@client_tool for a capability executed by the connected client.
Client-tool properties
Transport flow
The submitted result is identity-bound, one-time, and validated against the declared return type.
With an Agent Runtime Principal, client tools need an explicit permission held by that principal. Harnest checks it before exposure and execution; the client must still authorize the local action.
Private client input
Use@client_input to collect a password, token, or other private client value for trusted application code. Harnest delivers the validated input to the handler and exposes only a separately declared response to the model.
connect_account is your server-side integration. Its first parameter receives the private Pydantic value and is hidden from the model. Other parameters, such as service, are public arguments sent to the client.
Private input is delivered once to an async server handler and is not staged into history, checkpoints, or telemetry. It cannot be used inside durable tools. See the client_input contract for handler, response, timeout, and failure rules.
Successful handlers return the authored response to the model; failures do not. Do not stack @tool or @client_tool on @client_input.
Your handler and client remain responsible for their own logging, storage, and outbound calls. Keep private input out of prompts, public state, chat history, and telemetry. Delivery is process-local: it offers neither secure memory erasure nor restart recovery.
Private prompts use the same JSON, SSE, and WebSocket transport as client tools, with privateInput: true and inputSchema on the requested action. AG-UI uses an explicit private_input interrupt, rather than the automatic frontend tool-result loop.
Combine with approval
@client_tool and @require_human_approval can appear in either decorator order. Approval runs first. After approval, the host receives the client-tool request.
@client_input supports the same approval decorator ordering and runtime permission checks.
Human approvals
Bind approval to the exact user, session, invocation, action, and arguments.
Serving agents
Implement approval and client-tool responses over each transport.