Oracle AI Agent Tools
In Oracle AI Agent Studio, tools are the actions an agent can invoke — the mechanism that lets an agent do something in the real world rather than only produce text. When an agent needs to read a record, call an external API, connect to an external server, send a notification, or reference a document, it does so through a tool the agent's designer explicitly configured. Oracle officially supports several tool types, and each carries a different capability, availability date, and access-risk profile.
This page is the overview of Oracle AI Agent Studio tools and tool types. It explains what a tool is, catalogs the supported types, and links out to the deep page that owns each one — MCP tools, external REST tools, connector tools, email tools, and document tools. It does not re-explain what AI Agent Studio is or repeat each tool's configuration detail; those live on their own pages.
Last reviewed: 19 July 2026
Scope note. This is a tool-type overview, not a product overview and not a deep-dive on any single tool. For what AI Agent Studio is, how agents, teams, topics and knowledge sources fit together, and how to build an agent, start at the Oracle AI Agent Studio hub. For the mechanics of a specific tool type, follow the deep-dive link in the table below. This page's job is to help you tell the tool types apart and choose the right one.
What Is a Tool in Oracle AI Agent Studio?
A tool is a defined action an agent is allowed to perform. In Oracle's own terminology these are configured through the Create Tools capability of AI Agent Studio, and they are what separates an agent that can only answer questions from an agent that can take steps on a user's behalf. An agent's instructions describe when to act; its tools determine what it can actually do.
Because AI Agent Studio has been generally available since release 25C, tools are a supported, documented part of the platform rather than a preview feature. A single agent can be configured with more than one tool, and multi-agent teams can share and coordinate tool use. Every tool an agent holds is an explicit grant: it expands what the agent can reach, so the set of tools attached to an agent is also the practical boundary of that agent's authority.
Two ideas make the tool types easier to reason about. First, some tools call out — the agent reaches an external system (an API, an MCP server, an email channel). Second, some tools bring information in — the agent references documents added as knowledge for semantic search. The overview below groups the officially supported types and points you to the page that covers each in depth.
Conceptually distinct from tools are topics, instructions, and knowledge sources, which shape how an agent reasons and what it knows. Tools are specifically the actions. Keep that boundary in mind when a capability sounds like it could be either — if it performs an action against a system, it is a tool.
Oracle AI Agent Studio Tool Types
The officially supported tool types, what each does, its availability per Oracle's documentation, and the deep-dive page that owns it. Availability labels reflect the release in which Oracle documents the capability; confirm the current state for your pod with Oracle before relying on any date.
| Tool type | What it does | Availability | Deep-dive |
|---|---|---|---|
| MCP tools | Connect an agent to an external MCP-compliant server, with no custom REST wrapper needed, so the agent can use tools that server exposes. | Generally available (release 26A) | MCP tools → |
| External REST tools | Let an agent call a third-party REST API to fetch data or perform an action; includes a "Require Human Approval" option before the action executes. | Enhanced release 26A (human-approval option) | External REST tools → |
| Connector tools | Use a configured connector — including the client connectors that underlie the Slack and Microsoft Teams channels — to reach an external system. | Generally available (confirm current release with Oracle) | Connector tools → |
| Email tools | Send email from an agent through the Fusion HCM Alert system — for notifications and outbound messages as part of a workflow. | Generally available (release 25C) | Email tools → |
| Document tools | Add documents an agent can reference; documents are indexed for semantic search so the agent can ground responses in their content. | Generally available (confirm current release with Oracle) | Document tools → |
Availability reflects Oracle's documented readiness for each capability. Connector and document tool types are confirmed as supported; where this brief cannot pin a single release quarter, the label says so rather than guessing.
Human Approval on Tools
Not every tool action should run unattended. Oracle's external REST tool type includes a "Require Human Approval" option (enhanced in release 26A) that pauses the agent before the action executes and asks a person to approve or reject it. This is the primary control for tools that write to, change, or trigger something in an external system rather than only reading from it.
Human approval is also where agent orchestration and tool execution meet: multi-agent teams in AI Agent Studio support checkpoints and approvals, so a tool call can be gated at the point of the action itself. When you design an agent, decide per tool whether its action is safe to execute automatically or should require a human in the loop — a read is usually low risk; a write, a payment-adjacent step, or an outbound message often is not.
Because approval behavior is a control worth testing in its own right — does the gate actually fire, and can it be bypassed — it has its own deep page. See Oracle AI agent human approval for how approval gates work, where they apply across tool types, and what to verify.
Tools Are Actions — and Actions Are Access
The most important security idea on this page is simple: a tool is a grant of capability. Attaching a tool to an agent expands what that agent — and by extension anyone or any process that can invoke the agent — can reach. An agent with an external REST tool can call whatever that API exposes; an agent with an MCP tool inherits the reach of that MCP server; an agent with an email tool can send messages. Each tool is therefore a piece of the agent's effective access footprint.
That makes tool assignment an access-governance question, not just a design convenience. The risks below are the ones to weigh when granting any tool.
| Risk | Why it matters for tools | Control to consider |
|---|---|---|
| Over-broad access | A tool can reach more data or actions than the agent's purpose requires. | Scope each tool to the minimum endpoint or object needed. |
| Unapproved writes | An action executes against an external system with no human check. | Enable Require Human Approval on write-capable tools. |
| Data leakage | Sensitive Fusion data flows out through an external REST or MCP call. | Review what each tool sends and receives; restrict payloads. |
| External server trust | An MCP or connector tool depends on a third-party endpoint's behavior. | Vet, credential and monitor the external server or connector. |
| Duty separation | Combined tools could let one agent complete a sensitive end-to-end process. | Assess tool combinations against segregation-of-duties policy. |
Because a tool can let an agent complete steps that a human would normally have split across roles, tool assignment intersects directly with segregation of duties. Organizations that already run continuous Oracle Fusion segregation-of-duties monitoring can extend that same access lens to agents — treating an agent's tool set as another combination of privileges to evaluate. SyntraFlow can be configured to help assess where agent tool grants intersect with existing SoD policy, as a complement to your Oracle-side controls rather than a replacement for them.
Testing Tool Execution
A tool that is configured is not the same as a tool that behaves correctly. AI Agent Studio includes debugging, validation and testing of agents, and tool execution is one of the things worth exercising deliberately before an agent goes into a live Fusion workflow. The questions to answer are practical: does the agent choose the right tool for the request, does the tool call succeed against the target system, does it fail safely when the target is unavailable, and does a human-approval gate actually stop the action when it should?
A short checklist for validating tool execution:
- 1.Tool selection. The agent invokes the intended tool for a given request, and does not invoke a tool it should not for out-of-scope requests.
- 2.Successful execution. The tool call reaches the target system and returns the expected result for valid inputs.
- 3.Failure handling. When the external API, MCP server or connector is unavailable or returns an error, the agent degrades gracefully rather than acting on a bad result.
- 4.Approval gate. A tool marked Require Human Approval genuinely pauses and cannot execute the action without a decision.
- 5.Access boundary. The tool cannot reach data or actions beyond what its configuration intends.
- 6.Regression after updates. Tool behavior still holds after an Oracle quarterly update or a change to the external endpoint.
This overview lists what to check rather than the full method. For the discipline of validating agents — test types, coverage and regression across agent behavior — see AI Agent Studio and the deep tool pages, each of which covers testing specific to its tool type.
How SyntraFlow Helps
SyntraFlow is an Oracle Fusion testing and governance platform; Oracle AI Agent Studio and its tools are the subject you are testing, not a SyntraFlow feature. Where agents take actions through tools, those actions touch the same Fusion transactions, data and controls SyntraFlow already helps organizations validate — so agent tool behavior can be folded into the same assurance practice.
In practice, SyntraFlow can be configured to help teams:
- •Inventory which agents hold which tools, and assess that footprint against access and segregation-of-duties policy.
- •Build test plans that exercise tool execution — selection, success, failure handling and approval gates — as part of broader Fusion regression.
- •Connect release intelligence with test planning, so a quarterly update that changes tool behavior triggers targeted re-validation.
These are capabilities SyntraFlow can be configured to support and areas where it helps organizations assess risk — not guarantees that every Oracle AI tool type is covered out of the box. The right scope depends on your agent estate and control requirements, which is what an assessment establishes.
Official Oracle References
Oracle's own documentation for the capabilities described on this page:
Last reviewed: 19 July 2026. Availability and behavior can change between Oracle releases — confirm current details against Oracle's documentation for your environment.
Frequently Asked Questions
What is a tool in Oracle AI Agent Studio?
▼
A tool is an action an agent can invoke — configured through AI Agent Studio's Create Tools capability. It is what lets an agent do something (call an API, connect to an external server, send an email, reference a document) rather than only produce text. Tools are a supported part of AI Agent Studio, which has been generally available since release 25C.
What tool types does Oracle AI Agent Studio support?
▼
Oracle documents MCP tools, external REST tools, connector tools, email tools, and document tools. MCP tools and external REST tools are documented at release 26A; email tools at release 25C; connector and document tools are confirmed as supported. Each type is covered in depth on its own deep-dive page linked from the tool-type table above.
What is the difference between an MCP tool and an external REST tool?
▼
An external REST tool has the agent call a specific third-party REST API you configure. An MCP tool connects the agent to an external MCP-compliant server without a custom REST wrapper, letting it use the tools that server exposes. Both were documented/enhanced at release 26A. See the MCP tools and external REST tools pages for specifics.
Do agent tools support human approval before an action runs?
▼
Yes for external REST tools, which include a "Require Human Approval" option (enhanced in release 26A) that pauses the agent before the action executes. This is the main control for tools that write to or trigger something in an external system. See the human approval page for how the gates work.
Why are agent tools a security concern?
▼
A tool is a grant of capability. Attaching one expands what the agent — and anything that can invoke it — can reach. Tools can read or send sensitive data, act on external systems, and in combination let one agent complete a sensitive end-to-end process. Treat tool assignment as an access-governance decision and assess tool combinations against segregation-of-duties policy.
How do you test agent tool execution?
▼
Verify that the agent selects the right tool, that the call succeeds against the target for valid inputs, that it fails safely when the target is unavailable, that any human-approval gate genuinely stops the action, that access stays within the tool's intended boundary, and that behavior holds after Oracle quarterly updates. AI Agent Studio includes debugging, validation and testing of agents to support this.
Where should I start if I want the full AI Agent Studio picture?
▼
Start at the Oracle AI Agent Studio hub for the product overview — agents, teams, topics, knowledge sources and how to build an agent. This page deliberately covers only tools and tool types; the broader Oracle AI hub orients you across the wider Oracle AI landscape.
Can SyntraFlow help govern and test agent tools?
▼
SyntraFlow can be configured to help organizations inventory which agents hold which tools, assess that footprint against access and segregation-of-duties policy, and build test plans that exercise tool execution as part of Fusion regression. These are hedged, assessment-led capabilities that complement your Oracle-side controls — not a claim that every tool type is covered automatically.
Assess Your Oracle AI Agent Tool Estate
Understand which tools your agents hold, where those grants intersect access and segregation-of-duties risk, and how to validate tool execution before agents go live. SyntraFlow can be configured to help you plan the assessment.