# List agent tools

> Returns the allowlisted non-intrusive tools agents may run, their skill and UI URLs, and the caller's rate limits.

Source: https://docs.vigilbase.com/tools/developers/api-reference/agent-tools/list-agent-tools-v1

`GET https://api.vigilbase.com/tools/v1/agent/tools`

Returns the allowlisted non-intrusive tools agents may run, their skill and UI URLs, and the caller's rate limits. Anonymous calls get the free tier (10 requests a minute per IP); a developer API key from https://one.vigilbase.com/developers gets 30 a minute.

> Deprecated aliases: `GET https://vigilbase.com/api/v1/agent/tools` (410 Gone from 2027-02-01), `GET https://vigilbase.com/api/agent/tools` (410 Gone from 2027-02-01). They answer with the same bodies, with a `Deprecation` header and a `successor-version` link to this URL. Until their `Sunset` date; from then on they answer `410 Gone` with the successor URL.

## Authorizations

Optional: requests without a key use the anonymous free tier.

- `Authorization` (string, header): Developer API key (prefix vb_dev_), as a Bearer token or in the X-Api-Key header. Format: `Bearer <token>`. Scope: `tools:read`.

## Responses

### 200 (application/json)

Success

- `success` (boolean, required): One of `true`.
- `apiVersion` (string)
- `description` (string)
- `openapi` (string)
- `docsUrl` (string)
- `skillsIndex` (string)
- `tools` (object[], required)
  - `toolName` (string, required)
  - `name` (string, required)
  - `description` (string, required)
  - `targetDescription` (string, required)
  - `uiUrl` (string, required)
  - `skillUrl` (string, required)
  - `executeUrl` (string, required): Where to POST a scan, on api.vigilbase.com/tools/v1 whichever host served the catalogue.
- `auth` (object)
  - `anonymousScopes` (string[])
  - `developerKeyScopes` (string[])
  - `header` (string)
  - `manageKeys` (string)
- `rateLimit` (object)
  - `windowSeconds` (integer): Minimum -9007199254740991, maximum 9007199254740991.
  - `maxRequests` (integer): Minimum -9007199254740991, maximum 9007199254740991.
  - `tier` (string)
  - `scope` (string)
  - `scanQuota` (object)
    - `windowSeconds` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `maxScansPerClientIp` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `maxScansPerTarget` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `maxScansOverall` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `scope` (string)
  - `dailyAllowance` (object): The free daily scan allowance executes spend, shared with the vigilbase.com tools.
    - `tier` (string, required): `anonymous` (per network), `signed_in` (per Vigilbase account, for signed-in Vigilbase MCP users) or `developer` (a developer API key spends none).
    - `limit` (integer): Scans per UTC day: 5 anonymous, 50 signed in; absent for a developer key. Minimum -9007199254740991, maximum 9007199254740991.
    - `used` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `remaining` (integer): Minimum -9007199254740991, maximum 9007199254740991.
    - `resetsAt` (string): Next UTC midnight, ISO 8601. Absent with used and remaining when the limiter could not answer.
    - `scope` (string)
- `deprecation` (object)
  - `legacy` (boolean, required): One of `true`.
  - `successor` (string, required)
  - `sunset` (string, required)

### 401 (application/problem+json)

Problem: `unauthorized`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 403 (application/problem+json)

Problem: `forbidden`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 429 (application/problem+json)

Problem: `rate_limit_exceeded`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 503 (application/problem+json)

Problem: `service_unavailable`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### default (application/problem+json)

Problem details (RFC 9457).

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

## Example request

```bash
curl --request GET \
  --url 'https://api.vigilbase.com/tools/v1/agent/tools'
```

With the Vigilbase CLI:

```bash
vigilbase list
```

## Example response (200)

```json
{
  "success": true,
  "apiVersion": "<string>",
  "description": "<string>",
  "openapi": "<uri>",
  "docsUrl": "<uri>",
  "skillsIndex": "<uri>",
  "tools": [
    {
      "toolName": "security-headers",
      "name": "<string>",
      "description": "<string>",
      "targetDescription": "<string>",
      "uiUrl": "<uri>",
      "skillUrl": "<uri>",
      "executeUrl": "<uri>"
    }
  ],
  "auth": {
    "anonymousScopes": [
      "<string>"
    ],
    "developerKeyScopes": [
      "<string>"
    ],
    "header": "<string>",
    "manageKeys": "<uri>"
  },
  "rateLimit": {
    "windowSeconds": 123,
    "maxRequests": 123,
    "tier": "<string>",
    "scope": "<string>",
    "scanQuota": {
      "windowSeconds": 123,
      "maxScansPerClientIp": 123,
      "maxScansPerTarget": 123,
      "maxScansOverall": 123,
      "scope": "<string>"
    },
    "dailyAllowance": {
      "tier": "<string>",
      "limit": 123,
      "used": 123,
      "remaining": 123,
      "resetsAt": "<string>",
      "scope": "<string>"
    }
  },
  "deprecation": {
    "legacy": true,
    "successor": "<uri>",
    "sunset": "<string>"
  }
}
```