Tools

Beyond answering questions, your agent can do things — look up a calendar, check availability, create a record, or call your own backend. These actions are tools, and you manage them from the Tools card on the agent page.

There are two ways to give your agent tools: connect a third-party app, or add a webhook to your own endpoint.

Connecting an app

Lorito connects to many third-party apps through Composio — calendars, email, support tools, and more. Connecting one is a one-time setup per project, done in Customize → Connections.

A connected app stays connected until you disconnect it from the same screen. Disconnecting stops every agent in the project from using it.

Choosing which tools the agent may use

A single app can expose many individual tools. You stay in control of which ones your agent is actually allowed to call.

Once an app is connected, it appears in the agent's Tools card under Connections. Toggle it on to enable it for that agent, then use Configure tools to choose its tools:

• Recommended — when you first enable an app, Lorito pre-selects a safe set of tools suited to customer-facing use. This is the best starting point for most agents.
• All tools — enable everything the app offers, including any tools added to it in the future. Choose this when you want the agent to have the app's full range.
• A custom selection — pick exactly the tools you want, one by one.

Removing an app from an agent's tools list stops that agent from using it, but leaves the connection in place — you can re-add it any time. The number of connection tools an agent can use at once is subject to your plan's limit.

Webhooks

When you want the agent to call your own service — or an automation platform like Make.com — add a webhook. A webhook turns any HTTP endpoint into a tool the agent can invoke.

Click Add tool → Webhook in the Tools card and fill in:

• Tool name — a friendly name (for example, "Check Availability"). Lorito stores it in a short code form that you can reference in your system prompt.
• URL — the endpoint the agent should call.
• Description — tell the agent what the tool does and what data to send. The clearer this is, the better the agent uses it. For example: "Check appointment availability. Send the date and service. Returns available slots."
• Await response — turn on if the agent should wait for your endpoint to reply and use that reply in its answer.
• Secret (advanced) — an optional signing secret for verifying that requests genuinely come from your agent.

Each webhook can be toggled on or off, edited, or removed from the agent at any time. The number of webhooks, and the total number of tools an agent can use, are subject to your plan's limit — if you reach it, disable or remove one to add another.

What your endpoint receives

Every webhook call is a POST request with a JSON body shaped like this:

{
  "tool": "checkAvailability",
  "data": { "date": "2026-06-14", "service": "haircut" },
  "projectId": "9c3f6b2e-4a7d-4e1a-8f2c-1d5b6a9e0c3f",
  "deploymentId": "abc-123"
}

• tool — the tool's short code name, the same one shown under "Stored as" when you add it.
• data — the fields the agent filled in, based on your Description. This is the only part of the request the agent controls, so validate its shape before trusting it. Lorito doesn't check it for you.
• projectId — the project the agent belongs to.
• deploymentId — the channel deployment the conversation is happening on (which website widget, WhatsApp number, and so on), or null if the call isn't tied to a specific deployment.

If Await response is on, Lorito passes whatever your endpoint returns straight back to the agent as the tool's result. Return whatever your agent's instructions expect it to read (plain text or JSON). If the request times out or your endpoint returns a non-2xx status, the agent sees an error message instead and can tell the visitor its request failed.

Verifying requests

If you set a secret, every request Lorito sends to your endpoint is signed so you can confirm it genuinely came from your agent. Two headers are included:

X-Lorito-Signature: sha256=<hmac-sha256-hex>
X-Lorito-Timestamp: <unix-timestamp-seconds>

The signature is an HMAC-SHA256, keyed with your secret, over the timestamp and the raw request body joined by a dot — <timestamp>.<body> — and hex-encoded. To verify a request:

Here's the check in Node.js:

import crypto from "node:crypto";

function verify(rawBody: string, headers: Headers, secret: string) {
  const timestamp = headers.get("x-lorito-timestamp") ?? "";
  const signature = (headers.get("x-lorito-signature") ?? "").replace("sha256=", "");

  // Reject stale requests (replay protection).
  const ageSeconds = Math.floor(Date.now() / 1000) - Number(timestamp);
  if (!timestamp || ageSeconds > 300) {
    return false;
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}