# Tools and integrations
A node's **Approval mode** sets which tools it can use and when it asks permission. Nodes can use built-in tools, saved agents, discovered skills, web search, and MCP servers. The [Tools reference](https://philbotar.github.io/OpenFlow/reference/tools.html) lists arguments and limits.
## Approval modes
Set **Approval mode** in a node's Inspector, under **Tools**:
[](https://philbotar.github.io/OpenFlow/media/screenshots/tools-approval-modes.jpg)
The four approval modes.
| Mode | Behavior |
| --- | --- |
| **Read only** | Exposes read-tier tools. |
| **Read auto-approve, write prompt** | Runs read-tier tools without prompting and asks before write-tier tools. |
| **Always ask** | Prompts for each tool call. |
| **Auto-approve all** | Skips prompts for tools allowed to that node. |
In the middle mode, read-only `ls` and `find` commands through Bash can stay auto-approved; shell operators and mutating `find` predicates are write-tier. MCP tools are write-tier by default unless you explicitly review a server policy.
## Skills
Type `/` in a composer or task prompt to search discovered `SKILL.md` files. In a run, each recognized skill resolves to its exact file and loads into context. Skills are read-only catalog entries and aren't copied into OpenFlow storage. An unknown leading command blocks the run; an unknown inline token stays literal.
## Saved and callable agents
The **Agents** screen stores reusable agent definitions. To let a node delegate work, add a saved agent to it as a callable agent. The definition is snapshotted at run start, so later library edits don't change an in-flight run. [Callable agents](https://philbotar.github.io/OpenFlow/architecture/callable-agents.html) describes the snapshot lifecycle.
## Web search
Add search credentials in **Settings → Search** to let workflows use the bundled web-search tool. Keep keys in Settings or the provider's environment fallback, never in prompts or workflow files.
## MCP servers
In **Settings → MCP Servers**, add Stdio, Streamable HTTP, or legacy SSE servers, import `mcpServers` JSON, and test, trust, disable, or remove connections. Have the server command, URL, or imported configuration ready, and enter credentials in Settings, not workflow text. Review the server policy before enabling it: OpenFlow doesn't automatically trust a server's read-only annotation. [Security and data](https://philbotar.github.io/OpenFlow/security-and-data.html#mcp-and-external-services) explains what external services can receive.
[](https://philbotar.github.io/OpenFlow/media/screenshots/tools-mcp-servers.jpg)
Settings → MCP Servers before any server is added.
Connecting a server doesn't inject its resources or prompts. Select each one explicitly under **MCP context** in a node Inspector. OpenFlow snapshots the selected content at run start; resume and replay use that immutable snapshot. Selected context is untrusted provider input, bounded by the limits in [Configuration](https://philbotar.github.io/OpenFlow/reference/configuration.html#mcp).
**Expose selected project root**, **Allow approved sampling reqs**, and **Allow approved form/URL elicitation** are off by default; enable them deliberately. Sampling and elicitation requests appear in the originating conversation for one-time approval. Stopping the run cancels pending callbacks.
Use **Approve & Test** after import or a security-relevant change. Changing the source, install, connection, or policy revokes trust. If an enabled server fails setup or listing during a run, OpenFlow skips it and continues with the others.
For startup, authentication, or listing failures, see [MCP troubleshooting](https://philbotar.github.io/OpenFlow/troubleshooting/#mcp-servers).