§02 · Building agents

Tool

A managed connection (database, SSH, HTTP, Kubernetes) that agents and operators reach with the connection string injected.

A Tool declares an external system an agent (or a human via the CLI) can talk to. The connection string is injected at call time, and the credential never leaves the cluster.

Overview

A typed connection profile (host, port, database, credentials, TLS).
The CLI (exo tool connect/exec) and agents use it to run queries or commands.
An optional engine-native permission policy (spec.permissions).

Declare a Tool

The Tools page with the add-a-tool guide and per-integration YAML samples — The dashboard's Tools page walks the same flow: store the credential Secret, apply the Tool, sync. Each supported integration ships a ready-to-adapt tool.yaml.

●tool-postgres.yaml· yaml

1apiVersion: v1
2kind: Secret
3metadata:
4  name: analytics-pg-creds
5type: Opaque
6stringData:
7  password: REPLACE_ME
8---
9apiVersion: autonomic.sh/v1alpha1
10kind: Tool
11metadata:
12  name: analytics-postgres
13spec:
14  type: postgres
15  description: "Analytics Postgres read-replica"
16  tags:
17    - databases
18    - postgres
19    - readonly
20  probe: true
21  config:
22    hostname: pg-analytics.prod.internal
23    port: 5432
24    username: autonomic_ro
25    databaseName: analytics
26    sslMode: require
27    credentialsRef:
28      name: analytics-pg-creds
29      key: password

Integration types

Common values for spec.type include:

●spec.type· text

1ssh           postgres    mysql       mariadb     sqlserver   mongodb
2redis         clickhouse  kubernetes  http        snowflake   bigquery
3elasticsearch kafka       oracle      cockroachdb yugabytedb  redshift
4rabbitmq      aws         gcp         azure       custom

Plus managed and flavour variants (for example mongodb_atlas, documentdb, elasticache, and the *_aws_secrets_manager forms). The repo's autonomic/samples/tool-*.yaml has a worked example for each type, including tool-custom.yaml for arbitrary images.

Config & credentials

spec.config carries the connection details and a credentialsRef to a Secret. The reconciler reads the secret and, when spec.probe: true, runs a type-specific connectivity check before marking the Tool Ready. custom tools point at their own container image.

Integrations

Every supported type ships a minimal, valid Tool manifest, the same samples the dashboard's add-a-tool wizard provides. Each card maps to a spec.type above — filter by category or search, then open one for a ready-to-adapt sample: store the credential in a Secret, set the connection details, and kubectl apply.

34 integrations

Previous · Building agentsSchedules Next · Building agents Skills