Tool calling

Native tool calling in the OpenAI shape: send tools (up to 128 function definitions) and tool_choice, and the model's tool_calls come back with finish_reason: tool_calls. Execution is always the agent's, on the agent's machine — the server runs nothing. Send results back as role: tool turns.

JSON

{"model": "qwen3.8-flash-next-whitehacker",
 "tools": [{"type": "function", "function": {"name": "read_file", "parameters": {"type": "object", "properties": {"path": {"type": "string"}}}}}],
 "tool_choice": "auto",
 "messages": [{"role": "user", "content": "Review src/auth.ts"}]}

→ "choices": [{"finish_reason": "tool_calls", "message": {"role": "assistant", "content": null,
     "tool_calls": [{"id": "call_1", "type": "function", "function": {"name": "read_file", "arguments": "{\"path\":\"src/auth.ts\"}"}}]}}]

# then: {"role": "tool", "tool_call_id": "call_1", "content": "<file contents>"}

Tool-definition characters count toward the input ceiling (524,288). The host-side firewall gates task kinds by assurance rung: code-review / vulnerability-triage / remediation from the identity rung; payload-crafting / c2-tooling refused until the contracted rung.