01.1 Multi-round execution
Call, observe, continue.
The model can use a tool, reason over its result, and call again before answering. Stop cancels the model request, an in-flight call, and any approval still waiting.
LIBRE / PRODUCT Action with approval CURRENT CAPABILITIES
Agents & tools
Models can act. You decide when.
Libre runs a native multi-round tool loop in Chat: the model requests a tool, receives the result, and continues toward an answer. Every call runs under the invoking user’s identity, and side effects wait for a clear approval.
- First-party chat tools
- 13
- External tool sources
- OpenAPI + MCP
- Identity and audit trail
- Per call
01 The loop
A tool call remains part of the conversation.
Calls, results, and approvals appear as normalized events while the answer streams. Refreshes and reconnects replay the same durable state instead of hiding what happened between prompt and reply.
01.2 Per-turn scope
Offer only the tools this task needs.
Tools are enabled by an administrator, remain off by default in Chat, and are selected for each turn. A profile can narrow the available set but never widen a user’s access.
01.3 Built in
Search, documents, skills, notes, and calendars.
First-party tools cover web and document search, bounded document reads, lazy skill loading, note reads and edits, and calendar reads and mutations.
Go deeper
02 Tool sources
Bring an API. Keep the destination fixed.
External inventories are fetched, reviewed, and pinned. The model chooses arguments for an allowed operation; it never gets to choose where the request goes.
02.1 OpenAPI
Turn pinned operations into tools.
Register an OpenAPI 3.x service and each operation becomes callable. GET starts read-only; other methods start as side effects, with per-operation classification under administrator control.
02.2 MCP
Connect Streamable HTTP servers.
Libre fetches a server’s JSON-RPC tool inventory and honors its read-only annotations. Streamable HTTP is supported; stdio MCP processes do not run inside the web process.
02.3 Credentials + egress
Keep secrets per user and requests on course.
Bearer or named-header credentials are encrypted for the exact user and server. Destination checks reject redirects and private, loopback, and metadata networks unless an operator explicitly allowlists a host.
Go deeper
03 Approval
Make side effects a visible decision.
Read-only tools can proceed. A tool classified as side-effecting pauses the turn until the person who invoked it chooses what happens next.
03.1 Decision scope
Allow once, allow here, allow always—or deny.
Approvals can cover one call, the current chat, or the same tool on the same server. Persistent grants survive restarts and remain revocable in Settings.
03.2 Failure closed
No answer is not permission.
A denial or expired approval never runs the call. The model receives that result and can continue without pretending the side effect occurred.
03.3 Accountability
Calls and decisions leave a redacted record.
Every tool call and approval produces a security audit event without placing prompt content or secrets into the log.
04 Reusable assistants
Package the instructions, context, and tools that belong together.
Build assistants from versioned parts instead of pasting the same setup into every new chat.
04.1 Prompts
A library with variables and history.
Saved prompts open from the composer slash menu, render named variables before insertion, preserve earlier versions, and can be shared or exported.
Prompt library 04.2 Skills
Load instructions and files only when needed.
A compact manifest tells the model what skills exist. The full instructions and bounded companion files enter context only after the model explicitly loads them.
Skills guide 04.3 Assistant profiles
Bind a model to its working set.
A profile can combine a prompt, built-in and external tools, skills, knowledge collections, and a voice. Authorization is resolved again every time the profile runs.
Assistant profiles Go deeper