Tools
The browser and data tools the AI can call during a chat — grouped by category, with a four-tier risk model and human-in-the-loop approval.
Tools are the actions Cordy's assistant can take in your browser during a conversation — reading the current page, listing your tabs, searching bookmarks, opening a URL. The model decides when a tool would help, calls it, and uses the result to answer. Anything that changes your browser is gated behind your approval.
Overview
When you ask something that needs live browser data ("what's on this page?", "find my tab about invoices"), the assistant calls the relevant tool, and a compact tool-call row appears in the transcript showing what it did. Read-only public actions run automatically; sensitive, write, or destructive actions pause for your confirmation first.
Turning tools on and off
Tools are controlled in Settings → AI Tools. The Enable browser tools switch lets the assistant use them; turn it off for chat without browser-tool access. The settings page lists tools by category and risk level.
The tools
Cordy currently exposes thirteen tools, grouped by category:
Browser
| Tool | What it does | Risk |
|---|---|---|
getCurrentTab | Read the title and URL of the current tab | Public read |
getTabContent | Read the visible text of the current page | Public read |
Tabs
| Tool | What it does | Risk |
|---|---|---|
listOpenTabs | List the currently open tabs | Sensitive read |
openUrl | Open a URL in a new tab (http/https only) | Write |
createTab | Create a new blank tab | Write |
switchToTab | Switch to an already-open tab | Write |
closeTab | Close a specific tab | Destructive |
Bookmarks & history
| Tool | What it does | Risk |
|---|---|---|
searchBookmarks | Search your bookmarks by keyword | Sensitive read |
searchHistory | Search your browsing history by keyword | Sensitive read |
Data
| Tool | What it does | Risk |
|---|---|---|
cleanSiteData | Clear cache, cookies, and storage for a site | Destructive |
Conversations
| Tool | What it does | Risk |
|---|---|---|
searchConversations | Search your past Cordy conversations | Public read |
listConversations | List recent conversations | Public read |
getConversationMessages | Read the full messages of a past conversation | Public read |
Risk tiers and approval
Every tool is assigned one of four risk tiers, which decides whether it needs your OK:
- Public read — runs automatically, no prompt (reading the current page, searching your own conversations).
- Sensitive read and Write — pause for an approval card. You can choose Approve and remember for this session to stop being asked for that tool until you close the session.
- Destructive (
closeTab,cleanSiteData) — require approval every single time; there's no "remember," by design.
Cordy is fail-closed: any tool without an explicit policy is treated as destructive. It never errs toward running something unapproved.
Approving an action in chat
When the assistant wants to run a gated tool, an approval card appears on its message: "Allow this browser action?" Review it and choose Approve, Deny, or (where allowed) Approve and remember for this session. Denied actions are clearly marked as denied — the assistant is told it didn't run, rather than being allowed to pretend it succeeded. While a tool is awaiting your decision, the composer reminds you to respond before continuing.
Tool support by local route
Tool support depends on the model:
- Cloud models with tool-calling support get the full set above, with the approval flow.
- Browser-local generation, including Chrome's built-in model and in-browser Gemma, does not receive tools.
- A local-native chat model that supports OpenAI-compatible tool calling receives the normal tool set and uses the same approval cards as cloud chat.
What the tools can't do
- There is no web-search tool. The assistant can open a URL and read the current page, but it can't query a search engine on its own. To search the web, use the command palette's
/web-search, which opens your default engine. - Tools can't act on your browser without going through the risk model above.
Privacy
Tools run locally in your browser. Any data a tool returns (page text, tab titles, bookmarks) is treated as untrusted context and only reaches your provider as part of a message you send. Nothing is collected in the background, and destructive actions always need your explicit approval. See Privacy & permissions.