Agent tools in the Python SDK — bash, file operations, and skills — are exposed through beta_agent_toolset_20260401, which returns async-only tools for use with async session runners and requires explicit import to avoid loading heavy stdlib dependencies. File tools confine operations to a workdir; bash runs unrestricted and requires OS-level sandboxing, while skill downloads are managed separately in _skills.py with restrictive permissions.
src/anthropic/lib/tools/agent_toolset.py is not exported from anthropic.lib.tools.__init__ — because importing it pulls in subprocess and other heavy stdlib modules, it must be depended on explicitly: from anthropic.lib.tools.agent_toolset import beta_agent_toolset_20260401.[1] The public surface of agent_toolset.py (its __all__) exports: AgentToolContext, BashSession, BashResult, resolve_path, beta_agent_toolset_20260401, beta_bash_tool, beta_read_tool, beta_write_tool, beta_edit_tool, beta_glob_tool, and beta_grep_tool.[1] src/anthropic/lib/tools/_skills.py is split out from agent_toolset to keep skill download and archive extraction as a separate concern from the tool implementations themselves.[2] Memory-related types BetaManagedAgentsMemory, BetaManagedAgentsMemoryVersion, and BetaManagedAgentsDeletedMemory (in src/anthropic/types/beta/memory_stores/) document version-retention behaviour when memories are updated or deleted. In src/anthropic/resources/skills/versions.py, the string "latest" is a valid value for skill version references, as documented in the resource's docstrings.
beta_agent_toolset_20260401 returns a list[BetaAsyncFunctionTool] — async function tools only — so it is compatible exclusively with async runners: client.beta.sessions.events.tool_runner(...) (the SessionToolRunner) for a managed-agents session, or the EnvironmentWorker for self-hosted environments. The sync messages.tool_runner(...) accepts BetaRunnableTool, which excludes async function tools, and therefore cannot consume this toolset.[1]
The file tools (read, write, edit, glob, grep) confine all paths to workdir (symlink-aware) and are considered safe without a sandbox; the bash tool is unrestricted regardless of path settings and must be sandboxed at the OS layer.[1] Skill directories created by _skills.py are assigned mode 0o700 (owner-only) rather than inheriting the process umask, because they may contain downloaded third-party content.[2] In src/anthropic/lib/tools/_files.py, the read tool permits a view_range-bounded read to succeed even when the total file size exceeds the size cap; only unbounded reads of oversized files are refused. File tools in src/anthropic/lib/tools/_files.py and the beta built-in memory tool in src/anthropic/lib/tools/_beta_builtin_memory_tool.py read and write files in binary mode (rb/wb) to preserve exact byte sequences and avoid OS line-ending translation (e.g., \r\n → \n on Windows) that would corrupt non-text payloads.
Sources