toolfuncs

toolfuncs turns typed Python functions into tools that have native Python, Cyclopts command-line, and local FastMCP interfaces.

A toolfunc exposes typed functions through one module-level App. It can be an executable Python script or an explicitly opted-in installed package console script. Its lowercase kebab-case command name determines the Python facade name by replacing hyphens with underscores. PATH controls discovery and lookup in both cases; ordinary installed commands do not become toolfuncs automatically.

Package a tool

Use ordinary project metadata with matching console-script and toolfuncs entry points:

[project]
name = "agent-apps"
version = "0.1.0"
dependencies = ["toolfuncs>=1,<2"]

[project.scripts]
agent-apps = "agent_apps.tools:app"

[project.entry-points.toolfuncs]
agent-apps = "agent_apps.tools:app"

Define the interface once in agent_apps/tools.py:

"""Manage agent application conversations."""

import toolfuncs.sdk as toolsdk

app = toolsdk.App()


@app.command
def describe(conversation: str) -> dict[str, str]:
    """Describe one conversation.

    Parameters
    ----------
    conversation:
        Conversation identifier to inspect.
    """
    return {"conversation": conversation}

Install with uv-launch install agent-apps "agent-apps @ file:///absolute/path/to/project" for managed launches. Use uv-launch by default; it prepares and updates the command environment automatically. The installer generates the console script; no separate handwritten executable, self-dependent PEP 723 script, custom backend, or registration command is needed. agent-apps describe example calls the same decorated function exposed as toolfuncs.agent_apps.describe("example"). Direct Python lookup returns the real agent_apps.tools module and native objects/exceptions.

Discovery reads installed entry points, unique RECORD ownership, a strong launcher checksum, and the module docstring. It never imports a target, starts an interpreter, prepares dependencies, or uses the network. uv-launch records locate foreign command environments and capture one immutable generation. Packages installed in the caller's own interpreter use its metadata search paths. Generated launcher bodies are opaque: Python shebangs, long-path shell wrappers, and future installer templates follow the same ownership and checksum checks. Unmanaged foreign environments must be migrated with uv-launch; their interpreter locations are not inferred from executable text. Installed Python source is required; editable import-hook layouts are not inferred. The first docstring line is the static description.

These checks detect inconsistent installations, not malicious package metadata. The package installer is trusted to generate the command declared by matching console_scripts and toolfuncs entry points. Discovery does not prove executable semantics or authenticate a publisher.

Python consumers can call toolfuncs.sdk.discover(path=...) for the same static Catalog used by listing and agent hooks. Omit path to use PATH; a supplied path has the same first-executable precedence. Read catalog.tools and catalog.invalid_tools without executing command help.

Direct Python loading installs the owning distribution into the caller's interpreter if needed, using its recorded exact Git origin, other direct origin, or published name/version. It then imports the actual module. This preserves native Python semantics rather than opening an RPC proxy into the tool environment. Use a suitable interpreter when tools have incompatible dependency requirements. toolfuncs doctor /path/to/agent-apps validates the installed module's registered commands and generated help. import_path retains its existing local-script contract and does not import package console wrappers.

Write a toolfunc

Create an extensionless file named weather-report:

#!/usr/bin/env toolfuncs
# /// script
# requires-python = ">=3.11"
# dependencies = ["toolfuncs>=1,<2", "weather-client"]
# [tool.toolfuncs]
# description = "Read current weather conditions."
# cli_name = "weather-report"
# python_name = "weather_report"
# ///

"""Read current weather conditions."""

import toolfuncs.sdk as toolsdk
import weather_client
from pydantic import JsonValue

app = toolsdk.App()


@app.command
def current(city: str) -> dict[str, JsonValue]:
    """Read current conditions for one city.

    Parameters
    ----------
    city:
        City whose current conditions should be read.
    """

    return weather_client.current(city)

Make it executable:

chmod +x weather-report

No registration operation is required. Move it to an existing PATH directory only when it should be globally discoverable:

mv weather-report ~/.local/bin/

Call it

A known source can be run explicitly without adding it to PATH:

$ toolfuncs ./weather-report current London
{"city": "London", "temperature": 18}

When the source is on PATH, its filename is also the CLI:

$ weather-report current London
{"city": "London", "temperature": 18}

A known source is importable by path:

import toolfuncs as tools

weather_report = tools.import_path("./weather-report")
conditions = weather_report.current("London")

When the source is on PATH, the same file is also dynamically importable by name in a Python process with that PATH:

import toolfuncs as tools

conditions = tools.weather_report.current("London")

import_path() also works for an ordinary local Python script whose path is already known:

import toolfuncs as tools

module = tools.import_path("scripts/prepare_data.py")

It accepts one ordinary .py file or extensionless script and derives the module name from its filename. An extensionless lowercase kebab-case filename is mapped to its snake-case Python name. It does not require a shebang, executable bit, [tool.toolfuncs] metadata, or App, and it does not import packages, projects, distributions, or URLs. When an optional PEP 723 block exists, the default installer installs all declared requirements together into the running Python environment before import. A caller can replace that behavior with one callable that accepts list[str] and returns None:

module = tools.import_path(
    "scripts/prepare_data.py",
    dependency_installer=my_installer,
)

Python dependency preparation uses uv-launch: it reuses satisfying installed distributions and adds missing packages to the current interpreter. Conflicts fail before installation instead of replacing existing packages. Background resolution refresh never mutates the active interpreter. Repeated imports retain their actual module objects; a new kernel does not itself reset an existing virtual environment.

Direct Python calls return ordinary Python objects and raise the original exceptions. Dynamic tool attributes and toolfuncs.import_path() prepare declared requirements in the running Python environment before import. CLI calls use Cyclopts to parse annotated values. Interactive terminals receive Rich help, errors, and Python-object result rendering; pipes and other non-terminal destinations receive plain help and errors plus strict JSON results validated against the declared return type with Pydantic.

Set TOOLFUNCS_OUTPUT=terminal or TOOLFUNCS_OUTPUT=machine before invoking a tool to force either presentation. The default auto mode decides independently for stdout and stderr, so redirecting a result preserves machine-readable stdout without changing an attached terminal's error presentation. Cyclopts help_formatter and error_formatter settings remain configurable. Custom result_action settings are rejected: return a value for success, or raise an exception for failure. Help and version are framework control operations, so their internal return values bypass the command result action; a registered command that returns None remains an ordinary result and renders as None or null according to the selected mode.

Function commands inherit help and error presentation from their parent app. All registered commands share the same input validation and result contract.

Use MCP

Register one server to expose the effective PATH catalog. Scripts and opted-in package executables remain separate tool families:

{
  "mcpServers": {
    "toolfuncs": {
      "command": "/absolute/path/to/toolfuncs",
      "args": ["mcp"]
    }
  }
}

toolfuncs mcp captures PATH and starts one persistent child per family, using each source's isolated dependency environment. Children inherit the launch directory and environment. Startup is bounded to 120 seconds, including dependency preparation, with at most eight families starting concurrently. Configure the client's startup timeout to at least 180 seconds for cold installations. Failed families appear in catalog with an error; healthy families remain callable. toolfuncs doctor loads all families and exits nonzero if any are unavailable. It does not invoke their operations. Use toolfuncs doctor SOURCE for the full source documentation and help checks.

The server's operation catalog remains fixed until restart. A crashed child becomes unavailable and is not restarted automatically. Interrupted operations are never replayed, since their side effects may already have occurred. Ordinary function exceptions remain tool errors and leave the family available. Shutdown closes the children. Installing tools, changing PATH, or updating source/dependencies requires restarting the server.

toolfuncs mcp SOURCE remains available to serve one source or opted-in package command. Use --prepared only when the selected interpreter already contains every selected source's dependencies. Toolfuncs does not edit client configuration.

Progressive discovery

The hook advertises families. Inspect one group at a time, then one selected operation:

toolfuncs catalog
toolfuncs commands weather-report
toolfuncs commands weather-report --group '["records"]'
toolfuncs inspect-operation weather-report '["records", "show"]'

The generic MCP server exposes these same three discovery functions as catalog, commands, and inspect_operation. Group views contain only immediate child names and short descriptions. Selected operation views contain the original input/output schemas, documentation, canonical CLI argv, MCP name, and a Python attribute when it is verifiably exported by the source module. Do not reconstruct Python access from an MCP name: registered aliases and nested CLI groups need not match Python attributes.

Python uses the same bound functions:

from toolfuncs.sdk import ToolCatalog

async with ToolCatalog() as catalog:
    families = catalog.catalog()  # static discovery, no child startup
    await catalog.start(["weather-report"])
    children = catalog.commands("weather-report")
    detail = catalog.inspect_operation("weather-report", ["records", "show"])

In Codex Code Mode, use toolfuncs discovery to select an operation, resolve its runtime name from ALL_TOOLS, and invoke tools[name](arguments). Retain deferred MCP exposure; native tool search is unnecessary. In Claude Code, keep the server's tools deferred ("alwaysLoad": false on supported versions), load the selected tool with ToolSearch query select:mcp__toolfuncs__NAME, then call it normally. Claude still exposes operation names initially. These context policies belong to the client; generic MCP clients may expose all schemas. For the agent hook's client-specific guidance, set TOOLFUNCS_MCP_SERVER=toolfuncs in the host environment when that server is registered.

For programmatic use, server = app.to_mcp() returns a FastMCP server. Sync functions use FastMCP's thread dispatch and async functions are awaited. FastMCP owns request handling and cancellation. MCP calls do not share live state with an IPython kernel. The function implementation is shared.

A nested CLI command such as records show becomes records__show; the PATH server prefixes the family, for example weather_report__records__show. Hyphens become underscores. Aliases remain CLI aliases. Collisions and names exceeding 64 characters fail explicitly. Every successful MCP result has structured content {"result": value}, including scalar and null results, plus JSON text content. Exceptions become MCP tool errors.

Use stderr for logs and diagnostics. Stdout belongs to the CLI result or MCP protocol; an operation that prints to stdout can corrupt that stream. Durable background tasks, push notifications, remote hosting, resources and prompts are outside the 1.0 interface.

Portable functions

Use ordinary def or async def, with typed positional-or-keyword or keyword-only parameters and an explicit return annotation. Direct Python calls keep the original function, return values and exceptions. CLI and MCP adapters validate inputs and results with the same Pydantic contract, reject extra fields, and reject non-finite numbers.

Supported data includes strings, numbers, booleans, null, typed lists/tuples/string-keyed dictionaries, unions, literals, string/integer enums, dataclasses, TypedDicts, ordinary Pydantic models, paths, dates, times and UUIDs. Use pydantic.JsonValue when an API deliberately accepts arbitrary JSON. Any, object, untyped containers, generators, opaque objects, positional-only parameters and variadic signatures are rejected.

Cyclopts still owns tokenization, option spelling and help. Scalar strings, paths, dates, times, UUIDs and string literals/enums use plain tokens. Collections, records, unions and JsonValue use one JSON token, for example --labels '["a","b"]' or --record '{"path":"out","count":2}'. A str | None argument uses '"text"' for a string and null for None. Bool options retain --enabled / --no-enabled. Other scalar values use JSON spelling.

Cyclopts metadata for names, help and presentation remains useful. CLI-only converters, validators, environment inputs, config providers, meta apps, hidden injection, repeated-token parsing and custom result policies are rejected because they change the function contract on only one interface. Put domain validation inside the function. Pydantic model field constraints are supported. Records must be plain data: custom validators/serializers (including field metadata), construction hooks, schema overrides, aliases and excluded fields are rejected. Nested record schemas reject unknown fields; string-keyed dictionaries retain their declared value type.

See the 1.0 migration guide and the full contract.

Source contract

A toolfunc source must:

1. be one executable file;
2. have an extensionless lowercase ASCII kebab-case filename;
3. start with one of the two exact toolfuncs shebangs described below;
4. contain exactly one PEP 723 script block with dependencies, a one-line description, and required cli_name and python_name documentation that exactly matches the filename-derived identities;
5. define a module-level app = toolsdk.App() after import toolfuncs.sdk as toolsdk;
6. give the module and every registered operation a docstring, annotate every operation parameter and return value, and provide effective Cyclopts help for every visible CLI argument;
7. register each CLI-callable function explicitly with @app.command.

Declare toolfuncs>=1,<2 in PEP 723 dependencies to make the required major version explicit. Managed source installation requires uv-launch 0.2.9 or later to honor that declaration.

The description, either [tool.toolfuncs].description or a package module's first docstring line, is the line agents read in toolfuncs list and session-start catalogs when they choose a tool. Write one sentence that says what the tool does for its caller. Keep implementation details, compatibility notes and contract caveats out of it; put them in later docstring text or in command docstrings.

Descriptions are static by default. A script whose available domain surface changes at runtime may opt into a last-known catalog description with dynamic = true:

[tool.toolfuncs]
description = "Use connected services."
dynamic = true
cli_name = "connected-services"
python_name = "connected_services"

After refreshing its own state, the tool publishes one current line without changing its source:

toolsdk.publish_description(
    "connected-services",
    "Use connected services: Gmail, Google Drive, and Slack.",
)

Toolfuncs stores the line at ${XDG_STATE_HOME:-~/.local/state}/toolfuncs/descriptions/connected-services. Missing or invalid state uses the required static description. The CLI and Python identities always remain static.

Git requirements may use full commits, branches, tags, abbreviated hashes, or the default branch. uv-launch pins each cached resolution to exact commits and checks for updates in the background. The ordinary #!/usr/bin/env toolfuncs shebang is sufficient. The older --allow-floating-vcs shebang is accepted but no longer changes policy. Adjacent uv lock --script files are not consumed; uv-launch owns the cached resolutions.

Only functions registered on app become CLI commands. Imported functions and __all__ do not define the command surface. Function command and option spelling follows Cyclopts' Python-to-kebab-case projection.

No if __name__ == "__main__": block is required. The operating system passes the source path to the shebang interpreter, and toolfuncs imports the source under its declared Python name before invoking its module-level app. Consequently, weather-report ... is the supported CLI while python weather-report ... merely defines the module and exits, or fails if its dependencies are not already installed.

Packaged tools opt in with an additional matching entry point:

[project.entry-points."toolfuncs.dynamic_description"]
my-tool = "my_package.tools:app"

Keep the matching project.scripts and project.entry-points.toolfuncs declarations. Publish descriptions through the same toolsdk.publish_description API. Discovery reads the current user's published line on each call and falls back to the module docstring when no valid line exists; it does not import the tool or access its service.

Package-backed implementations

A toolfunc remains one script even when most of its implementation lives in a package:

#!/usr/bin/env toolfuncs
# /// script
# requires-python = ">=3.11"
# dependencies = ["my-large-package"]
# [tool.toolfuncs]
# description = "Run the package's agent operation."
# cli_name = "package-operation"
# python_name = "package_operation"
# ///

from my_large_package.agent_tool import app, perform_operation

The imported app and functions are the original Python objects. Toolfuncs does not inspect the package's project layout, metadata, or import structure.

Discovery and precedence

Toolfuncs reads the current process's PATH from left to right. It considers only executable files and symlinks, reads their first line, and parses PEP 723 metadata only when either exact toolfuncs shebang matches.

The first executable filename claims a command name even when it is not a toolfunc. Therefore an ordinary executable earlier on PATH hides a same-named toolfunc later on PATH, matching what the shell actually executes. Repeated directories are scanned once, inaccessible directories are skipped, and discovered records are sorted by CLI name.

toolfuncs list returns one JSON object with tools and invalid_tools. Valid records contain cli, python, path, and the effective description; python is the complete dynamic facade name, such as toolfuncs.weather_report. For dynamic = true, discovery reads the optional one-line state file and otherwise uses the static description. An opted-in but invalid tool is reported with its path and validation error without hiding unrelated valid tools; the command also prints a concise warning to stderr and exits successfully. Listing never imports a tool, prepares its dependencies, executes its source, or accesses the network.

Validate a tool while authoring

Run the doctor against one explicit source before installing or committing it:

toolfuncs doctor ./weather-report

The doctor validates the static source contract, prepares the declared dependencies, loads the source, and inspects the actual Cyclopts command graph. It requires a module docstring, at least one registered operation, a docstring and complete annotations for every operation, effective help text for every visible parsed CLI argument, and successful root and command help generation. Aliases are inspected once through their underlying command. Doctor also rejects any signature, default or configuration that cannot serve all three interfaces; it does not invoke operations or predict their actual results.

The result is always one strict-JSON tagged union. A valid source exits zero:

{"status": "success", "path": "/path/to/weather-report", "commands": ["current"]}

Expected authoring failures return status: "error", list every independently detectable operation error, and exit nonzero without using an exception as the result:

{"status": "error", "path": "/path/to/weather-report", "errors": ["current: CLI argument '--city' must have help text"]}

Loading is intentional: the registered command graph and Cyclopts' effective parameter help can be constructed dynamically and should not be approximated with a second source parser. The CLI doctor prepares an isolated uv-launch runtime; calling the Python doctor directly uses the current interpreter.

Install the runtime

uvx --from "toolfuncs>=1,<2" toolfuncs setup

Setup bootstraps uv-launch through a transient uv tool run invocation, prepares managed toolfuncs and toolfuncs-agent-hook commands, and writes small forwarding wrappers at ~/.local/bin/toolfuncs and ~/.agents/hooks/toolfuncs/hook. Both managed commands use at least the running toolfuncs version and receive updates within that major version. These wrappers no longer invoke uvx on each call. The destination must already be on PATH; setup is idempotent, refuses to overwrite unmanaged commands, and does not modify shell profiles.

Both shebang invocation and toolfuncs SOURCE delegate requirements to uv-launch before executing the source in an immutable environment. First use waits for installation. Warm calls reuse an existing environment and check for dependency updates in the background. Source edits run immediately; changed requirements or interpreter constraints select or prepare a matching environment before execution. Failed background updates leave the last working environment available. toolfuncs doctor SOURCE uses the same isolated preparation.

The managed hook uses the toolfuncs[hooks] environment and is registered at user scope for Codex and Claude Code through typed-agent-hooks. Running setup again reconciles those registrations, so the managed launcher remains the configured executable even when provider configuration changes.

Setup does not discover, copy, register, link, synchronize, or remove tools. There is no dedicated tools directory, registry, manifest, generated shim, project scope, user scope, or sync command.

Management commands

toolfuncs SOURCE [ARGS...]
toolfuncs doctor [--prepared] [SOURCE]
toolfuncs mcp [--prepared] [SOURCE]
toolfuncs list
toolfuncs catalog
toolfuncs commands FAMILY [--group JSON_PATH]
toolfuncs inspect-operation FAMILY JSON_PATH
toolfuncs setup [--bin-dir DIRECTORY]

toolfuncs SOURCE [ARGS...] runs a known source directly. This is the explicit-source interface, not a name dispatcher: toolfuncs weather-report resolves weather-report as a source path rather than searching PATH for that tool name. A toolfunc on PATH can instead be invoked directly by its own filename.

Agent integration

The installed hook runs at initial session start and at the session-start event emitted after compaction. It discovers the effective tools directly from that harness process's PATH, then adds a compact catalog such as:

Available toolfuncs:
- `weather_report`: Read current weather conditions.
  CLI: `weather-report --help`
  Python: `import toolfuncs as tools; help(tools.weather_report)`

The hook reads executable headers and PEP 723 metadata, plus the optional one-line state file for tools declaring dynamic = true. It advertises valid tools and lists invalid tool paths and errors separately; one invalid tool does not suppress the others. It does not import tools, resolve their dependencies, execute them, or access the network. The hook itself is harness infrastructure, not a toolfunc, and therefore does not carry the toolfuncs shebang or appear in the catalog.

Development

Development and CI resolve dependencies from PyPI. The runtime requires uv-launch 0.2.9 or later for managed source installations that select toolfuncs 1.0.

uv sync
uv run pytest
uv run ruff format --check .
uv run ruff check .
uv run basedpyright

The exact guarantees and non-goals are recorded in the contract.

Releasing

The GitHub Release is the release control point. Set [project].version, merge and push that commit, then publish a GitHub Release whose tag is v<version>. The release workflow verifies that the tag and package version match, builds the wheel and source distribution, and publishes them to PyPI through Trusted Publishing.

Prepared source installations

For a toolfunc delivered together with adjacent files, use uv-launch 0.2.9 or later and uv-launch install-source NAME REPOSITORY SOURCE. The launcher resolves the PEP 723 dependencies and validates the tool before selecting a generation. PATH discovery and the Python facade recognize the managed source without executing its shell wrapper.

toolfuncs run-prepared SOURCE ARGS... executes in the caller's already selected environment. toolfuncs doctor --prepared SOURCE validates that same boundary. These commands are for environment managers and integration tests; ordinary local development can continue to use toolfuncs SOURCE ARGS..., which prepares declared dependencies when necessary.