Skip to main content
An agent that runs on Claude Code, Codex or OpenCode starts with two sets of built-in tools besides the skills you add to it:
  • Harness built-in tools: the coding CLI’s own shell, file read, write and edit, search, web fetch and search, sub-agents and plan mode.
  • xpander built-in tools: what xpander gives every agent, such as memory, knowledge base search, web search, email, schedules, tasks to other agents, secrets, Slack, chat cards, screenshots, the browser, live surfaces, the services desk and tell_user progress updates.
Both are on by default. Turn one or both off for an agent that should act only through what you attached to it, for example in an environment where the agent must not run shell commands or reach the web on its own. What you attached stays available whichever switch is off: skills (API and MCP connectors), custom functions, workflows and sub-agents.

​
Set it in Agent settings

Open Agent settings from the gear in the conversation header, then Advanced > Tools:
  1. Switch off Harness built-in tools to remove the CLI’s own shell, file and web commands. A note under the switch confirms that the agent can’t run commands or read and write files, and names what it still works through.
  2. Switch off xpander built-in tools to remove xpander’s.
Advanced pane of Agent settings with the Harness built-in tools and xpander built-in tools switches both on

Agent settings, Advanced, with both built-in tools switches on. Shown with sample data.

Advanced pane of Agent settings with Harness built-in tools off, the note under it, and xpander built-in tools on

Harness built-in tools switched off: the note under it says what the agent still works through. Shown with sample data.

The switches show only on agents that run on a harness (Claude Code, Codex or OpenCode). A change applies to conversations started after it; see Which value a turn uses.

​
What each switch removes

The agent’s instructions follow the switches: with a set off, the agent is not told about what it no longer has.

​
Codex and Harness built-in tools

With Harness built-in tools off, Codex keeps request_user_input and its read-only MCP resource helpers (list_mcp_resources, list_mcp_resource_templates, read_mcp_resource). Codex has no switch for them. The helpers only read from the MCP connectors already attached to the agent; nobody answers request_user_input during a run. Shell, file edits (apply_patch), web search, code mode and Codex sub-agents are removed. Claude Code and OpenCode keep none of their own built-in tools.

​
Set it over the API

The agent setting is harness_settings.builtin_tools. Each half is {"enabled": true} or {"enabled": false}; a missing half is on. Send it with Update Agent and deploy=true so it applies right away:
An update that names one half keeps the other one as stored, and an update to another harness setting keeps builtin_tools as it is. This turns xpander built-in tools back on and leaves the harness half alone:

​
Override for one call

The invoke endpoints (/invoke, /invoke/async and /invoke/stream) take builtin_tools in the body with the same shape. It overrides the agent setting for that call, in either direction, and either half can be named alone; the agent setting itself does not change. This turns harness built-in tools on for one run of an agent whose setting has them off:
On an agent that does not run on a harness, builtin_tools is ignored.

​
See what a run used

GET /v1/tasks/{task_id} returns the value the run resolved, with both halves filled in:

​
Which value a turn uses

Each half is resolved on its own, first match wins:
  1. The call’s builtin_tools.
  2. The conversation’s value.
  3. The agent’s harness_settings.builtin_tools.
  4. On.
A conversation keeps the value resolved on its first message. Changing the agent setting, in Agent settings or over the API, applies to conversations started after the change; a running conversation keeps its value until a call overrides it. A call that continues a conversation (with its id) and names a half changes that half for the conversation from then on, the way it would have been set on the first message; the half it does not name keeps the conversation’s value.