FilesystemTools includes attach_files(paths), which lets the model select images or documents under the session base_dir and add them to its conversation as real attachments. The same path-containment checks used by the other filesystem tools apply.

PythonTools executes arbitrary code. It has a timeout and per-session working directory, but is not a security sandbox; use a container or VM for untrusted code.

BraveSearchTools reads its token from BRAVE_SEARCH_API_KEY and exposes a web_search tool. The token is not passed to the model.