Skip to main content
Use @client_tool for a capability executed by the connected client.
Harnest never executes the declaration body. It suspends the invocation and asks the client to run the tool.

Client-tool properties

Transport flow

The submitted result is identity-bound, one-time, and validated against the declared return type. With an Agent Runtime Principal, client tools need an explicit permission held by that principal. Harnest checks it before exposure and execution; the client must still authorize the local action.

Private client input

Use @client_input to collect a password, token, or other private client value for trusted application code. Harnest delivers the validated input to the handler and exposes only a separately declared response to the model.
connect_account is your server-side integration. Its first parameter receives the private Pydantic value and is hidden from the model. Other parameters, such as service, are public arguments sent to the client. Private input is delivered once to an async server handler and is not staged into history, checkpoints, or telemetry. It cannot be used inside durable tools. See the client_input contract for handler, response, timeout, and failure rules. Successful handlers return the authored response to the model; failures do not. Do not stack @tool or @client_tool on @client_input. Your handler and client remain responsible for their own logging, storage, and outbound calls. Keep private input out of prompts, public state, chat history, and telemetry. Delivery is process-local: it offers neither secure memory erasure nor restart recovery. Private prompts use the same JSON, SSE, and WebSocket transport as client tools, with privateInput: true and inputSchema on the requested action. AG-UI uses an explicit private_input interrupt, rather than the automatic frontend tool-result loop.

Combine with approval

@client_tool and @require_human_approval can appear in either decorator order. Approval runs first. After approval, the host receives the client-tool request. @client_input supports the same approval decorator ordering and runtime permission checks.

Human approvals

Bind approval to the exact user, session, invocation, action, and arguments.

Serving agents

Implement approval and client-tool responses over each transport.