--- title: "Capabilities" description: "The Cloudflare tools the agent can use through the capability gate, their daily budgets, and what is not built." --- > Documentation Index > Fetch the complete documentation index at: https://oc-workers.mdick85.workers.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Capabilities The agent uses tools such as a browser, web pages, speech and images. Every tool goes through one gate in your Worker, so the container holds no credential for these services. ## The gate The capability gate answers at `http://15.0.0.3`, port 80, an address that your Worker serves and that exists only inside your install. The agent user (uid 1000) can reach only this gate and the sandbox gate at `15.0.0.4` (see [Sandbox](#sandbox)), and the container has no bearer token for either. If injected text steers the agent, a daily budget limits what it can spend. `ochost init` writes the gate into the OpenClaw config. The gate is then the agent's only browser, fetch, embedding and media provider. | Capability | Through the gate | Status | |---|---|---| | Browser | Cloudflare Browser Run, over CDP at `/browser/devtools` | Works. playwright-core and puppeteer-core connected and read a page title. | | Web fetch | Browser Run, through `/v2/scrape` and `/browser/markdown`, `/browser/content` | Experimental. The provider `cloudflare-web-fetch` of the `cf-capabilities` plugin posts to the gate through a loopback relay in the container. OpenClaw tries its own plain fetch first and calls the gate only for pages that the plain fetch cannot read. | | Web search | Cloudflare Web Search API, through `/search` | Experimental. The `cf-capabilities` plugin adds the provider "Cloudflare Web Search" to Settings > Search. It needs no API key. | | Embeddings | `@cf/baai/bge-m3` | Works through the gate (1024 dimensions). | | Speech out | `@cf/deepgram/aura-2-en` | Works through the gate. The reply is MP3. | | Transcription | `@cf/openai/whisper-large-v3-turbo` | Works through the gate. | | Image | `@cf/black-forest-labs/flux-1-schnell` | Works through the gate. | | Cloudflare docs | MCP server `https://docs.mcp.cloudflare.com/mcp`, no auth | Configured. | "Works through the gate" means a test call from the agent user returned a valid answer. We did not run a full agent turn for each tool. ### One plugin for web search, web fetch and the browser The plugin `cf-capabilities` ("Cloudflare capabilities") is in the image. Its card in Settings lists Web search, Web fetch and Browser, and it needs no API key. OpenClaw has no plugin API for the built-in browser tool, so the browser stays a config key (`browser.profiles.cf`) and the plugin only reads its state from the gate: `openclaw cf-capabilities status` prints `Browser: on, 40 s of 3600 s today`. `openclaw cf-capabilities test` runs one search, one fetch of `https://example.com` and one browser status read. On an older install, run `ochost config render`. Chat uses the gate too. The model provider `cfgw` points at `http://15.0.0.3/ai/v1`, and the Worker runs the call on its Workers AI binding. That is why no AI token exists. See [Models](https://oc-workers.mdick85.workers.dev/docs/models/). ## Budgets Each verb has a budget per UTC day. | Verb | Default | |---|---| | `browser` | 3600 seconds | | `neurons` | 100000 | | `requests` | 2000 | | `websearch` | 200 searches | | `exec` | 7200 seconds of sandbox commands | | `sandbox` | 8 hours of sandbox container time | At 80% you get a warning alert. At 100% you get a high alert, and the gate answers 429 with `retry-after`. Neuron use comes from the model's own count when it reports one; otherwise it is an estimate. The AI Gateway spend limit is the hard backstop. Claude calls (`anthropic/...`) count as requests, not neurons. ```sh ochost caps # used, limit and percent for each verb ochost caps set browser 7200 # raise or lower one limit ``` Browser Run includes 10 hours a month and then costs $0.09 per browser hour (rate read in October 2026). Check the Cloudflare pricing page for current prices. The owner console shows each budget on the Overview tab. See [How it works](https://oc-workers.mdick85.workers.dev/docs/how-it-works/#the-owner-console). ## File storage {#file-storage} The agent saves files to the storage location `r2`, which puts them in your R2 bucket under the prefix `f//` (`` is your install id). The files stay when the container stops, sleeps or restarts. They are not in snapshots or archives (see [State and backups](https://oc-workers.mdick85.workers.dev/docs/state-and-backups/)). - A plugin in the image (`ochost-storage`) adds the storage provider `ochost-r2` and the agent tool `file_store` (save, read, list, delete). - The plugin talks S3 to the replica gate at `15.0.0.2`, the part of your Worker that also stores the database backup. It goes through a loopback relay in the container (`127.0.0.1:18792`) and signs each request with the key of the current boot, the same key Litestream uses for the database. The gate accepts that key only for this boot's database path (`r//g/`) and `f//`. The key is not in the OpenClaw config. - The gate allows PUT, GET, HEAD, DELETE and list. It refuses multipart uploads, so one file is at most 100 MB. - A save never overwrites a file. Save to a new name. | Setting | Default | What it does | |---|---|---| | `files.capGb` | 5 | Total bytes under `f//`. At 80% you get the warning alert `storage-cap-80`. At 100% the gate refuses writes and sends the high alert `storage-cap-100`. | | `files.maxObjectMb` | 100 | Largest single file. | ```sh ochost caps # the files line shows bytes used and the cap ochost caps set storage 20 # raise the cap to 20 GB (same as config set files.capGb 20) openclaw storage test r2 # in the container: write, read and delete a check object ``` `ochost doctor` has a `file storage` row, which writes, reads and deletes a 1-byte object under `f//`. `ochost destroy --delete-data` deletes `f//` before it deletes the bucket. Without `--delete-data`, the files stay. ## Sandbox The tool sandbox is experimental and off by default. When it is on, the exec and file tool calls of a sandboxed session run in a separate Cloudflare Sandbox container, not in the gateway container. `ochost sandbox on` sandboxes every channel chat: your Telegram DM, group chats, other channels and sub-agents. Only the chat in the OpenClaw Control UI stays on the gateway. For its sandbox rule, OpenClaw classifies a channel DM by a per-peer key, even when the DM shares the main session; this is the pattern OpenClaw recommends. `ochost sandbox on --all` sandboxes every session, your main chat included. 1. Turn it on: ```sh ochost sandbox on # writes "sandbox": "on" in oc-host.jsonc; --all writes "all" ochost deploy ochost restart ``` 2. Check it: ```sh ochost sandbox # state, last sleep, exec and sandbox budgets ``` 3. Stop it when you want: ```sh ochost sandbox sleep # back up the workspace and stop the sandbox now ochost sandbox off ``` What to know: - The sandbox gate answers at `http://15.0.0.4`, port 80. The container holds no credential for it. - The sandbox has no internet access, so the agent cannot install packages there. - Web search, web fetch, the browser, memory, media, the message tool and `file_store` still run in the gateway container. OpenClaw's own sandbox policy leaves them out, so the render allows them for sandboxed sessions (`tools.sandbox.tools.alsoAllow`). - The sandbox starts at the first exec. It sleeps after 10 minutes without an exec, when the install sleeps, or when its budget is spent. - oc-workers backs up the sandbox `/workspace` to your R2 bucket at each sleep and every 30 minutes of use, and keeps the newest 2 backups. - The deploy builds the sandbox image even when the sandbox is off. ## Not built - A mode where the agent holds a Cloudflare API token. It would be opt-in. ## Next Go to [Configuration](https://oc-workers.mdick85.workers.dev/docs/configuration/). Source: https://oc-workers.mdick85.workers.dev/docs/capabilities/index.mdx