and remote Docker endpoints are rejected. The default image is minimal; prepare a compatible image with any project tools you need because shell commands run without network access.

Confirm the protected-work readiness reported by bazilion doctor, then test the intended Agent/provider through its actual Telegram, trigger, or remote path. General readiness does not prove every provider credential or project command works. Docker setup is required before those workflows can run.

The built-in tools

Within the capability limits above, normal turns have:

• coding tools — host tools or Docker bash for Team project files,
• web tools — fetch, with configured search available only in local operator turns,
• mailbox tools — send_message, read_inbox, wait_for_reply, and approval_status,
• memory tools — search and write the Team’s shared memory,
• guarded Team context tools — user_md_get and concurrency-checked user_md_write,
• home-file tools — read and update its own IDENTITY.md and notes.

Because a Team root can be a symlink to a real project (see Core concepts), Agents work on actual code rather than a throwaway sandbox.

Shell isolation and dangerous-command approval

For local operator turns, Pi’s host-backed read, bash, edit, write, grep, find, and ls tools operate from the Team root. This is convenient, but the working directory is not a security boundary.

Set BAZILION_BASH_SANDBOX=docker to replace the host-backed coding surface with a containerized bash. Every invocation uses a fresh container with no network, a read-only root, a temporary /tmp, a scrubbed environment, and the Team workspace as its only writable mount. Team memory, Agent inputs, and attached skills are mounted read-only. Bazilion accepts only a local Unix-socket Docker context and a pre-existing compatible image; a missing or invalid setup fails closed instead of falling back to the host.

BAZILION_BASH_APPROVAL=dangerous is a separate control. Commands classified as dangerous pause for approval inline in web chat or at an interactive CLI prompt. Decisions are scoped to that turn; cancellation and timeouts clean up the request, and non-interactive turns deny automatically. This is independent of durable Team Policy communication approvals.

BAZILION_BASH_SANDBOX=docker \
BAZILION_BASH_APPROVAL=dangerous \
bazilion dashboard

Browser automation

Local operator turns can drive an enabled Playwright browser. Perception is accessibility-tree-first: the agent reads an aria snapshot with stable element references and acts on those references, so it doesn’t depend on a vision model to see the page.

The suite covers navigation and interaction — browser_navigate, browser_snapshot, browser_click, browser_type, browser_fill_form, browser_select, browser_hover, browser_press_key, browser_go_back, browser_tabs, browser_take_screenshot, browser_console, and browser_network.

For a source checkout, install the matching browser from the repository root:

pnpm exec playwright install chromium

Then enable browser automation on config → Browser Automation (or via environment variables). Published Bazilion includes a Chromium browser package; if browser startup fails, inspect the installation error and browser system dependencies. The repository pnpm exec command is for source checkouts.

Caution

A network-layer SSRF guard blocks loopback and private-network targets by default, so an agent can’t browse localhost or your LAN. For local development you can override it with the BROWSER_ALLOW_PRIVATE_NETWORK environment variable.

MCP servers

The daemon is a Model Context Protocol client. Connect an MCP server and its tools are discovered automatically and injected into configured local operator turns, namespaced as mcp__<server>__<tool> so they never collide with built-ins.

Three transports are supported:

• stdio — the daemon launches the server as a local subprocess,
• Streamable-HTTP — a remote server over HTTP, with optional bearer auth,
• SSE — a server-sent-events endpoint, with optional bearer auth.

Manage servers from the CLI:

bazilion mcp add <name> …     # register a server
bazilion mcp list             # list configured servers
bazilion mcp show <name>      # inspect one server and its tools
bazilion mcp test <name>      # connect and verify it responds
bazilion mcp enable <name>
bazilion mcp disable <name>
bazilion mcp rm <name>

The same servers are managed visually on the /config/mcp page.

File handling

Files move both ways between you and your agents, across the web UI, Telegram, and the CLI.

Inbound. Attach a file and the daemon classifies it: images are passed to the model as vision input, while other files are stored where the agent can open them with its coding tools. From the CLI:

bazilion agent chat <agent-id> --image ./screenshot.png
bazilion agent chat <agent-id> --file ./report.pdf

Outbound. Agents send files back with the deliver_file tool (up to 25 MB per file). These deliveries arrive as downloadable files, including Telegram documents. Images returned by tools such as browser screenshots are displayed separately in web chat and sent as Telegram photos when supported.

Note

Audio and video files are stored as attachments; they are not native audio/video model input. Browser and MCP availability follows the turn boundary above, regardless of which client displays the conversation.

Durable files and live clarification in 0.15.0

deliver_file captures an immutable Team-owned result, rather than relying on transient stream bytes. Saved chat cards and the Team Results library survive reload and restart; downloads retain the original filename. See Saved results for authorization, previews and limits.

ask_user is available only on eligible live human routes. It offers bounded choices, Other or Skip and waits for a correlated answer in the originating conversation. Scheduled, inbox and review turns do not inherit this capability. See Agent questions.