Tool Use Overview

Kilo Code implements a sophisticated tool system that allows AI models to interact with your development environment in a controlled and secure manner. This document explains how tools work, when they're called, and how they're managed.

Core Concepts

Tool Groups

Tools are organized into logical groups based on their functionality:

Always Available Tools

Certain tools are accessible regardless of the current agent:

• question: Ask the user a clarifying question with selectable options
• task: Spawn a sub-agent session
• todowrite / todoread: Manage session task lists

Available Tools

Read Tools

These tools help Kilo Code understand your code and project:

• read - Reads file contents with line numbers
• glob - Finds files matching a glob pattern
• grep - Searches file contents with regex

Edit Tools

These tools help Kilo Code make changes to your code:

• edit - Makes precise text replacements in a file
• write - Creates new files or fully overwrites existing ones
• apply_patch - Applies unified diffs (used with certain models)

For multiple replacements in one file, Kilo uses repeated edit calls or a patch-style edit when the model supports it.

Execute Tools

These tools help Kilo Code run commands:

• bash - Runs shell commands with configurable timeout and working directory

Web Tools

These tools help Kilo Code access web content:

• webfetch - Fetches a URL and returns the content
• websearch - Searches the web

Web Search Availability

websearch is available automatically with the Kilo provider. For models from other providers it is off by default; enable it for all providers by setting web_search in kilo.jsonc:

{
  "web_search": true
}

In the VS Code extension, the same option lives under Settings → Web Tools → Web Search → Enable for All Providers. The KILO_ENABLE_EXA and KILO_ENABLE_PARALLEL environment flags also enable it.

Web Search Providers

websearch routes through the Exa or Parallel search providers. When the Exa provider is used and you are signed into Kilo, requests go through the Kilo proxy automatically — no separate Exa API key is required. Setting EXA_API_KEY uses your own Exa key instead. Exa searches return at most 10 results.

Set the KILO_WEBSEARCH_PROVIDER environment variable to force a provider:

Browser Tools

The VS Code extension has a built-in browser automation tool powered by Playwright MCP. Enable it in Settings → Web Tools → Browser Automation. When enabled, it registers an MCP server named kilo-playwright and exposes browser tools that follow the same permission model as all MCP tools.

The VS Code extension's experimental browser_open tool opens a local application in Agent Manager's Integrated Browser panel and returns a screenshot and diagnostics. Enable Integrated Browser under Settings > Experimental. It requires installed Chrome or compatible Playwright Chromium. It is independent from Playwright MCP.

The browser_open automation browser accepts HTTP URLs on localhost or 127.0.0.1 only, and blocks resources from other origins. See Browser previews for setup and element feedback.

This restriction is specific to browser_open, not Kilo's web access in general. Use websearch and webfetch to find and read public web pages. Browser tools from a separately configured MCP server can provide interactive web browsing according to that server's capabilities and permissions.

MCP Tools

MCP server tools are automatically available when an MCP server is connected. Tool names are namespaced as {server}_{tool}. See MCP Overview for details.

Workflow Tools

These tools help manage the conversation and task flow:

• question - Asks you a clarifying question with selectable options
• task - Spawns a sub-agent (child session)
• todowrite - Creates and updates a session TODO list
• todoread - Reads the current session TODO list
• plan - Enters structured planning mode
• skill - Invokes a reusable skill (Markdown instruction module)
• open_plan - Opens a saved plan for review in the VS Code extension
• agent_manager - Starts Agent Manager local or worktree sessions in VS Code
• board_post / board_read - Exchange messages on the Kilo Swarm board

Task tool

Full-tool primary agents can use task to delegate a focused subtask without switching to the deprecated orchestrator agent. A task child runs in a separate session and transcript, but it uses the same project directory or worktree as its parent. task does not create a git worktree.

Task children are non-interactive delegates. They cannot ask the end user a question directly, but they can use the tools allowed by their agent and session permissions. Their result is returned to the parent session, and the child transcript can be inspected from its task card in VS Code.

There are two execution modes:

For example, a primary agent can start independent background research with a call shaped like this:

{
  "description": "Audit API routes",
  "prompt": "Inspect the API routes and report authentication risks. Do not edit files.",
  "subagent_type": "explore",
  "background": true
}

Background subagents are available when the server exposes the background capability. Do not poll for progress or duplicate work in the same files. If Kilo returns a task_id after a failed or interrupted child, use it to resume that child when the current session and permissions allow it. A child can create more task children only when its configured depth and task permission allow it.

Kilo Swarm board tools

Kilo Swarm is a shared board for one main session and its task descendants, including nested descendants. It is on by default; turn it off in Settings > Agent Behaviour or set shared_agent_board to false in kilo.jsonc. The board is not shared by unrelated sessions, even when they use the same repository or worktree.

• board_post stores a concise material update for another participant. Use it for findings, questions, results, blockers, or corrections.
• board_read reads board messages explicitly. Use the cursor from the previous read for incremental reads instead of polling.
• Board activity notices are best-effort and do not prove that a recipient read or acted on a message.
• Board messages are coordination data, not user approval. Posting does not start, wake, assign, resume, stop, or cancel an agent.

See Kilo Swarm communication for how the board relates to background agents and Agent Manager sessions.

Agent Manager tool

The agent_manager tool is available in the VS Code extension. It creates visible Agent Manager sessions in either isolated worktree mode or shared local mode, and it can inspect and control existing sessions. Use it when you need separate branches, separate terminals, or multiple independent conversations. Use task when a child should remain part of the current session's task tree.

For existing sessions, call action: "list" to discover exact session, worktree, and section IDs before using prompt, stop, move, or answer. A targeted prompt is queued for a busy session and returns when accepted; it does not wait for the session to finish or broadcast to other sessions. See Starting and orchestrating sessions from chat for the full workflow.

Tool Calling Mechanism

When Tools Are Called

Tools are invoked under specific conditions:

1. Direct Task Requirements

   • When specific actions are needed to complete a task as decided by the LLM
   • In response to user requests
   • During automated workflows

2. Mode-Based Availability

   • Different modes enable different tool sets
   • Mode switches can trigger tool availability changes
   • Some tools are restricted to specific modes

3. Context-Dependent Calls

   • Based on the current state of the workspace
   • In response to system events
   • During error handling and recovery

Decision Process

The system uses a multi-step process to determine tool availability:

1. Mode Validation

   isToolAllowedForMode(
       tool: string,
       modeSlug: string,
       customModes: ModeConfig[],
       toolRequirements?: Record<string, boolean>,
       toolParams?: Record<string, any>
   )
   

2. Requirement Checking

   • System capability verification
   • Resource availability
   • Permission validation

3. Parameter Validation

   • Required parameter presence
   • Parameter type checking
   • Value validation

Technical Implementation

Tool Call Processing

1. Initialization

   • Tool name and parameters are validated
   • Mode compatibility is checked
   • Requirements are verified

2. Execution

   const toolCall = {
     type: "tool_call",
     name: chunk.name,
     arguments: chunk.input,
     callId: chunk.callId,
   }
   

3. Result Handling

   • Success/failure determination
   • Result formatting
   • Error handling

Security and Permissions

1. Access Control

   • File system restrictions
   • Command execution limitations
   • Network access controls

2. Validation Layers

   • Tool-specific validation
   • Mode-based restrictions
   • System-level checks

Mode Integration

Mode-Based Tool Access

Tools are made available based on the current mode:

• Code Mode: Full access to file system tools, code editing capabilities, command execution
• Ask Mode: Limited to reading tools, information gathering capabilities, no file system modifications
• Architect Mode: Design-focused tools, documentation capabilities, limited execution rights
• Custom Modes: Can be configured with specific tool access for specialized workflows

Mode Switching

1. Process

   • Current mode state preservation
   • Tool availability updates
   • Context switching

2. Impact on Tools

   • Tool set changes
   • Permission adjustments
   • Context preservation

Best Practices

Tool Usage Guidelines

1. Efficiency

   • Use the most specific tool for the task
   • Avoid redundant tool calls
   • Batch operations when possible

2. Security

   • Validate inputs before tool calls
   • Use minimum required permissions
   • Follow security best practices

3. Error Handling

   • Implement proper error checking
   • Provide meaningful error messages
   • Handle failures gracefully

Common Patterns

1. Information Gathering

   `question` → `read` → `grep`
   

2. Code Modification

   `read` → `edit` → final response
   

3. Task Management

   `task` → `bash` → final response
   

4. Progress Tracking

   `todowrite` → `bash` → `todowrite`
   

Error Handling and Recovery

Error Types

1. Tool-Specific Errors

   • Parameter validation failures
   • Execution errors
   • Resource access issues

2. System Errors

   • Permission denied
   • Resource unavailable
   • Network failures

3. Context Errors

   • Invalid mode for tool
   • Missing requirements
   • State inconsistencies

Recovery Strategies

1. Automatic Recovery

   • Retry mechanisms
   • Fallback options
   • State restoration

2. User Intervention

   • Error notifications
   • Recovery suggestions
   • Manual intervention options