Tools
The browser and data tools the AI can call during a chat — grouped by category, with a four-tier risk model and human-in-the-loop approval.
Tools are the actions Cordy's assistant can take in your browser during a conversation — reading the current page, listing your tabs, searching bookmarks, opening a URL. The model decides when a tool would help, calls it, and uses the result to answer. Anything that changes your browser is gated behind your approval.
Overview
When you ask something that needs live browser data ("what's on this page?", "find my tab about invoices"), the assistant calls the relevant tool, and a compact tool-call row appears in the transcript showing what it did. Read-only public actions run automatically; sensitive, write, or destructive actions pause for your confirmation first.
Turning tools on and off
Tools are controlled in Settings → AI Tools (and the Agent & browser tools section). The Enable browser tools switch lets the assistant use them; turn it off for a pure chat assistant with no browser access at all. The settings page lists every tool grouped by category, with its risk level.
The tools
Cordy currently exposes thirteen tools, grouped by category:
Browser
| Tool | What it does | Risk |
|---|---|---|
getCurrentTab | Read the title and URL of the current tab | Public read |
getTabContent | Read the visible text of the current page | Public read |
Tabs
| Tool | What it does | Risk |
|---|---|---|
listOpenTabs | List the currently open tabs | Sensitive read |
openUrl | Open a URL in a new tab (http/https only) | Write |
createTab | Create a new blank tab | Write |
switchToTab | Switch to an already-open tab | Write |
closeTab | Close a specific tab | Destructive |
Bookmarks & history
| Tool | What it does | Risk |
|---|---|---|
searchBookmarks | Search your bookmarks by keyword | Sensitive read |
searchHistory | Search your browsing history by keyword | Sensitive read |
Data
| Tool | What it does | Risk |
|---|---|---|
cleanSiteData | Clear cache, cookies, and storage for a site | Destructive |
Conversations
| Tool | What it does | Risk |
|---|---|---|
searchConversations | Search your past Cordy conversations | Public read |
listConversations | List recent conversations | Public read |
getConversationMessages | Read the full messages of a past conversation | Public read |
Risk tiers and approval
Every tool is assigned one of four risk tiers, which decides whether it needs your OK:
- Public read — runs automatically, no prompt (reading the current page, searching your own conversations).
- Sensitive read and Write — pause for an approval card. You can choose Approve and remember for this session to stop being asked for that tool until you close the session.
- Destructive (
closeTab,cleanSiteData) — require approval every single time; there's no "remember," by design.
Cordy is fail-closed: any tool without an explicit policy is treated as destructive. It never errs toward running something unapproved.
Approving an action in chat
When the assistant wants to run a gated tool, an approval card appears on its message: "Allow this browser action?" Review it and choose Approve, Deny, or (where allowed) Approve and remember for this session. Denied actions are clearly marked as denied — the assistant is told it didn't run, rather than being allowed to pretend it succeeded. While a tool is awaiting your decision, the composer reminds you to respond before continuing.
Local models get a smaller, read-only set
Tool support depends on the model:
- Cloud models with tool-calling support get the full set above, with the approval flow.
- Local, on-device models are deliberately limited to the five public-read tools only — the write, sensitive, and destructive tools are withheld entirely, because the local path has no approval UI. The principle is simple: withhold a capability rather than run it unapproved.
- Chrome's built-in Gemini Nano does not support tool calling at all.
What the tools can't do
- There is no web-search tool. The assistant can open a URL and read the current page, but it can't query a search engine on its own. To search the web, use the command palette's
/web-search, which opens your default engine. - Tools can't act on your browser without going through the risk model above.
Agents
Beyond one-shot tools, Cordy has agents — multi-step AI tasks you trigger in natural language. The one that ships today is bookmark classification, which batch-organizes your bookmarks (see Bookmarks). Agents appear under Settings → AI Tools → Agents.
Privacy
Tools run locally in your browser. Any data a tool returns (page text, tab titles, bookmarks) is treated as untrusted context and only reaches your provider as part of a message you send. Nothing is collected in the background, and destructive actions always need your explicit approval. See Privacy & permissions.