That way, you can audit or supervise the agent that writes the code, then expose the tool to be called by other agents without worrying about them.
A trusted role: a human, or an agent you supervise. Acts once per tool.
Can be untrusted, automated, or disposable. Acts many times, never reviewed.
A tool is one default-exported async function. It takes the call's JSON arguments and returns a JSON result. The manager publishes it with the exact access it is allowed to use, and nothing else.
export default async function weather(args) { const { city } = args; const res = await fetch(`https://api.weather.com/v1?city=${city}`); if (!res.ok) throw new Error(`upstream ${res.status}`); const data = await res.json(); return { city, tempC: data.temp_c, conditions: data.summary }; }
Published with: allow-net: ["api.weather.com:443"]. That one line is the tool's whole reach. No filesystem, no secrets, no other hosts, so a caller running it can only ever do this.
A caller can introspect and run tools via the tooldance CLI for auto-discoverability and dynamicism.
# list the tools this key can call, with descriptions $ tooldance tooldance weather Current weather for a city. Args: { city } tooldance geocode Geocode an address. Args: { address, country? } # named params -> JSON $ tooldance weather --city Toronto { "ok": true, "result": { "city": "Toronto", "tempC": 21, "conditions": "clear" } } # or a raw JSON body, and pull one field out with jq $ tooldance geocode '{"address": "1 Infinite Loop"}' | jq .result.lat 37.3318
Get the CLI: download tooldance.sh. It targets https://tool.dance by default, so you only set TOOLDANCE_KEY. See the caller guide for details.