feat(tools): configurable LLM tool list via tools config, env, and --tool/--no-tool

Add a new  config section with  (whitelist) and
(blacklist) plus CLI flags  /  and env vars
 / . This supports deployments
where odek should only expose a subset of tools, e.g. a chatbot with
web_search + voice but no shell or file writes.

Key changes:
- internal/config/loader.go: ToolConfig/ToolsConfig types, file/env/CLI
  merge logic, and project-level security restriction (project config can
  only disable, never enable).
- internal/tool/registry.go: FilterTools helper with whitelist/blacklist
  and required-tool preservation.
- odek.go: ToolFilterConfig on Config; memory tool is no longer appended
  unconditionally — it respects the filter.
- cmd/odek/*.go: wire filtering into run, continue, repl, serve, telegram,
  subagent, schedule, and mcp surfaces.
- Docs and help text updated with examples and env vars.

Tests:
- internal/config/tools_test.go
- internal/tool/filter_test.go
- cmd/odek/run_flags_tools_test.go
- odek_test.go memory-filter regression tests

All existing tests pass.

Author: jkyberneees

cmd/odek/main.go

@@ -26,6 +26,7 @@ import (
 	"github.com/BackendStack21/odek/internal/session"
 	"github.com/BackendStack21/odek/internal/skills"
 	"github.com/BackendStack21/odek/internal/telegram"
+	"github.com/BackendStack21/odek/internal/tool"
 )
 
 // version is set at build time via ldflags: -ldflags "-X main.version=v0.2.1"
@@ -253,8 +254,14 @@ type runFlags struct {
 	NoAgents       *bool   // nil = not set
 	PromptCaching  *bool   // nil = not set; true = enable prompt caching
 	Session        *bool   // nil = not set; true = save session after run
-	Learn          *bool   // nil = not set; true = enable skills learning mode
-	Task           string
+	Learn    *bool // nil = not set; true = enable skills learning mode
+	Task     string
+
+	// ToolsEnabled and ToolsDisabled control which tools are exposed to the LLM.
+	// Repeated --tool/--no-tool flags accumulate. They are the highest priority
+	// layer after file config and env vars.
+	ToolsEnabled  []string
+	ToolsDisabled []string
 	Ctx            []string // --ctx files to attach
 
 	// Sandbox-specific CLI flags
@@ -333,6 +340,18 @@ func parseRunFlags(args []string) (runFlags, error) {
 		case "--no-learn":
 			f.Learn = boolPtr(false)
 			i++
+		case "--tool":
+			if i+1 >= len(args) {
+				return f, fmt.Errorf("--tool requires a value")
+			}
+			f.ToolsEnabled = append(f.ToolsEnabled, args[i+1])
+			i += 2
+		case "--no-tool":
+			if i+1 >= len(args) {
+				return f, fmt.Errorf("--no-tool requires a value")
+			}
+			f.ToolsDisabled = append(f.ToolsDisabled, args[i+1])
+			i += 2
 		case "--no-color":
 			f.NoColor = boolPtr(true)
 			i++
@@ -604,6 +623,8 @@ Run flags:
   --session            Save conversation as a multi-turn session
   --learn              Enable skill learning mode — on by default, no flag needed
   --no-learn           Disable skill learning mode (overrides config/default)
+  --tool <name>        Enable a tool for the LLM (repeatable)
+  --no-tool <name>     Disable a tool for the LLM (repeatable)
   --system <prompt>    System prompt override
 
 Skill commands:
@@ -641,6 +662,8 @@ Environment variables:
   ODEK_NO_COLOR        true/false — disable colors
   ODEK_NO_AGENTS       true/false — skip AGENTS.md
   ODEK_SYSTEM          System prompt override
+  ODEK_TOOLS_ENABLED   Comma-separated tool whitelist
+  ODEK_TOOLS_DISABLED  Comma-separated tool blacklist
   ODEK_SANDBOX_IMAGE   Docker image for sandbox container
   ODEK_SANDBOX_NETWORK Network mode (none | bridge | host)
   ODEK_SANDBOX_READONLY true/false — mount read-only
@@ -669,6 +692,10 @@ const defaultConfigTemplate = `{
   "sandbox_user": "",
   "sandbox_env": {},
   "sandbox_volumes": [],
+  "tools": {
+    "enabled": [],
+    "disabled": []
+  },
   "dangerous": {
     "action": "prompt",
     "non_interactive": "deny",
@@ -835,6 +862,8 @@ func run(args []string) error {
 		Learn:         f.Learn,
 		System:        f.System,
 		Task:          f.Task,
+		ToolsEnabled:  f.ToolsEnabled,
+		ToolsDisabled: f.ToolsDisabled,
 
 		SandboxImage:    f.SandboxImage,
 		SandboxNetwork:  f.SandboxNetwork,
@@ -881,6 +910,9 @@ func run(args []string) error {
 	var sandboxCleanup func() error
 	tools := builtinTools(resolved.Dangerous, sm, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{Transcription: resolved.Transcription, Vision: resolved.Vision, WebSearch: resolved.WebSearch}, nil)
 
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	// MCP server tools
 	var mcpCleanup func()
 	if len(resolved.MCPServers) > 0 {
@@ -951,6 +983,7 @@ func run(args []string) error {
 		ThinkingBudget:  f.ThinkingBudget,
 		Temperature:     0, // deterministic by default; override with --temperature
 		Tools:           tools,
+		ToolFilter:      odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		SandboxCleanup:  sandboxCleanup,
 		Renderer:        rend,
 		Skills:          skillsCfg,
@@ -1235,6 +1268,38 @@ func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager, approver d
 	return tools
 }
 
+// filterBuiltinTools applies the configured tools.enabled / tools.disabled
+// lists to a slice of tools. Unknown names are ignored. Required tools are
+// always preserved.
+func filterBuiltinTools(tools []odek.Tool, cfg config.ToolConfig, required ...map[string]bool) []odek.Tool {
+	var req map[string]bool
+	if len(required) > 0 {
+		req = required[0]
+	}
+	adapted := make([]tool.Tool, len(tools))
+	for i, t := range tools {
+		adapted[i] = odekToolAdapter{t}
+	}
+	filtered := tool.FilterTools(adapted, cfg.Enabled, cfg.Disabled, req)
+	out := make([]odek.Tool, len(filtered))
+	for i, t := range filtered {
+		out[i] = t.(odekToolAdapter).tool
+	}
+	return out
+}
+
+// odekToolAdapter bridges odek.Tool to internal/tool.Tool.
+type odekToolAdapter struct {
+	tool odek.Tool
+}
+
+func (a odekToolAdapter) Name() string        { return a.tool.Name() }
+func (a odekToolAdapter) Description() string { return a.tool.Description() }
+func (a odekToolAdapter) Schema() any         { return a.tool.Schema() }
+func (a odekToolAdapter) Call(args string) (string, error) {
+	return a.tool.Call(args)
+}
+
 // loadMCPTools connects to configured MCP servers and appends their tools
 // to the tool slice. Returns a cleanup function that closes all connections.
 // The passed-in tool slice pointer is extended with ToolAdapters.
@@ -1792,6 +1857,10 @@ func continueCmd(args []string) error {
 		)
 	}
 	tools := builtinTools(resolved.Dangerous, sm, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{Transcription: resolved.Transcription, Vision: resolved.Vision, WebSearch: resolved.WebSearch}, store)
+
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	var sandboxCleanup func() error
 
 	// MCP server tools
@@ -1853,6 +1922,7 @@ func continueCmd(args []string) error {
 		Thinking:        resolved.Thinking,
 		Temperature:     0, // deterministic by default; override with --temperature
 		Tools:           tools,
+		ToolFilter:      odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		SandboxCleanup:  sandboxCleanup,
 		Renderer:        rend,
 		Skills:          skillsCfg,

cmd/odek/mcp.go

@@ -76,6 +76,9 @@ Flags:
 	// Build tools
 	toolSet := builtinTools(resolved.Dangerous, sm, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{WebSearch: resolved.WebSearch}, nil)
 
+	// Apply tool filtering based on configuration.
+	toolSet = filterBuiltinTools(toolSet, resolved.Tools)
+
 	// MCP server tools — connect and discover before sandbox
 	var mcpCleanup func()
 	if len(resolved.MCPServers) > 0 {

cmd/odek/repl.go

@@ -79,6 +79,10 @@ func replCmd(args []string) error {
 		)
 	}
 	tools := builtinTools(resolved.Dangerous, sm, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{WebSearch: resolved.WebSearch}, nil)
+
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	var sandboxCleanup func() error
 
 	// MCP server tools
@@ -139,6 +143,7 @@ func replCmd(args []string) error {
 		Thinking:       resolved.Thinking,
 		ThinkingBudget: f.ThinkingBudget,
 		Tools:          tools,
+		ToolFilter:     odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		SandboxCleanup: sandboxCleanup,
 		Renderer:       rend,
 		Skills:         skillsCfg,

cmd/odek/schedule.go

@@ -671,6 +671,10 @@ func runTaskHeadless(ctx context.Context, resolved config.ResolvedConfig, system
 	dangerCfg := buildHeadlessDangerConfig(resolved)
 
 	tools := builtinTools(dangerCfg, nil, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{Transcription: resolved.Transcription, Vision: resolved.Vision, WebSearch: resolved.WebSearch}, nil)
+
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	tools = append(tools, mcpTools...)
 
 	// Capture cumulative token usage from the final iteration so the Runner
@@ -691,6 +695,7 @@ func runTaskHeadless(ctx context.Context, resolved config.ResolvedConfig, system
 		Thinking:          resolved.Thinking,
 		Temperature:       0,
 		Tools:             tools,
+		ToolFilter:        odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		Renderer:          render.New(io.Discard, false), // silent: unattended
 		InteractionMode:   "off",
 		PromptCaching:     resolved.PromptCaching,

cmd/odek/serve.go

@@ -185,6 +185,7 @@ func serveCmd(args []string) error {
 	var sandboxReadonly *bool
 	var promptCaching *bool
 	var sandboxImage, sandboxNetwork, sandboxMemory, sandboxCPUs, sandboxUser string
+	var toolsEnabled, toolsDisabled []string
 
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
@@ -232,6 +233,16 @@ func serveCmd(args []string) error {
 			}
 		case "--prompt-caching":
 			promptCaching = boolPtr(true)
+		case "--tool":
+			i++
+			if i < len(args) {
+				toolsEnabled = append(toolsEnabled, args[i])
+			}
+		case "--no-tool":
+			i++
+			if i < len(args) {
+				toolsDisabled = append(toolsDisabled, args[i])
+			}
 		default:
 			return fmt.Errorf("unknown flag %q for serve", args[i])
 		}
@@ -246,6 +257,8 @@ func serveCmd(args []string) error {
 		SandboxMemory:   sandboxMemory,
 		SandboxCPUs:     sandboxCPUs,
 		SandboxUser:     sandboxUser,
+		ToolsEnabled:    toolsEnabled,
+		ToolsDisabled:   toolsDisabled,
 	})
 	// Serve mode default-on for sandbox: the Web UI surface is the
 	// largest blast radius (browser-driven tool calls, untrusted-page
@@ -331,6 +344,8 @@ Flags:
   --sandbox-memory limit   Container memory limit (e.g. 512m, 2g)
   --sandbox-cpus limit     Container CPU limit (e.g. 0.5, 2, 4)
   --sandbox-user user      Container user (e.g. 1000:1000)
+  --tool name              Enable a tool for the LLM (repeatable)
+  --no-tool name           Disable a tool for the LLM (repeatable)
   --help, -h               Show this help`)
 }
 
@@ -412,6 +427,9 @@ func newServeAgent(resolved config.ResolvedConfig, system string, sendFn func(v
 
 	tools := builtinTools(resolved.Dangerous, sm, approver, resolved.MaxConcurrency, resolved.APIKey, toolConfig{WebSearch: resolved.WebSearch}, nil)
 
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	// Find the delegateTasksTool to wire up sub-agent log streaming
 	var subagentTool *delegateTasksTool
 	for _, t := range tools {
@@ -503,6 +521,7 @@ func newServeAgent(resolved config.ResolvedConfig, system string, sendFn func(v
 		Thinking:        resolved.Thinking,
 		InteractionMode: resolved.InteractionMode,
 		Tools:           tools,
+		ToolFilter:      odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		// SandboxCleanup is intentionally NOT passed here. In serve mode,
 		// cleanup is the caller's responsibility (handleWS defers it).
 		// Passing it here would cause agent.Close() to call docker rm -f,

cmd/odek/subagent.go

@@ -352,6 +352,10 @@ func subagentCmd(args []string) error {
 		)
 	}
 	tools := builtinTools(resolved.Dangerous, sm, nil, resolved.MaxConcurrency, resolved.APIKey, toolConfig{WebSearch: resolved.WebSearch}, nil)
+
+	// Apply tool filtering based on configuration.
+	tools = filterBuiltinTools(tools, resolved.Tools)
+
 	var sandboxCleanup func() error
 
 	// MCP server tools
@@ -416,6 +420,7 @@ func subagentCmd(args []string) error {
 		NoProjectFile:  resolved.NoAgents,
 		Thinking:       resolved.Thinking,
 		Tools:          tools,
+		ToolFilter:     odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		SandboxCleanup: sandboxCleanup,
 		Renderer:       rend,
 		Skills:         &resolved.Skills,

cmd/odek/telegram.go

@@ -1214,6 +1214,11 @@ func handleChatMessage(
 	// Build the agent with Telegram approver.
 	tools := builtinTools(resolved.Dangerous, nil, approver, resolved.MaxConcurrency, resolved.APIKey, toolConfig{Transcription: resolved.Transcription, Vision: resolved.Vision, WebSearch: resolved.WebSearch}, sessionManager.Store)
 
+	// Apply tool filtering based on configuration, but preserve Telegram's
+	// required tools so the bot can always respond and ask clarifications.
+	requiredTelegramTools := map[string]bool{"send_message": true, "clarify": true}
+	tools = filterBuiltinTools(tools, resolved.Tools, requiredTelegramTools)
+
 	modelLabel := odek.ProfileLabel(resolved.Model)
 	if modelLabel == "" {
 		modelLabel = "deepseek-v4-flash"
@@ -1516,6 +1521,7 @@ func handleChatMessage(
 		Skills:           skillsCfg,
 		Thinking:         resolved.Thinking,
 		Tools:            agentTools,
+		ToolFilter:       odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
 		Renderer:         rend,
 		ToolEventHandler: func(event string, name string, data string) {
 			// Enhance mode: send new messages with narrated descriptions.

docs/CLI.md

@@ -51,6 +51,8 @@
 | `--session` | bool | false | Save conversation as a multi-turn session |
 | `--learn` | bool | `true` | Enable skill learning mode (detects patterns, saves skills). On by default |
 | `--no-learn` | bool | `false` | Disable skill learning mode (overrides config/default) |
+| `--tool <name>` | string | — | Enable a specific tool for the LLM (repeatable). Highest-priority layer for the tool whitelist. |
+| `--no-tool <name>` | string | — | Disable a specific tool for the LLM (repeatable). Merges with lower-priority disabled lists. |
 | `--system <prompt>` | string | built-in | Override system prompt |
 | `--ctx <files>` / `-c` | string | — | Attach comma-separated files as context blocks |
 

docs/CONFIG.md

@@ -556,6 +556,52 @@ Project-level `odek.json` cannot set `schedules.dangerous`; configure it via `~/
 
 Full guide: [docs/SCHEDULES.md](SCHEDULES.md).
 
+## Tool configuration
+
+Control which tools are exposed to the LLM. Use this to deploy locked-down
+agents — for example, a chatbot with only `web_search`, `transcribe`, and
+`vision`, or a read-only research assistant with no write tools.
+
+```json
+{
+  "tools": {
+    "enabled": ["web_search", "transcribe", "vision"],
+    "disabled": ["shell", "write_file", "patch"]
+  }
+}
+```
+
+| Field | Env | Default | Description |
+|---|---|---|---|
+| `enabled` | `ODEK_TOOLS_ENABLED` | unset | Whitelist. When set, only these tools are registered. Comma-separated in env. |
+| `disabled` | `ODEK_TOOLS_DISABLED` | unset | Blacklist. These tools are removed from the default set. Comma-separated in env. |
+
+CLI flags override file and env config:
+
+```bash
+# Whitelist mode: only these tools
+odek run --tool web_search --tool vision "what's new in Go?"
+
+# Blacklist mode: remove specific tools
+odek run --no-tool shell --no-tool write_file "review this code"
+
+# Environment
+ODEK_TOOLS_ENABLED=web_search,vision odek run "search and summarize"
+```
+
+Resolution rules:
+
+- `enabled` is set by the highest-priority layer that provides it.
+- `disabled` is merged across layers.
+- If both are present: start from `enabled`, then subtract `disabled`.
+- Unknown tool names are silently ignored.
+- The `memory` tool is also subject to this filter, so a whitelist must
+  include `"memory"` if you want persistent memory.
+
+Project-level `./odek.json` **cannot enable tools** — it may only append to
+`disabled`. This prevents a malicious repository from widening the tool
+surface.
+
 ## Tool Progress
 
 Controls how per-tool progress messages appear inside the Telegram bot during agent runs. Independent from `interaction_mode` — you can have engaging terminal output with minimal Telegram progress, or verbose terminal with rich progress bubbles.