Skip to main content
The ExuluTool constructor takes a single options object. This page documents every option, verified against the current @exulu/backend source.

Identity

id
string
required
Unique identifier. Used for database references — never change it after the tool has been used. Must start with a letter or underscore, contain only letters, digits, and underscores, and be at most 80 characters; treat 5 as the practical minimum.
name
string
required
Human-readable name shown in the platform UI and passed to the language model as the tool name. Agent tool-call names are derived from this value (sanitized).
description
string
required
Description surfaced to agents and administrators. Write it from the agent’s point of view — explain what the tool does and when to call it. Good descriptions improve tool-selection accuracy.
category
string
default:"\"default\""
Organizes tools in the admin UI. If omitted, defaults to "default".
Never change id after the tool has data in the database — references stored by ID will silently point at nothing.

Type

type
"function" | "web_search" | "skill" | "context"
required
Categorization hint used by the platform UI and agent runtime to label and filter tools. Does not change how execute is called.
"agent" and "context" types are managed by IMP internally and cannot be set via the public constructor. Passing "agent" throws immediately. Use ExuluTool.internal() only if you are building framework-level tooling.

Input schema

inputSchema
z.ZodType
Zod schema that defines and validates the tool’s input parameters. When omitted, defaults to an empty object schema (z.object({})). The schema is forwarded to the AI SDK and from there to the language model, so always add .describe() to every field.
Always add .describe() to every schema field. These descriptions are the only way the language model learns what each parameter is for — without them, tool-calling accuracy drops.

Admin-configurable params

config
object[]
required
Array of runtime parameters that platform administrators configure per agent in the platform UI. Pass an empty array when the tool needs no admin configuration.
config[].name
string
required
Parameter name used as the key in the tool’s config record.
config[].description
string
required
Description shown to the administrator in the platform UI.
config[].type
"boolean" | "string" | "number" | "variable" | "json"
required
The value type. "variable" means the value is looked up from the platform’s encrypted variables table — suitable for API keys and secrets. "json" accepts any JSON-serializable object.
config[].default
string | boolean | number | object
Default value surfaced in the admin UI before the administrator saves a custom value. Not applicable to "variable" type params (which must be set explicitly).

Approval

needsApproval
boolean
default:"true"
Whether the platform prompts the user to approve each tool call before execute runs. Defaults to true. Set false for read-only, low-risk tools where interruption is undesirable (for example, a price lookup or a knowledge search).

OAuth

oauth
ExuluOauthConfig
When set, IMP wraps execute with an authorization-code OAuth 2.0 flow. The tool only runs when a valid access token exists for the (provider, userId) pair. When no token is present, execute is skipped and the tool returns an authorization URL that the agent surfaces to the user. After the user completes the flow, IMP retries the call with a fresh token.
oauth.provider
string
Provider key shared across tools that use the same OAuth service (for example, "google"). Tools sharing a provider share tokens per user — one consent screen per provider per user instead of per tool. When omitted, defaults to the tool’s id.
oauth.authorizationUrl
string
required
The OAuth provider’s authorization endpoint.
oauth.tokenUrl
string
required
The OAuth provider’s token endpoint. Used server-side in the token exchange — never exposed to the browser.
oauth.clientId
string
required
OAuth client ID.
oauth.clientSecret
string
required
OAuth client secret. Used server-side only.
oauth.scopes
string[]
required
Scopes to request. Joined with spaces in the authorization URL.
oauth.pkce
boolean
default:"true"
Whether to use PKCE (S256 code challenge). Most modern providers support it; set false for providers that reject PKCE.
oauth.extraAuthParams
Record<string, string>
Extra query parameters appended to the authorization URL. For example, { access_type: "offline", prompt: "consent" } forces Google to issue a refresh token.
When oauth is declared, the framework injects an oauth field into the tool’s inputs on every authenticated call:

Execute function

execute
function
required
The function that implements the tool’s logic. Receives (inputs, options?) where inputs matches your inputSchema plus any framework-injected fields (for example oauth when an OAuth config is present). options carries AI-SDK context such as toolCallId and messages — ignore it if you don’t need it.
The return value can be a Promise or an AsyncGenerator yielding the same shape:
result
string
The main result returned to the agent. Non-string values should be JSON-stringified before returning — agents parse JSON automatically.
job
string
Job ID when the tool enqueued background work. Surfaced in the platform UI.
items
Item[]
Items from a context search, for context-retrieval tools.

Complete example

Next steps

API reference

Public properties, the execute() method, and ExuluTool.internal().

ExuluApp

Register the tool on the app.