◆ Sparround

Tools, toolsets and the terminal backend

All of the agent's power comes from tools. A tool is a function the model can call: terminal, read_file, patch, web_search, browser_navigate, memory, cronjob and dozens more. Tools are grouped into toolsets so you can switch them on and off in bundles rather than one by one.

ToolsetWhat is insideRisk level
`terminal`, `file``terminal`, `process`, `read_file`, `patch`High — makes real changes
`web`, `search``web_search`, `web_extract`Medium — external content enters the context
`browser``browser_navigate`, `browser_snapshot`, `browser_vision`Medium to high — it can log into sites
`memory`, `session_search`Writing memory and searching past sessionsLow
`cronjob`Creating scheduled tasksHigh — it runs itself in the future
`delegation`, `code_execution``delegate_task`, `execute_code`High
`safe`A set of harmless tools onlyLow

The second important decision is the terminal backend: where the agent executes commands. It is one configuration line that completely changes the blast radius:

  • local — on your machine, with your user rights
  • ssh — on a separate machine; the agent cannot modify its own code
  • docker — in a container, with hardened flags and resource limits
  • cloud sandboxes (modal, daytona, vercel_sandbox) — isolation that scales

The default is local — so from day one the agent carries your user rights.

A subtlety worth noticing: the dangerous-command check runs on the local and ssh backends, and is skipped on container backends — because there the container is the boundary. Moving to docker is therefore not "more control" but "a different kind of control": it stops asking for approval, but the damage stays inside the container.

Practice. Run the same task on two backends: local and docker. The task: "create report.txt in the current directory and write the date into it". Then find where the file was created in each case. Done means: for docker you can show that the file is not on the host but in the sandbox directory.

📚 Sources and documentation