- Install a tool skill —
/add-tavily-tool,/add-ollama-tool, and friends. Each is a SKILL.md workflow that wires an MCP server into the agent groups you choose, with credentials handled by the OneCLI Agent Vault where the service needs them. - Bring your own MCP server — register any stdio or remote Streamable HTTP MCP server in a group’s container config with one
nclcommand. No skill required.
nanoclaw MCP server (messaging, sub-agents, self-modification — see Agent MCP tools), and web access via the agent-browser container skill (below).
Landed here looking for Gmail? Gmail was a channel in v1 — it polled your inbox and triggered the agent on new emails. v2 later carried a
/add-gmail-tool MCP skill (read, search, send — no inbound trigger), but upstream removed it along with /add-gcal-tool. There is currently no Gmail or Google Calendar integration on trunk. You can still wire any Gmail MCP server yourself — see Bring your own MCP server.Web search with Tavily
/add-tavily-tool gives the agent Tavily Search and Extract with no API key. The skill pins the mcp-remote bridge in the container manifest (container/cli-tools.json) and registers Tavily per group with ncl groups config add-mcp-server, using Tavily’s keyless access mode (X-Tavily-Access-Mode: keyless header; access is IP-based). Tool filters expose only search and extract, so the agent sees mcp__tavily__tavily_search and mcp__tavily__tavily_extract. No credential is needed for the keyless tier; the skill also installs an optional upgrade path — when the shared keyless allowance runs out, a paid Tavily key goes in the OneCLI vault and the gateway injects it into the bridge’s requests.
It adds the most for groups on non-Claude providers — the Claude provider already ships built-in WebSearch/WebFetch, and Codex has web search off by default.
Local models as tools
Two skills let the agent offload work to local models. In both cases the agent stays the orchestrator — it decides when to delegate, calls the local model as a tool, and uses the result.Don’t confuse
/add-ollama-tool with /add-ollama-provider. The tool skill keeps your existing provider as the agent’s brain and gives it a local model to call; the provider skill replaces the agent’s brain with a local Ollama model for an entire group. See Providers.Phone: SMS and voice calls with Dial
/add-dial-tool gives the agents you choose a real phone number as a CLI tool rather than an MCP server. The pinned @getdial/cli lands in the agent image through container/cli-tools.json, a sandbox-aware dial-cli skill teaches the agent to text, place AI-handled voice calls, and wait for inbound codes, and the account key sits in the OneCLI vault for api.getdial.ai — injected at the gateway, never inside the container. The skill asks which agents may use Dial and blocks the rest with per-agent OneCLI rules (403 blocked_by_policy); answer with all, none, or ag-… ids separated by commas with no spaces. If you run it from /add-dial, the parent asks that question and passes the answer down. Each run replaces the vault secret rather than updating it, so re-onboarding and key rotation work. It spends real money and reaches real people, so grant it deliberately. Details, and the separate /add-dial messaging channel, are on the Dial channel page.
Local document conversion
/add-anydoc installs the pinned Firecrawl AnyDoc CLI and a convert-documents-to-markdown container skill. Agents can convert Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and text-based PDF attachments locally into Markdown. It adds no MCP server, credential, or hosted parser; the original attachment pipeline stays unchanged.
Web access
Every agent can already browse the web. Theagent-browser container skill ships in container/skills/, which is mounted read-only into every container — and the container config’s skills field defaults to "all", so it’s available without any setup.
It teaches the agent the agent-browser CLI: navigate to URLs, snapshot pages as accessibility trees with element refs, click and fill forms, extract text and attributes, take screenshots, save PDFs, run JavaScript, and persist login state across sessions. The agent uses it on its own whenever a browser helps — research, reading articles, interacting with web apps — not just when you ask explicitly.
Which container skills a group gets is controlled per group — see Container config.
Bring your own MCP server
Any stdio MCP server can be added to a group without a skill. Register it in the group’s container config:--args and --env are optional JSON. The server is merged with the built-in nanoclaw server at runner startup, and the agent’s allow-pattern (mcp__github__*) is derived automatically from the server name. The change lands in the central database and takes effect on the group’s next container spawn — restart the group (ncl groups restart --id <group-id>) to pick it up immediately.
Remote Streamable HTTP servers work too — pass --url instead of --command:
localhost, 127.0.0.1, [::1], and host.docker.internal. URLs that embed credentials are rejected — connect the service through OneCLI instead. Remote servers also accept --headers as a JSON object for non-secret headers; keep real credentials in the vault.
Run from inside an agent’s container, ncl write commands are approval-gated; from a host operator shell they execute immediately. Remove user-added servers with ncl groups config remove-mcp-server --id <group-id> --name github. Plugin-owned servers cannot be edited or removed through these commands: update the plugin and re-stamp it instead. The optional instructions field (composed into the group’s CLAUDE.md) can’t be set through ncl as of v2.1.4 — see Container config.
If your server needs a credential, don’t put a raw key in --env — connect the service in the OneCLI vault and let the gateway inject it in flight. See Credentials.
Next steps
Skills catalog
Tool-install skills, including document conversion, dashboard, memory, and Vercel
Agent MCP tools
The built-in nanoclaw server every agent already has
Credentials
How the vault keeps raw tokens out of containers
Container config
The full mcp_servers, skills, and mounts reference