4.3 KiB
The tools
Twenty-two, in five groups. All are on by default; turn any off in
../configs/tools.toml, which removes them from the spec entirely
rather than hiding them.
The Setup column is empty when a tool needs nothing beyond docker compose up -d.
Web and research
| Tool | What it does | Setup |
|---|---|---|
web_search |
Searches the web through SearXNG and returns titles, URLs and snippets | searxng |
fetch_page |
Reads a web page or PDF as text, windowed so a 200-page manual cannot blow the context | |
wikipedia_lookup |
Reads a Wikipedia article | contact — 403s without it |
search_stackexchange |
Searches Stack Exchange for an answer, with the accepted one marked | stackexchange (optional) |
search_papers |
Searches academic papers through OpenAlex, with citation lines ready to copy | contact (optional) |
IT and reference
| Tool | What it does | Setup |
|---|---|---|
lookup_rfc |
Reads or searches IETF RFCs | |
lookup_cve |
Looks up a CVE or searches vulnerabilities; CIRCL first, NVD for CVSS detail | nvd (optional) |
read_man_page |
Reads a Linux manual page | |
lookup_package |
Current version of a package across PyPI, npm, crates.io, Docker Hub, GitHub and Debian | github-token (optional) |
Networking
dns_lookup, inspect_tls, http_headers and lookup_ip_or_asn reach out and touch a
host the user named, so they share a per-user hourly budget
(OWUITOOLS_PROBE_RATE_PER_HOUR, default 30). The others are offline.
| Tool | What it does |
|---|---|
subnet_calc |
Subnet arithmetic, IPv4 and IPv6, including splitting a prefix |
dns_lookup |
DNS records over DoH |
inspect_tls |
Reads a certificate: issuer, expiry, SANs, chain |
http_headers |
Response headers, redirect chain, security headers |
lookup_ip_or_asn |
RDAP and RIPEstat: who owns an address, an ASN or a domain |
network_reference |
MAC vendor, port number and HTTP status, from datasets baked in at build time |
Electronics
All four are deterministic arithmetic with no network access. If you never do electronics, these are the cheapest schemas to reclaim.
| Tool | What it does |
|---|---|
ohms_law_power |
Solves Ohm's law and power from any two of V, I, R, P |
component_calc |
Resistor colour codes, E-series, RC and LC, dividers, series/parallel |
pcb_calc |
Trace width, microstrip impedance, via current |
wiring_calc |
AWG properties, voltage drop, LED resistors, decibels, battery life |
find_datasheet |
Finds a component datasheet — needs searxng |
Code execution
| Tool | What it does | Setup |
|---|---|---|
matlab_run |
Runs MATLAB/Octave code in a network-less sandbox and reports output, errors and MATLAB compatibility | octave |
vm_agent |
Hands a task to a second model driving a real throwaway machine | vm-agent |
Why every tool is a POST with a body
Open WebUI's OpenAPI converter flattens query parameters to {type, description} — enums
become prose and defaults vanish — while a request body is $ref-resolved with its enums,
defaults and nesting intact. So every tool takes a body, and no tool mixes body and query
parameters.
Two other constraints from the same converter, worth knowing if you add a tool:
- The tool name the model sees is the
operationId, and an operation without one is silently dropped from the spec. - The description the model reads is the docstring. Keep it terse: it is paid on every turn. The reasoning belongs in the system prompt, not in the tool.
Why failures come back as HTTP 200
Open WebUI turns any status ≥ 400 into {"error": "HTTP error 502: ..."} and marks the call
failed. For a genuine fault that is right. But "that page is behind a login" and "the search
returned nothing" are findings, not faults — and they are exactly the findings that
should stop the model inventing an answer.
Handed back as prose in a successful call, they get acted on. Handed back as an error, they
read as something to retry. 401 and 429 stay real status codes; those are about the
caller, not the question.