ExuluTool constructor takes a single options object. This page documents every option, verified against the current @exulu/backend source.
Identity
string
required
Unique identifier. Used for database references — never change it after the tool has been used. Must start with a letter or underscore, contain only letters, digits, and underscores, and be at most 80 characters; treat 5 as the practical minimum.
string
required
Human-readable name shown in the platform UI and passed to the language model as the tool name. Agent tool-call names are derived from this value (sanitized).
string
required
Description surfaced to agents and administrators. Write it from the agent’s point of view — explain what the tool does and when to call it. Good descriptions improve tool-selection accuracy.
string
default:"\"default\""
Organizes tools in the admin UI. If omitted, defaults to
"default".Type
"function" | "web_search" | "skill" | "context"
required
Categorization hint used by the platform UI and agent runtime to label and filter tools. Does not change how
execute is called."agent" and "context" types are managed by IMP internally and cannot be set via the public constructor. Passing "agent" throws immediately. Use ExuluTool.internal() only if you are building framework-level tooling.Input schema
z.ZodType
Zod schema that defines and validates the tool’s input parameters. When omitted, defaults to an empty object schema (
z.object({})). The schema is forwarded to the AI SDK and from there to the language model, so always add .describe() to every field.Always add
.describe() to every schema field. These descriptions are the only way the language model learns what each parameter is for — without them, tool-calling accuracy drops.Admin-configurable params
object[]
required
Array of runtime parameters that platform administrators configure per agent in the platform UI. Pass an empty array when the tool needs no admin configuration.
string
required
Parameter name used as the key in the tool’s config record.
string
required
Description shown to the administrator in the platform UI.
"boolean" | "string" | "number" | "variable" | "json"
required
The value type.
"variable" means the value is looked up from the platform’s encrypted variables table — suitable for API keys and secrets. "json" accepts any JSON-serializable object; at hydration time, object values are passed through unchanged and string values are JSON.parsed — if parsing fails the value falls back to undefined and IMP logs a warning.string | boolean | number | object
Default value surfaced in the admin UI before the administrator saves a custom value. Not applicable to
"variable" type params (which must be set explicitly).Approval
boolean
default:"true"
Whether the platform prompts the user to approve each tool call before
execute runs. Defaults to true. Set false for read-only, low-risk tools where interruption is undesirable (for example, a price lookup or a knowledge search).Authentication
Breaking (July 2026): the
oauth constructor option was renamed authentication and requires an explicit authType: "oauth" tag. Update your tool definitions accordingly.ExuluAuthConfig
When set, IMP wraps Both arms require the
execute with an authentication flow. ExuluAuthConfig is a discriminated union tagged by authType:BACKEND environment variable (the backend’s public base URL) to build redirect and credential-submit URLs. Missing BACKEND is detected at construction time and throws immediately.OAuth tools tutorial
Step-by-step guide to building an OAuth-connected tool.
User credential tools tutorial
Step-by-step guide to building a tool with user-supplied credentials.
OAuth (authType: "oauth")
ExuluOauthConfig
Configures an authorization-code OAuth 2.0 flow. The tool only runs when a valid access token exists for the
(provider, userId) pair. When no token is present, execute is skipped and the tool returns a structured oauth: { authorizationUrl } response that IMP’s chat UI renders as a Connect card."oauth"
required
Discriminant tag. Must be
"oauth".string
Provider key shared across tools that use the same OAuth service (for example,
"google"). Tools sharing a provider share tokens per user — one consent screen per provider per user instead of per tool. When omitted, defaults to the tool’s id.string
required
The OAuth provider’s authorization endpoint.
string
required
The OAuth provider’s token endpoint. Used server-side in the token exchange — never exposed to the browser.
string
required
OAuth client ID.
string
required
OAuth client secret. Used server-side only — never exposed to the browser or the model.
string[]
required
Scopes to request. Joined with spaces in the authorization URL.
boolean
default:"true"
Whether to use PKCE (S256 code challenge). Most modern providers support it; set
false for providers that reject PKCE.Record<string, string>
Extra query parameters appended to the authorization URL. For example,
{ access_type: "offline", prompt: "consent" } forces Google to issue a refresh token.authentication is declared with authType: "oauth", IMP injects an oauth field into the tool’s inputs on every authenticated call. Values are injected server-side and never transit the model.
User credentials (authType: "user_credentials")
ExuluUserCredentialsConfig
Prompts the user to supply a set of named credentials (for example an API key and a workspace URL) the first time the tool is called. IMP stores them encrypted per
(provider, userId) and injects them on subsequent calls. Tools sharing the same provider share one stored credential set per user."user_credentials"
required
Discriminant tag. Must be
"user_credentials".string
required
Identifier for the credential set (for example,
"jira" or "my-erp"). Tools sharing a provider share one stored credential set per user — one prompt per provider per user instead of per tool.CredentialField[]
required
The credential fields to collect. Must contain at least one entry; field names must be unique, non-empty, and have no leading or trailing whitespace. Each field’s
type must be "text" or "password".(values: Record<string, string>) => Promise<void>
Optional server-side hook called after the user submits credentials. Throw any error to reject the submission and surface the message to the user. When omitted, submitted values are stored without server-side validation.
authentication is declared with authType: "user_credentials", IMP injects a credentials field into the tool’s inputs on every authenticated call. Values are injected server-side and never transit the model.
CredentialInvalidError — if execute determines that the stored credentials are no longer valid (for example, the upstream API returns 401), throw CredentialInvalidError(provider, reason?). IMP will delete the stale stored row and re-prompt the user in the same turn.
Construction-time validation
BothauthType arms validate their configuration when the ExuluTool is constructed (before any request is handled). The following are rejected with a thrown Error at startup:
- OAuth: missing or blank
authorizationUrl,tokenUrl,clientId,clientSecret;scopesnot an array;providerwith leading/trailing whitespace; missingBACKENDenv var. - User credentials: blank or whitespace
provider; emptyfieldsarray; duplicate field names; fieldnamewith leading/trailing whitespace; fieldtypeother than"text"or"password"; missingBACKENDenv var.
Execute function
function
required
The function that implements the tool’s logic. Receives
(inputs, options?) where inputs matches your inputSchema plus any framework-injected fields (for example oauth when an OAuth authentication config is present, or credentials when a user-credentials config is present). options carries AI-SDK context such as toolCallId and messages — ignore it if you don’t need it.Promise or an AsyncGenerator yielding the same shape:
string
The main result returned to the agent. Non-string values should be JSON-stringified before returning — agents parse JSON automatically.
string
Job ID when the tool enqueued background work. Surfaced in the platform UI.
Item[]
Items from a context search, for context-retrieval tools.
Complete example
Next steps
API reference
Public properties, the execute() method, and ExuluTool.internal().
ExuluApp
Register the tool on the app.