Runtime built-in tools

These are the Claude-style built-in tools the internal Sketch agent runtime can run. They are not the same as the public /mcp tools — different surface, different names.

Internal surface

Grant these only through the agent runtime’s permission callback (canUseTool). They are not exposed on the public /mcp endpoint. See Permissions.

How the tools are scoped

“Built-in tools” means three overlapping lists, not one count. It’s worth keeping them apart:

• Guarded by canUseTool (9): Bash, Read, Write, Edit, Glob, Grep, WebSearch, WebFetch, Skill. This is the permission allowlist — the full set the callback will consider. Every tool below is one of these nine.
• Enabled by default (7): Bash, Read, Write, Edit, Glob, Grep, Skill. WebSearch and WebFetch are not on by default — grant them deliberately.
• Grantable in the team UI (8): Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch. The UI catalog intentionally excludes Skill.

On top of these built-ins, the runtime also loads Sketch MCP tools — indexed search and file content, plus tools such as chat history, file upload, audio transcription, and visual analysis. Those are a separate surface from the built-in tools documented below.

The nine tools below are the canUseTool allowlist, with the input each accepts.

Read

Read file contents.

{ file_path: string }

Returns file text. The path must be inside the user’s workspace or the configured Claude config directory. Direct reads of image attachments can be denied when visual analysis is enabled.

Write

Create or overwrite a file.

{ file_path: string; content: string }

Returns a write result from the runtime. The path must be inside the user’s workspace or the configured Claude config directory.

Edit

Edit an existing file.

{ file_path: string; old_string: string; new_string: string; replace_all?: boolean }

Returns an edit result from the runtime. The path must be inside the user’s workspace or the configured Claude config directory.

Bash

Run a shell command.

{ command: string; description?: string }

Returns stdout, stderr, and command status. Absolute paths outside the workspace are denied, with a narrow broker exception for CANVAS_CLI integration commands.

Glob

Find files by glob pattern.

{ pattern: string; path?: string }

Returns matching paths. File access is scoped to the workspace or the configured Claude config directory.

Grep

Search file contents.

{ pattern: string; path?: string; glob?: string; output_mode?: string }

Returns matching files or matching lines, depending on runtime options. File access is scoped to the workspace or the configured Claude config directory.

WebSearch

Search the public web.

{ query: string }

Returns web search results. Grant this only when public web access is acceptable for the agent’s role.

WebFetch

Fetch a public URL.

{ url: string; prompt?: string }

Returns fetched page content or a model-processed result, depending on the runtime. Grant this only when public URL fetching is acceptable for the agent’s role.

Skill

Load and run an installed skill.

{ skill: string }

Returns the skill execution result. Sketch records the skill name for telemetry when the input includes skill.