Tools of a model node — search, page reading, code and functions

A model node can give the model tools. The settings name a tool by a neutral name — web_search, web_fetch, code_execution, a function — and Slen translates it into what the provider of the model takes. This page says what each tool is at each provider, what bounds the price of a call with tools, and how a run may bring tools of its own.

Two kinds of tools

• A built-in tool is run by the provider inside the call: it searches the web, reads a page, runs code, and the model answers with what it found. The search and the page cost tokens, and some tools cost money per call on top of them.

• A function is run by your code. The model only asks for it: the answer names the function and its arguments, the execution leaves through Function call, and your code runs the function and starts the next run with its result — Functions.

A node holds its tools in its settings, in this form:

{
  "model": "claude-haiku-4-5",
  "tools": [
    { "type": "web_search", "max_uses": 5, "allowed_domains": ["docs.example.com"], "user_location": { "country": "UA", "city": "Kyiv" } },
    { "type": "web_fetch", "max_uses": 3, "blocked_domains": ["ads.example.com"], "max_content_tokens": 20000 },
    { "type": "function", "name": "lookup_crm", "description": "Find a customer by email", "parameters": { "type": "object", "properties": { "email": { "type": "string" } } }, "strict": true }
  ],
  "tool_choice": "auto",
  "response_format": null,
  "input_overrides": null
}

The names at each provider

OpenAI has no tool of its own for reading a page: its web search opens pages by itself. Code execution is offered at Gemini only: at Anthropic and OpenAI it is paid by the time of a container, and a call with it could be neither priced in advance nor bounded. Which tools a model has, and which settings each takes, is in the catalogue — Models and prices — and the builder offers only those.

Set the tools of a node

When you choose another model, the tools it does not have stay in the node, greyed with the reason, and the flow is not published until you switch them off or choose a model that has them. A copy made by Add a fallback model keeps the tools of the original and is checked the same way.

What bounds a call

The price of a call with tools is not known in advance: the model decides how many times it searches, and every search adds to the input of the next round. What Slen can know is the most a call may cost — its ceiling:

• without built-in tools — the input of the call and max_output_tokens at the prices of the model;

• with built-in tools — every round of the call at the window of the model, the paid calls of the tools up to their limits, and the output ceiling. A model with a long-context tier is priced at the tier.

The panel shows it as «At most $X per call» once the draft is saved. That number is worked out before any input is known: the window of the model stands for the input, at the dearer of the input and the cache-write price, for every round of the server tools, with each paid call and max_output_tokens — or the default ceiling. The ceiling of a real call, whose input is known, is lower. It holds for the call as a whole, the continuations of an Anthropic call included. The output of Estimate Cost carries it as ceiling beside estimated_cost. A tool that takes a limit needs one — max_uses, from 1 to 20 — because without it nothing bounds the call.

A strict budget uses the ceiling: a call goes through only if what was spent, the ceilings of the calls in flight and the ceiling of the new call fit the limit — Budgets. A call without a ceiling is refused by a strict budget. A budget that is not strict takes the call by its hold, as always.

Anthropic

• web_search takes max_uses, allowed_domains or blocked_domains — one of the two, not both — and user_location. A search costs $10 per 1,000 on top of its tokens. A search that failed counts towards the limit and is not paid.

• web_fetch takes max_uses, the sites and max_content_tokens — how many tokens of one page go into the input. Reading a page costs only its tokens.

• A long call with tools may stop halfway; Slen continues it by itself up to 3 times, as one attempt. Each continuation gets only what is left of the call's limits — the searches and pages left of max_uses, the tokens left of max_output_tokens — and Slen does not continue when a limit is used up or when one more part could take the call past its ceiling. When the call has not ended, the answer is what the model wrote, with finish_reason incomplete.

• content of the output is the answer after the last search or page; what the model wrote before it is intermediate_text. The sources of the answer are citations, and an error of a search or a page inside a successful call is listed in tool_errors — AI Model.

• An Anthropic model has no response format: a node that asks for one is not published.

{
  "content": "The order ships on Monday.",
  "finish_reason": "stop",
  "intermediate_text": "Let me look up the delivery policy.",
  "citations": [{ "url": "https://docs.example.com/delivery", "title": "Delivery", "cited_text": "Orders ship on the next working day." }],
  "tool_errors": []
}

OpenAI

• web_search takes max_uses, allowed_domains and user_location; blocked sites are not taken. A search costs $10 per 1,000 calls on top of its tokens.

• One limit covers every built-in tool of a call at OpenAI: Slen sends the sum of the limits of the node. In the ceiling each of those calls is counted at the price of the dearest tool.

• gpt-5 takes no temperature: a node of that model with a temperature is not published — Models and prices.

• Without a location in the node, OpenAI is sent an empty approximate one: otherwise it assumes the United States. Its citations carry no quoted text — cited_text is null.

• OpenAI's own code of a refused request — context_length_exceeded and the like — is inside error.message of the node's output, as «OpenAI error (context_length_exceeded): …»; a Condition finds it with the operator contains on nodes.<key>.output.error.message.

{ "error": { "class": "rejected", "code": "provider_error", "message": "OpenAI error (context_length_exceeded): Your input exceeds the context window of this model." } }

Gemini

• web_search is Google Search, web_fetch is URL context, and code_execution runs code. None of them takes a setting: Gemini has no limit, no list of sites and no location for them.

• Gemini cannot limit its searches. How that bounds a call depends on how the model pays for Search. A model paid once per request that searched — Gemini 2.5 — has a ceiling: $35 per 1,000 such requests, and the results of the search are not billed as input. A model paid per search query — Gemini 3 and later — has none: a node with Search on such a model is published with the warning ai_model_tool_without_ceiling, the panel says that the ceiling is not guaranteed, and a strict budget refuses the call.

• URL context and code execution cost tokens only. The input they add is bounded by the window of the model, so a call with them has a ceiling.

• Gemini 2.5 takes no built-in tool beside a function, and no response format beside a tool: such a node is not published.

• Search suggestions. Google requires that an answer grounded in Google Search be shown to the end user with its search suggestions, unchanged. Slen hands them to your caller as grounding.search_entry_point of the output and does not keep a Google-grounded answer in the trace.

{ "model": "gemini-2.5-flash", "tools": [{ "type": "web_search" }, { "type": "web_fetch" }, { "type": "code_execution" }] }

{
  "content": "Kyiv is cloudy today, 12 °C.",
  "citations": [{ "url": "https://weather.example.com/kyiv", "title": "weather.example.com" }],
  "grounding": { "search_entry_point": "<div class=\"container\">…</div>" }
}

Free quotas of the providers

Providers give some use for free: Gemini a number of requests with Search a day, Anthropic hours of a code container a month. Slen counts every call as paid, so for small volumes its actual cost can be above the provider's bill. That errs on the side of the budget.

The response format

Response format asks for text, any JSON object (json_object) or JSON that follows a schema (json_schema). The builder lists only the formats the model has; OpenAI and Gemini have both kinds, Anthropic none.

Tools from the input of a run

A caller that moves its call to Slen often sends tools or response_format with it. By default a flow does not pass them to the model, and the answer of the run says so with a warning — the run is not stopped:

{
  "warnings": [
    { "code": "input_key_ignored", "keys": ["tools", "temperature"], "message": "The input carries keys of a model call the flow does not pass to the model: tools, temperature" }
  ]
}

The warning is in the answer of POST /v1/operations/execute, GET /v1/executions/{id}/status and GET /v1/executions/{id}, and in the trace. It names the keys of a model call the input carried and nothing reads, of these:

model, tools, tool_choice, response_format, temperature, top_p, max_tokens, max_output_tokens,
max_completion_tokens, stop, parallel_tool_calls, reasoning, text, instructions, system, generationConfig

A key a node reads — a path of a condition, a setting — is not named, and neither is a key of your own data.

The node can take them instead. Under From the run’s input the panel has three switches, saved as input_overrides:

• Accept tools (narrow only) — the built-in tools of input.tools replace those of the node for this run. Each has to be a tool the node has; its limit is at most the node's, and the node's is taken when none is given; allowed_domains may only narrow the node's list, blocked_domains are added to the node's. A tool the input does not name is not in the call, so the ceiling of the run is at most the ceiling of the node.

• Accept functions — the functions of input.tools are added to those of the node: at most 32 in all, a name the node does not have, a schema of at most 16 KB each.

• Accept a response format — input.response_format replaces the node's; the model has to have it.

How the sites of the input are compared: every name in lower case and without a trailing dot; a site is within another when it is the same name or a subdomain of it, and *.example.com covers the subdomains of example.com, not the name itself.

• Each allowed site of the input has to be within one of the node's allowed sites: docs.example.com is accepted under example.com.

• When an allowed list meets blocked sites, an allowed site within a blocked one is refused, and so is a blocked site below an allowed one — allowed example.com with blocked ads.example.com is something one list cannot say. A blocked site outside every allowed site is not needed and changes nothing.

With a switch off, the node does not read that key: the call is made with the node's own settings, and the warning names the key.

A run that breaks one of these rules ends before the model is called with 422 invalid_flow_input, and error.details says which node and why:

{
  "error": {
    "code": "invalid_flow_input",
    "message": "The input asks for a tool the node does not allow",
    "details": { "node": "answer", "reason": "tool_not_allowed", "tool": "web_fetch" }
  }
}

reason is one of these:

tool_not_allowed, max_uses_exceeds_node, domain_not_allowed, functions_not_allowed,
response_format_not_allowed, not_supported_by_model

Where to go next

• Functions — define a function, read the call, continue with a new run.

• AI Model — the settings, the ports and the output of the node.

• Models and prices — which tools each model has and what they cost.

• Budgets — a strict budget and the worst case of a call.