Tools & integrations

Every turn gets the same tools, whatever started it: web or CLI chat, a follow-up, Telegram, a scheduled trigger or an inbox wake. Only two depend on someone being there to answer: ask_user (questions) and dangerous-command approval, which is denied when nobody can answer. Learning reviews run separately with a single propose_lesson tool.

Built-in tools

Tools	What they do
bash, and with the sandbox off read, edit, write, grep, find, ls	Work in the Team directory (coding)
memory_write, memory_read, memory_search, memory_list	The Team’s shared Markdown memory
home_read, home_write, home_list, bootstrap_done	The Agent’s own documents
user_md_get, user_md_write	The Team’s USER.md
send_message, read_inbox, wait_for_reply	The mailbox, within Team Policy
web_fetch, web_search	Web research
browser_*	The managed browser
mcp__<server>__<tool>	Tools from MCP servers
image_generate	Image generation, when a model is set
deliver_file	Saves a workspace file as a result
ask_user	Asks you a question, when someone is watching

While a tool runs, its output streams into the chat; see live tool output.

Web research

• web_search finds sources. The daemon runs the search, so backend URLs and keys never reach the Agent.
• web_fetch reads a page as Markdown. It refuses private and loopback addresses, also after redirects, and caches pages for 15 minutes. With FIRECRAWL_API_KEY set, a page whose text comes out nearly empty is fetched again through Firecrawl.

BAZILION_WEB_SEARCH_ROUTE picks the search backend (Web search on /config/services, or bazilion config set BAZILION_WEB_SEARCH_ROUTE <value>):

Value	Backend
auto (default)	Brave when BRAVE_API_KEY is set, else SearXNG when SEARXNG_URL is set, else native
brave	The Brave Search API with BRAVE_API_KEY
searxng	Your SearXNG instance at SEARXNG_URL, with JSON output enabled
native	The search built into the Agent’s own model: OpenAI models with OPENAI_API_KEY, or ChatGPT models with the ChatGPT login. Other models get no web_search
off	No web_search tool

A backend that is chosen but not configured leaves Agents without web_search; nothing falls back to another one. A query has at most 512 characters and returns up to 10 results. web_fetch reads at most 3 MiB of a page and returns 20,000 characters by default.

Managed browser

Each Agent has its own browser: the Chrome, Brave, Edge or Chromium installed on the machine, running on a persistent profile, so cookies and logins carry over between turns. The Agent reads pages as accessibility snapshots with refs such as [ref=e5] and acts on them with browser_navigate, browser_snapshot, browser_click, browser_type, browser_fill_form, browser_select, browser_hover, browser_press_key, browser_go_back, browser_tabs, browser_take_screenshot, browser_console and browser_network.

The browser starts at the Agent’s first browser action and stops after BROWSER_IDLE_MS of inactivity. Settings are on /config/services (Browser Automation):

Key	Default
BROWSER_ENABLED	true	Give Agent turns the browser tools
BROWSER_EXECUTABLE_PATH	discovery	Browser binary; otherwise the first installed Chrome, Brave, Edge or Chromium
BROWSER_HEADLESS	true	false opens a visible window
BROWSER_ALLOW_PRIVATE_NETWORK	false	Turn the SSRF proxy off; local development only
BROWSER_IDLE_MS	900000	Stop a browser after 15 minutes idle
BROWSER_MAX_SESSIONS	4	Browsers running at once

All browser traffic goes through a proxy in the daemon that refuses loopback, private and link-local addresses. Downloads are refused and WebRTC and QUIC are off, so nothing goes around the proxy.

The profile lives in ~/.bazilion/browsers/<agent-id>/. It holds the Agent’s cookies and logins, is never mounted into the Docker sandbox and is left out of backups. Manage it on the Agent page (Managed browser card) or:

bazilion agent browser status <agent>   # never starts the browser
bazilion agent browser stop <agent>     # keeps the profile
bazilion agent browser reset <agent>    # deletes the profile; --yes skips the prompt

Archiving an Agent stops its browser; deleting it deletes the profile. Sites may still block the browser or show CAPTCHAs and logins; the Agent is told to stop and tell you.

Caution

BROWSER_ALLOW_PRIVATE_NETWORK=true lets pages reach your local network and file: URLs. Use it only for local development.

MCP servers

Tools from Model Context Protocol servers are offered to every turn as mcp__<server>__<tool>. Servers are configured once for the whole installation, on /config/mcp or with the CLI:

bazilion mcp add files --command npx --args "-y @modelcontextprotocol/server-filesystem /my/project"
bazilion mcp add docs --transport http --url https://mcp.example.com/mcp --token <bearer>
bazilion mcp list
bazilion mcp test <server-id>      # connect afresh and list the tools
bazilion mcp disable <server-id>   # or enable
bazilion mcp rm <server-id>

• stdio servers run as daemon child processes. They get the daemon’s environment with your provider keys, but never Bazilion’s own credentials. Treat them as trusted local programs.
• http servers use Streamable HTTP. The bearer token is stored encrypted and redirects are refused. A token passed with --token can land in your shell history; the web page avoids that.

A server starts on first use and is shared by all turns. One that fails to start or to list its tools within 10 seconds is skipped for that turn; bazilion mcp test shows why. Calls time out after 60 seconds and are never retried. Only tools are supported: no MCP resources, prompts, sampling or automatic OAuth sign-in.

Image generation

image_generate creates an image from a prompt and saves it as a result. It is off until you pick a model with BAZILION_IMAGE_MODEL (Content tools → Image generation on /config/services, or bazilion config set BAZILION_IMAGE_MODEL <value>):

Value	Account
off (default)	No image_generate tool
openai-codex:gpt-image-2	Your ChatGPT login; uses the subscription
openai:gpt-image-2	OPENAI_API_KEY; billed per image by OpenAI
openrouter:google/gemini-3.1-flash-image	OPENROUTER_API_KEY; billed by OpenRouter
openrouter:openai/gpt-image-2	OPENROUTER_API_KEY; billed by OpenRouter

At most four calls per turn, each waiting up to 180 seconds. Nothing is retried, and a call that failed after the request was sent may still have been billed. Set spending limits in the provider’s own account.

Files in and out

In. Attach files in the web composer (button, paste or drag and drop), in Telegram, or from the CLI. Images reach the model as images; any other file is saved to the Agent’s uploads/ directory and the Agent gets its path. Audio and video are stored as files, not model input.

bazilion agent chat <agent> --message "Describe this screenshot" --image ./screenshot.png
bazilion agent chat <agent> --message "Summarise this report" --file ./report.pdf

Out. deliver_file saves a workspace file (up to 25 MiB) as a result: a download card in the web chat, a document in the Agent’s Telegram topic, and a file in the current directory for bazilion agent chat. Screenshots and other tool images show inline in the chat and as Telegram photos.