The Coding Agent Tool Surface Index

The verdicts below are our recommended posture, argued in Which Claude Code tools should you deny out of the box?: allow the core loop, deny the outward tail until first need, gate the irreversible. ACP itself starts in audit mode, so nothing is denied until you apply a posture.

Every agent harness that speaks a modern LLM API sends its full tool list in every request. The model can’t call a tool it can’t see, so an agent’s real capabilities are in its traffic, not its documentation. This page lists those tools per client, captured from live requests.

Tool lists change. Harnesses load tools mid-session, MCP servers connect, and updates add new families. When a client’s declaration changes, this page is due an update. The counts here are as of the 2026-07 captures, so treat them as a snapshot of that version.

At a glance

The two harnesses take different approaches. Codex ships a tight execution core and pushes everything else to plugins. Claude Code ships a broad standing surface, including families most users have never watched it invoke.

Claude Code: 76 tools declared

Captured from a live session of Claude Code 2.1.x with the Chrome extension and claude.ai connectors available. There are three layers.

Core harness: 37 tools

The coding loop and its scaffolding, grouped by blast radius, with our recommended verdict. ACP itself starts in audit mode, so nothing is denied until you apply a posture.

The live capture counted 76 declared at session start. The enumeration above includes two tools that registered later in the session. The Recommended column is a suggested posture, not ACP's default.

Browser control: 21 tools (when the Chrome extension is connected)

These cover navigate, computer (click, type, screenshot), form_input, file_upload, javascript_tool, read_page, get_page_text, read_console_messages, read_network_requests, tab management, shortcuts, GIF recording, and more.

This is the largest single grant in the list. These tools act as the user, in the user’s logged-in browser. A form_input plus javascript_tool pair can take authenticated action on any site the user has a session with. Recommended: ASK. Reads such as screenshots and page text are reasonable to allow. Anything that clicks, types, uploads, or runs JavaScript deserves a human gate.

Connectors: 20 tools (claude.ai MCP servers)

These handle OAuth flows and actions for Gmail, Google Calendar, Google Drive, Notion, Canva, job boards, and custom servers. Each authenticate pair is the door to a whole account. Recommended: ASK, case by case. A connector your workflow doesn’t use is risk with no benefit.

OpenAI Codex CLI: 17 tools declared

Captured from Codex 0.142.x via the Responses API. It has a deliberately tighter core:

Two things to notice. First, there is no first-party send, schedule, or publish family. Codex’s outward surface arrives via plugins, so request_plugin_install is the tool to watch. It isn’t dangerous itself, but it is how the surface grows. Second, exec_command and write_stdin give a full interactive shell, so the sandbox carries all the weight.

How to capture your own

You don’t need special tooling. Dump one request body from your harness (a logging proxy or mitmproxy session will do), list the tools array, and you have your real surface. Diff it across sessions and you have drift detection.

ACP records each declaration and diffs changes, and the console lets you set any tool to allow, flag, deny or ask. One command gets you that view for your own agents:

curl -sf https://agenticcontrolplane.com/install.sh | bash

The full walkthrough of what that install gives you (the per-session bill, the cost X-ray, the control table) is on ACP for coding agents.

Quick answers

Postures in depth

The tables above give a verdict per family. These pieces argue the verdicts, family by family, with the incidents behind them.

Setting the policy

• Which Claude Code tools should you deny out of the box?: the full argument behind this page’s verdicts, from blast radius
• AI agent tool allowlists: deny by default, scope per task, audit everything: the reference page, with Claude Code, Codex, and MCP config
• Claude Code’s deny list can be bypassed: where client-side rules stop holding, and what a real boundary looks like
• --dangerously-skip-permissions disables every control hook: the documented opt-out, including of our own hook
• How to govern AI agent tool calls (before they run): the deterministic gate, and why it needs narrow typed tools
• Agent access control: least-privilege scoped tools: why the narrow surface is the precondition for everything else
• When to use a control plane, and when to reach for a sandbox: where each one stops

Per-client setup

• Log and control every Claude Code tool call in 60 seconds: the Claude Code install, end to end
• Codex CLI hooks: PreToolUse & PostToolUse reference: what Codex’s hook surface covers, and what it doesn’t
• Claude Code cost tracking: token counters vs per-action attribution: pricing the surface you just captured

The incidents, one family at a time, in the Stop Your Agent From… series:

• running rm -rf · deleting your production database · touching files outside your project · rewriting git history
• leaking .env secrets · leaking PII through tool calls · being weaponized by a malicious package
• burning your API budget · making payments without approval · dropping a Kubernetes namespace · escalating IAM permissions

All the first-party numbers behind these pages (the captures, the metered calls, the benchmark) live on the data page, with method and provenance for each.

Captures dated 2026-07. Surfaces change with client versions. If you spot a drift we haven’t indexed yet, tell us.

curl -fsSL https://agenticcontrolplane.com/install.sh | bash

irm https://agenticcontrolplane.com/install.ps1 | iex