# AI agent tools and skills | Oxagen

Source: https://oxagen.sh/product/mandates/tools-and-skills

# Tools and skills

Every new MCP server your team adds shows up in every agent's tool list, with its own token pasted into a config file. In Oxagen, a server reaches agents through a reviewed change, each agent gets a toolbelt, and a rule answers every call before Oxagen sends it with the credential it holds.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the product overview](https://oxagen.sh/product)

01

## Tool catalog

Equip supported agents from one shared toolbelt. An owner or admin decides which servers and tools the workspace makes available, and each agent sees only the toolbelt assigned to it. Being in the catalog grants no agent permission: its role and your rules still decide which calls go through.

02

## Toolbelts

A toolbelt is a named set of tools grouped by the server they came from. The All tools belt holds every tool an owner or admin made available. A custom belt adds or removes a whole server, or turns one tool on or off.

Assigning a toolbelt to an agent writes a new version of the agent and keeps its identity, roles, and grants. The toolbelt decides which tools the agent sees. Its role and your rules decide which calls go through.

A review agent's custom toolbelt: the GitHub server included with its merge tool turned off, the Linear server included, and a deploy server left out.

One agent's toolbelt

Toolbelt

Code review

Agent

review-agent

github

Included with merge\_pull\_request offDone

linear

IncludedDone

deploy

Not includedBlocked

Illustrative Fields from the get\_toolbelt contract

03

## MCP servers

Each server is a folder in your workspace's steering repository, and nothing reaches an agent until its pull request merges. Every call to a served tool takes these steps.

1.  **Off switches**
    
    A switch on the tool, the server, the connection, or the operator stops the call.
    
2.  **Rules**
    
    The workspace's rules allow the call, deny it, or hold it for a person. Oxagen sends a held call only when the agent calls the tool again after the approval.
    
3.  **Credential**
    
    Oxagen adds the credential the server names and sends the call. The agent does not receive the credential.
    
4.  **Record**
    
    Oxagen records the call as a governed action with its outcome: ran, denied, waited for approval, or failed.
    

04

## Servers in a private network

A server inside your network reaches Oxagen through a relay you run in that network. The relay makes one outbound connection, so the server needs no public address. A relay carries a request body of at most 8 MiB.

The relay still needs that outbound connection to Oxagen. It does not let agents work while disconnected from Oxagen.

05

## Skills

Skills are instruction files an agent loads for a task. Oxagen counts which skills your workspace's runs loaded, how many runs loaded each one, and how many of those runs ended in a merged pull request.

The count covers Claude Code's Skill tool and a read of a skill's SKILL.md file in Claude Code, Cursor, or Stella. Codex reads skills through its shell, so its loads are not counted.

## Related pages

*   [
    
    ### Mandates
    
    The terms an agent works under
    
    ](https://oxagen.sh/product/mandates)

## Product walkthrough

Review a toolbelt and the permissions behind each requested tool.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the product overview](https://oxagen.sh/product)