Tool catalog

A reference list of the tool names LLM agents commonly expose, tagged with a default risk rating you can use as a starting point when you configure approval-rule patterns. @protect is the canonical entry point; every protected tool ships tool_name + args + kwargs on the wire, and ToolParameters approval rules read argument values directly out of kwargs by param_name.

The catalog covers three sources that NullRun sees in production:

• LangChain built-in toolkits (langchain-community — search, SQL, Gmail, Slack, GitHub, file system, vector stores, code interpreters)
• Anthropic / OpenAI hosted tools (OpenAI code interpreter, e2b sandbox, Riza JS exec)
• MCP servers (official + community — filesystem, git, github, postgres, sqlite, redis, puppeteer, memory, time)

Names are normalised to snake_case — that's the convention LangChain's docs recommend.

Risk rating:

Rating	Meaning
low	Read-only or reversible. Safe to call without a policy decision.
medium	Mutates external state but the change is reversible (issue created, draft email, S3 put).
high	Side effects you can't easily undo — files written or deleted, money moved, messages sent, code executed, infra changed. Mark with @protect and route through a human approval gate.

Search & retrieval

Tool	Risk
tavily_search, tavily_search_results_json	low
duckduckgo_search, duckduck_results_json	low
google_search, google_search_results_json	low
bing_search	low
brave_search	low
web_search, search_web	low
fetch, fetch_url	low
requests_get	low
wikipedia, arxiv, pubmed_search, semantic_scholar	low
news_search, search_news	low
requests_post, requests_put, requests_patch	medium
requests_delete	high

File system

Tool	Risk
read_file, file_read	low
list_directory, get_file_info, search_files, file_search	low
copy_file, create_directory	medium
write_file, file_write, create_file, edit_file	high
delete_file, file_delete, move_file	high

Code execution

Any tool that evaluates arbitrary code is high by definition — the blast radius is the entire host or sandbox the agent reaches.

python_repl, python_repl_ast, execute_python, code_interpreter (OpenAI built-in), e2b_code_interpreter, execute_javascript (Riza), execute_code, run_command, run_bash_command, terminal, bash, shell, repl — all high. Register a blanket pattern (see the starter list below) rather than enumerating them.

Databases

Tool	Risk
sql_db_schema, sql_db_query_checker, read_query (sqlite)	low
list_tables, describe_table	low
sql_db_query, query_sql_database, db_query	medium
redis_set	medium
execute_sql, run_sql, db_write, write_query, create_table	high
db_delete, redis_delete	high

Git & GitHub

Tool	Risk
git_status, git_diff, git_log	low
github_get_issue, github_get_pull_request, github_list_repos, github_get_file, github_search_code	low
github_create_issue, github_update_issue, github_close_issue, github_create_pull_request, github_create_repo, github_create_branch, git_add, git_checkout	medium
git_commit, github_merge_pull_request, github_push_files, github_delete_repo	high

Email & messaging

Tool	Risk
gmail_get_message, gmail_search, office365_search_emails, slack_get_channel, slack_get_messages	low
gmail_create_draft, office365_create_draft	medium
send_email, send_gmail, gmail_send_message, gmail_delete_message, office365_send_email, slack_send_message, slack_schedule_message, send_sms	high

Calendar & tasks

Tool	Risk
office365_search_events, get_calendar_events	low
office365_create_event, create_calendar_event, create_task, complete_task	medium
delete_calendar_event, delete_task	high

Cloud & infrastructure

Tool	Risk
s3_get_object, s3_list_objects, ec2_describe_instances, kubernetes_get	low
s3_put_object, docker_run	medium
s3_delete_object, s3_delete, ec2_start_instance, ec2_stop_instance, ec2_terminate_instance, lambda_invoke, kubernetes_apply, kubernetes_delete, docker_stop	high

Finance & payments

stripe_charge, stripe_create_customer, stripe_refund, stripe_create_payment, create_invoice, send_payment — all high. Reads only (get_balance_sheet, get_income_statement, get_cash_flow) drop to low.

Memory & vector stores

Tool	Risk
vector_store_search, memory_retrieve, search_nodes	low
vector_store_add, memory_store, create_entities, add_observations	medium
vector_store_delete, memory_delete, delete_entities	high

Browser & scraping

Tool	Risk
puppeteer_screenshot, browser_screenshot, scrape_page, extract_content	low
puppeteer_navigate, puppeteer_click, puppeteer_fill, browser_navigate, browser_click	medium
puppeteer_evaluate	high

Note

puppeteer_evaluate runs JS in the browser page context — treat it as high (cross-origin requests, DOM injection, credential theft). browser_navigate and browser_click are medium because they take actions on whatever URL the agent picks.

Recommended ToolBlock starter list

The SDK does not ship a built-in sensitive tool list (see Sensitive tools for the rationale). You express "this tool needs review" with a ToolBlock policy on the server, evaluated by the gate on every /gate call. The recommended starter patterns below map to that policy mechanism.

Create a ToolBlock policy in the dashboard under Policies → New policy (pick Tool block as the type). The dashboard renders the canonical tool name for every framework integration so you can match against the right string:

tool_block_policy.json

{
  "policies": [
    {
      "name": "Sensitive starter (matches the catalog)",
      "type": "ToolBlock",
      "scope": "Org",
      "config": {
        "tool_pattern": [
          "stripe.*", "charge", "send_payment", "create_invoice", "refund",
          "send_email", "send_gmail", "send_message", "send_sms",
          "slack_send.*", "office365_send.*",
          "delete_file", "file_delete", "write_file", "file_write",
          "execute_sql", "run_sql", "db_write", "db_delete",
          "write_query", "create_table",
          "s3_delete.*", "ec2_terminate.*", "ec2_stop.*",
          "lambda_invoke", "kubernetes_delete", "kubernetes_apply",
          "python_repl.*", "bash", "shell", "terminal",
          "execute_.*", "run_command", "run_bash_command",
          "git_commit", "github_merge.*", "github_push.*", "github_delete.*",
          "memory_delete", "vector_store_delete", "delete_entities"
        ]
      }
    }
  ]
}

Patterns are glob-matched against the tool name the agent requested, case-insensitively — "Stripe.Charge" will match "stripe.*".

For finer-grained rules (e.g. "block refunds over $500", "require approval for sends to non-@internal addresses"), use the typed BusinessImpact predicate (money_amount or tool_parameters) — see Human approval → typed predicates.

See also

• Sensitive tools — the policy- driven way to express "this tool needs review" (no built-in SDK list, all server-side via ToolBlock)
• Tool policies — glob patterns, per-tool block / allow rules
• Human approval — typed BusinessImpact predicates for narrower rules

Deep dive

Enforcement does not live in the catalog. The catalog is a starting point for rating tools; a tool is actually stopped by a ToolBlock policy evaluated on the server against the canonical tool name the agent requested. Keeping the decision server-side means a pattern can be tightened or relaxed without an SDK rollout. Because the gate classifies the name it receives and that classification is authoritative, treat the names here as documentation of what agents commonly call — the drift between this page and the names a particular agent actually sends is a real possibility, and the gate's view wins when they disagree.

The pattern language is deliberately narrow. * is the only metacharacter and matches any run of characters, including nothing at all, so send_* matches anything with that prefix and bash.* matches the bare bash as well as bash.foo and bash.foo.bar. A pattern with more than one star, such as *.drop_*, matches when its literal segments appear in order, which is why it catches s3.drop_table and db.drop_user but not s3.execute_drop. | separates alternatives inside one entry, and a bare literal matches exactly — never a substring. ? and ** are not supported and are matched as ordinary characters, so a pattern written as a regex habit matches less than intended. Each entry is capped at 4096 bytes, which is a bound on matcher work per gate call rather than a limit on how many patterns a policy may carry.

Matching is name-only. A pattern never inspects arguments, so bash.* blocks every bash call regardless of the command inside it, and a glob cannot express a condition on one argument. For command-level rules, the typed tool_parameters predicate reads an argument by param_name in the approval rule editor. Tool block is always hard, soft enforcement mode does not soften it, and a request that reaches the gate without a tool name while patterns are active is blocked rather than passed, so omitting the field is not a way around a policy. Blanket patterns such as python_repl.* and bash.* are the durable choice for execution tools: enumerating every framework's code runner goes stale as soon as a new server appears, while a prefix pattern keeps working.