Sandbox Tool Channel

The sandbox tool channel lets a shell command running in an agent’s sandbox call the agent’s integration tools directly, without a model turn for each call. A script can look up a record, branch on the answer, and update another system in one command. The agent already knows this from its shell tool, so you do not have to explain the mechanics: describe the read-then-branch job and it writes the script.

Two Ways to Call a Tool

From the shell, kindo-tool prints the tool’s result as JSON on stdout, so it pipes into jq:

kindo-tool list
kindo-tool call linear_list_issues '{"teamId": "ENG"}' | jq .

From Python, kindo_tool is importable in any command:

import kindo_tool

tools = kindo_tool.list_tools()
issues = kindo_tool.call_tool("linear_list_issues", {"teamId": "ENG"})

A failed call raises kindo_tool.KindoToolError. The CLI prints the error and exits non-zero. The script decides whether to stop or continue.

What a Command Can Call

The integration tools available to the conversation that are set to run automatically. Tools set to Ask before running are neither listed nor callable, because a running command cannot wait for approval. See Tool Actions and Permissions.
Not the sandbox’s own tools, not child-agent tools, and not Platform tools.
kindo-tool list shows exactly what the current command may call.

Limits

The channel is open only while the command that started it runs. When the command exits, calls fail instead of hanging, and a background process that outlives the command cannot call tools.
Each command may make up to 100 tool calls. Further calls fail.
The command’s timeout bounds every call it makes. The default is 60 seconds and the maximum is 300. The agent can raise the timeout on a command that needs longer.
Requests travel on the command’s stderr. A command that redirects stderr, for example with 2>/dev/null, disables the channel. Redirect stdout instead.

Permissions and Auditing

No credential enters the sandbox. Kindo executes each call on the agent’s behalf, under the same permissions as a tool call the model makes itself, and records it in the audit log the same way. A command cannot reach a tool the agent could not call directly.

What the Conversation Records

The shell command’s result reports how many tool calls it made. The individual calls appear in the audit log, not as separate entries in the conversation. For Script steps, each call is also recorded in the run.