How OpenClaw Tool Calling Works: Tools, Skills, and Plugins

ClawHub listed over 44,000 community-built skills as of April 2026, up from roughly 5,700 just two months earlier. That growth rate means the tool ecosystem is scaling faster than most developers can map. Yet the most-discussed debugging category in OpenClaw community channels remains the same one it was six months ago: tool call failures.

The issue is rarely about missing tools. It is about understanding the architecture that decides which tools the model can actually see.

Tool calling is the mechanism that lets an OpenClaw agent execute actions rather than just generate text. When the agent decides it needs to run a shell command, read a file, or search the web, it emits a structured function call. The runtime intercepts that call, validates it against active policies, executes the function, and returns the result as context for the agent's next step.

This works differently from prompt engineering. A prompt tells the model what to say. Tool calling lets the model do things: create files, open browser sessions, send messages to channels, schedule recurring jobs. The model receives typed function definitions with parameter schemas, selects the right function for the current task, and gets structured results back.

Here is the part most guides skip. The tools a model can call are not the same as the tools installed on the system. Between installation and visibility sit five enforcement layers that filter, restrict, and gate which tool schemas reach the model for any given turn. If a policy removes a tool, the model never receives its schema. It cannot call what it cannot see. When your agent ignores a tool you know is installed, the answer is almost always somewhere in those permission layers.

OpenClaw ships nine built-in tool categories that cover the core capabilities agents need. Eight handle primary agent workflows. The ninth covers infrastructure administration.

Runtime manages command execution and process control through tools like exec, process, and code_execution. Shell commands, scripts, and long-running processes all live here. Runtime tools carry the highest risk because they allow arbitrary code execution, which is why they are the most commonly gated category.

Files handles workspace file operations: read, write, edit, and apply_patch. Agents use these to inspect codebases, modify configuration, and produce output artifacts. File access is scoped to the agent's workspace directory by default, with explicit configuration required for broader filesystem access.

Web provides information retrieval through web_search, x_search, and web_fetch. These tools pull live data from search engines and web pages, giving agents access to information beyond their training data.

Browser automates browser sessions for tasks that require rendering a full web page. This covers page navigation, form interaction, and screenshot capture.

Messaging handles channel communication through the message tool. Agents use this to reply in Telegram, Discord, Slack, WhatsApp, or other bound channels without needing custom integrations per platform.

Sessions/Agents enables multi-agent coordination with tools like subagents, goal, and session_status. A parent agent can spawn sub-agents for parallel work, assign specific goals, and check progress. This category is what makes delegated workflows possible.

Automation manages scheduled and event-driven work through scheduling and heartbeat tools. Agents can create recurring tasks on a timed schedule or respond to system heartbeat checks that keep long-running sessions alive.

Media covers content generation and analysis, including image creation, text-to-speech, and video generation. Agents use these tools to produce visual and audio content from text prompts.

Gateway/Nodes is the ninth category, focused on infrastructure inspection. It is primarily an administrative toolset for checking gateway status and node health rather than building end-user agent workflows.

For a quick reference: the eight primary categories are Runtime (commands), Files (read/write), Web (search/fetch), Browser (automation), Messaging (channels), Sessions/Agents (multi-agent), Automation (scheduling/events), and Media (image/audio/video). Gateway/Nodes rounds out the set with infrastructure diagnostics.

Tool policy in OpenClaw is enforced before the model call. This design decision makes the system secure, but it also creates the most common debugging challenge. If a policy removes a tool at any layer, the model never receives that tool's schema for the turn. The agent does not report a missing tool. It never considers using one that has been filtered out.

Five layers evaluate in sequence, each one capable of stripping tools from the model's view.

Global configuration sets the baseline through instance-level allow and deny lists. These apply to every agent on the system. A tool on the deny list disappears for everyone, regardless of what individual agents specify.

Per-agent configuration narrows the baseline for specific agents. Each agent entry can define its own allow and deny overrides. This is how you prevent a customer support bot from running exec while keeping shell access available for your development agent.

Provider restrictions remove tools the current model cannot handle. Not every language model supports function calling. If the active provider lacks tool-call support, the runtime strips all tool schemas from the prompt entirely. This is the silent failure that catches developers who switch from a cloud API to a local model without checking tool compatibility first.

Channel permissions apply context-specific rules based on where the conversation originates. A Telegram channel might allow web_search but deny exec. A direct terminal session might allow everything. These policies evaluate fresh on every turn, so the same agent can have different tool access depending on the channel.

Sandbox state and plugin availability form the final gate. Sandbox mode restricts filesystem and network access regardless of what the tool policy allows. Plugin-provided tools only appear when their owning plugin is installed, enabled, and its dependencies are satisfied. A tool that passes the first four layers can still vanish here if its plugin is disabled or missing.

When an agent ignores a tool you expect it to use, trace through these layers in order. Start with global config, check per-agent overrides, verify the model provider supports tool calls, review channel policies, then confirm sandbox settings and plugin state. Comparing the tool schemas the model actually received (visible in session transcripts) against your expected tool list reveals exactly which layer filtered the missing tool.

The distinction between tools, skills, and plugins is the most commonly confused part of OpenClaw's architecture. Each serves a different purpose, and understanding the boundaries prevents most configuration mistakes.

Tools are typed functions the agent can call. They execute immediately: run a command, read a file, fetch a web page. Tools have parameter schemas, return structured results, and live inside the runtime. You do not write tools in markdown. They are code, registered either as built-in functions or through plugin manifests.

Skills are markdown instruction files that teach agents how and when to use tools. Each skill lives in a directory containing a SKILL.md file with YAML frontmatter and a markdown body. The frontmatter declares the skill name and description. The body contains workflow instructions that get injected into the agent's system prompt when the skill loads.

Skills do not execute anything. They provide knowledge, not capability. A skill might teach an agent how to combine web_search and write to research a topic and save the results in a specific format. The skill supplies the procedure. The tools supply the execution. Well-written skill descriptions improve tool selection accuracy because the model gets explicit guidance on when each tool is appropriate and how to structure its parameters.

This distinction matters operationally. A skill can only reference tools that exist and pass all five permission layers. Installing a skill for image generation does nothing if the image_generate tool is filtered out by provider restrictions or a missing plugin.

Plugins extend the platform by contributing new tools, skills, model providers, channels, and lifecycle hooks through installable code packages. A plugin can simultaneously add a new tool and the skill that explains how to use it. Examples of plugin-provided tools include Canvas, Tool Search, and LLM Task.

The hierarchy is straightforward. Plugins provide tools and skills. Skills reference tools. Tools do the actual work.

Skill loading follows a strict precedence order. When the same skill name exists in multiple locations, the highest-priority source wins. Workspace skills take the top spot, followed by project agent skills, personal agent skills, managed local skills, bundled skills shipped with OpenClaw, and finally plugin-provided skills at the lowest priority. This means you can always override a community skill by placing a modified copy in your workspace's skills/ directory.

ClawHub, the public skills registry at clawhub.ai, hosts the community catalog. Skills installed from ClawHub include verification metadata and security scan results. Third-party skills are untrusted code that runs in your agent's context, so reviewing them before installation is standard practice.

Agent allowlists add another layer of visibility control on top of the loading hierarchy. Even if a skill is installed and loaded, per-agent allowlists restrict which agents can see it. You configure a defaults block that applies to all agents, then override per agent as needed. An agent with an explicit skill list sees only those skills, ignoring defaults entirely. This keeps a focused code-review agent from being distracted by deployment skills it has no reason to trigger.

Give your OpenClaw agents a persistent workspace

Fast.io workspaces auto-index every file your agents upload, making outputs instantly searchable and shareable with your team. Version history, audit logging, and MCP access included. Start with a 14-day free trial.

Start 14-Day Trial

Tool chaining turns isolated function calls into complete workflows. The agent calls one tool, uses its output to decide the next step, calls another tool, and continues until the task is done. No orchestration framework is required. The model's conversation loop handles sequencing naturally.

A typical research workflow chains three tool categories:

1. web_search finds relevant sources for a topic
2. web_fetch extracts content from the best results
3. write saves a structured summary to a file

Each step's output feeds the next step's context. The model reads the search results, picks which URLs to fetch, processes the extracted content, and decides what to write. The chaining logic is implicit in the conversation rather than declared in a pipeline definition.

More complex workflows cross category boundaries. A code review agent might chain read (inspect source files), exec (run the test suite), web_search (check library documentation for a version change), and message (report findings to a Telegram channel). Each category contributes a distinct capability, and the model coordinates them based on what the task requires.

Multi-agent chaining adds another dimension through the Sessions/Agents tools. A parent agent spawns sub-agents for parallel work, each operating with its own tool access and skill set. The parent assigns goals, the sub-agents execute using their available tools, and results flow back for synthesis. Per-agent skill allowlists become critical here because each sub-agent should see only the tools relevant to its delegated task.

The outputs that tool chains produce need to go somewhere persistent. Local filesystem works for single-user experiments, and services like S3 or Google Drive handle basic team storage. For workflows where agents and humans need to collaborate on the same files with built-in search and versioning, a platform like Fast.io fits well. Agents write outputs to Fast.io workspaces through its consolidated MCP toolset, which auto-indexes uploaded files for semantic search and AI-powered retrieval. A research agent's summary becomes immediately searchable by other agents and human teammates in the same workspace, with full version history and an append-only audit log tracking every change.

The ownership transfer pattern works especially well with tool-chained workflows. An OpenClaw agent builds an entire workspace of research, generated code, or processed data, then transfers ownership to a human who reviews and distributes the results. The agent retains admin access for follow-up tasks while the human takes over decision-making. This is cleaner than passing files through email or shared folders because the workspace preserves full context: what was created, when it was created, and what intelligence metadata is attached to each file.

Not every language model can handle tool calling. The model needs specific training on function-call data and a chat template that supports the structured output format OpenClaw expects. Running an untrained model against tool schemas produces silent failures, malformed JSON, or unparseable output.

Community benchmarks as of mid-2026 point to several reliable options for locally hosted models. Qwen 3.6 27B dense handles nested JSON, missing-parameter recovery, and the choice to skip a tool call better than earlier models in the Qwen family. For memory-constrained systems, Qwen 3.6 35B-A3B MoE runs on 16GB RAM using CPU-offloaded mixture-of-experts layers. Qwen 2.5 7B works as a minimal fallback on 8GB systems, though smaller models show measurably lower accuracy on tool selection tasks. One benchmark found 0.933 F1 accuracy for a 7B model, with scores degrading as tool call complexity increases. Gemma 4 26B-A4B delivers solid results but requires disabling its thinking mode to prevent tool calls from being routed into reasoning output instead of the function-call channel.

Cloud-hosted models from Anthropic, OpenAI, and Google all support tool calling natively. The key consideration with cloud providers is format consistency. Anthropic's format uses unique IDs to match every tool_use block with a corresponding tool_result block. OpenAI's format handles matching differently. Switching providers mid-session without clearing conversation history can corrupt the tool-call chain, producing persistent "tool result's tool id not found" errors that only resolve by starting a fresh session.

Six failure patterns account for most tool-call debugging work:

• The model lacks tool-call training entirely. Base models like unmodified Llama 3 or Phi-4 fail silently or produce plaintext where JSON is expected.
• Malformed JSON output from smaller models, including broken JSON with preamble text, trailing commas, incorrect types, or function names that do not match any registered tool.
• Schema format mismatches between providers. Mixing Anthropic and OpenAI formats mid-session creates orphaned tool blocks with no matching result entries.
• Context overflow from tool definitions. Detailed schemas for five to ten tools consume 3,000 to 5,000 tokens, leaving less room for conversation history and reducing the model's ability to reason about which tool to call.
• Session corruption from interrupted tool calls. An aborted tool_use block without a matching tool_result triggers errors on every subsequent turn until the session is reset.
• Streaming implementation gaps in local inference servers. Some servers do not emit tool-call delta chunks correctly under streaming mode, returning empty responses instead of structured function calls.

Temperature affects reliability as well. Values between 0.6 and 0.7 produce more consistent structured output than the default 0.8, particularly for workflows that depend on precise JSON formatting across repeated tool calls.