Make builtin tools opt-in (ask_user)

go/api/adk/types.go

@@ -439,6 +439,7 @@ type AgentConfig struct {
 	Stream        *bool                 `json:"stream,omitempty"`
 	Memory        *MemoryConfig         `json:"memory,omitempty"`
 	ContextConfig *AgentContextConfig   `json:"context_config,omitempty"`
+	BuiltinTools  []string              `json:"builtin_tools,omitempty"`
 }
 
 // GetStream returns the stream value or default if not set

go/api/config/crd/bases/kagent.dev_agents.yaml

@@ -10042,6 +10042,22 @@ spec:
                           required:
                           - name
                           type: object
+                        builtin:
+                          description: BuiltinTool specifies which built-in tools
+                            to enable for the agent.
+                          properties:
+                            toolNames:
+                              description: The names of the built-in tools to enable.
+                              items:
+                                enum:
+                                - ask_user
+                                type: string
+                              maxItems: 10
+                              minItems: 1
+                              type: array
+                          required:
+                          - toolNames
+                          type: object
                         headersFrom:
                           description: |-
                             HeadersFrom specifies a list of configuration values to be added as
@@ -10142,9 +10158,11 @@ spec:
                           - enum:
                             - McpServer
                             - Agent
+                            - Builtin
                           - enum:
                             - McpServer
                             - Agent
+                            - Builtin
                           description: ToolProviderType represents the tool provider
                             type
                           type: string
@@ -10158,6 +10176,10 @@ spec:
                         rule: '!(has(self.agent) && self.type != ''Agent'')'
                       - message: type.agent must be specified for Agent filter.type
                         rule: '!(!has(self.agent) && self.type == ''Agent'')'
+                      - message: type.builtin must be nil if the type is not Builtin
+                        rule: '!(has(self.builtin) && self.type != ''Builtin'')'
+                      - message: type.builtin must be specified for Builtin filter.type
+                        rule: '!(!has(self.builtin) && self.type == ''Builtin'')'
                     maxItems: 20
                     type: array
                 type: object

go/api/v1alpha2/agent_types.go

@@ -350,25 +350,30 @@ type ServiceAccountConfig struct {
 }
 
 // ToolProviderType represents the tool provider type
-// +kubebuilder:validation:Enum=McpServer;Agent
+// +kubebuilder:validation:Enum=McpServer;Agent;Builtin
 type ToolProviderType string
 
 const (
 	ToolProviderType_McpServer ToolProviderType = "McpServer"
 	ToolProviderType_Agent     ToolProviderType = "Agent"
+	ToolProviderType_Builtin   ToolProviderType = "Builtin"
 )
 
 // +kubebuilder:validation:XValidation:message="type.mcpServer must be nil if the type is not McpServer",rule="!(has(self.mcpServer) && self.type != 'McpServer')"
 // +kubebuilder:validation:XValidation:message="type.mcpServer must be specified for McpServer filter.type",rule="!(!has(self.mcpServer) && self.type == 'McpServer')"
 // +kubebuilder:validation:XValidation:message="type.agent must be nil if the type is not Agent",rule="!(has(self.agent) && self.type != 'Agent')"
 // +kubebuilder:validation:XValidation:message="type.agent must be specified for Agent filter.type",rule="!(!has(self.agent) && self.type == 'Agent')"
+// +kubebuilder:validation:XValidation:message="type.builtin must be nil if the type is not Builtin",rule="!(has(self.builtin) && self.type != 'Builtin')"
+// +kubebuilder:validation:XValidation:message="type.builtin must be specified for Builtin filter.type",rule="!(!has(self.builtin) && self.type == 'Builtin')"
 type Tool struct {
-	// +kubebuilder:validation:Enum=McpServer;Agent
+	// +kubebuilder:validation:Enum=McpServer;Agent;Builtin
 	Type ToolProviderType `json:"type,omitempty"`
 	// +optional
 	McpServer *McpServerTool `json:"mcpServer,omitempty"`
 	// +optional
 	Agent *TypedReference `json:"agent,omitempty"`
+	// +optional
+	Builtin *BuiltinTool `json:"builtin,omitempty"`
 
 	// HeadersFrom specifies a list of configuration values to be added as
 	// headers to requests sent to the Tool from this agent. The value of
@@ -379,6 +384,15 @@ type Tool struct {
 	HeadersFrom []ValueRef `json:"headersFrom,omitempty"`
 }
 
+// BuiltinTool specifies which built-in tools to enable for the agent.
+type BuiltinTool struct {
+	// The names of the built-in tools to enable.
+	// +kubebuilder:validation:items:Enum=ask_user
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=10
+	ToolNames []string `json:"toolNames"`
+}
+
 func (s *Tool) ResolveHeaders(ctx context.Context, client client.Client, namespace string) (map[string]string, error) {
 	result := map[string]string{}
 

go/core/cli/internal/tui/workspace.go

@@ -535,6 +535,10 @@ func (m *workspaceModel) renderDetails() {
 					name = t.Agent.Name
 				}
 				fmt.Fprintf(&m.details, "- Agent tool: %s\n", name)
+			case v1alpha2.ToolProviderType_Builtin:
+				if t.Builtin != nil && len(t.Builtin.ToolNames) > 0 {
+					fmt.Fprintf(&m.details, "- Builtin tools: %s\n", strings.Join(t.Builtin.ToolNames, ", "))
+				}
 			default:
 				fmt.Fprintf(&m.details, "- Tool: (unknown type)\n")
 			}

go/core/internal/controller/reconciler/reconciler.go

@@ -537,6 +537,8 @@ func (a *kagentReconciler) validateCrossNamespaceReferences(ctx context.Context,
 			if err := a.validateAgentToolReference(ctx, agent.Namespace, tool.Agent); err != nil {
 				return err
 			}
+		case tool.Builtin != nil:
+			// Builtin tools are self-contained, no cross-namespace validation needed
 		}
 	}
 

go/core/internal/controller/translator/agent/adk_api_translator.go

@@ -300,6 +300,7 @@ func (a *adkApiTranslator) validateAgent(ctx context.Context, agent *v1alpha2.Ag
 			if err != nil {
 				return err
 			}
+		case v1alpha2.ToolProviderType_Builtin:
 		}
 	}
 
@@ -754,6 +755,8 @@ func (a *adkApiTranslator) translateInlineAgent(ctx context.Context, agent *v1al
 			default:
 				return nil, nil, nil, fmt.Errorf("unknown agent type: %s", toolAgent.Spec.Type)
 			}
+		case tool.Builtin != nil:
+			cfg.BuiltinTools = append(cfg.BuiltinTools, tool.Builtin.ToolNames...)
 
 		default:
 			return nil, nil, nil, fmt.Errorf("tool must have a provider or tool server")

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_builtin_ask_user.yaml

@@ -0,0 +1,52 @@
+operation: translateAgent
+targetObject: builtin-agent
+namespace: test
+objects:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: openai-secret
+      namespace: test
+    data:
+      api-key: c2stdGVzdC1hcGkta2V5
+  - apiVersion: kagent.dev/v1alpha2
+    kind: ModelConfig
+    metadata:
+      name: basic-model
+      namespace: test
+    spec:
+      provider: OpenAI
+      model: gpt-4o
+      apiKeySecret: openai-secret
+      apiKeySecretKey: api-key
+      openAI:
+        temperature: "0.7"
+        maxTokens: 1024
+        topP: "0.95"
+        reasoningEffort: "low"
+      defaultHeaders:
+        User-Agent: "kagent/1.0"
+  - apiVersion: kagent.dev/v1alpha2
+    kind: Agent
+    metadata:
+      name: builtin-agent
+      namespace: test
+    spec:
+      type: Declarative
+      declarative:
+        description: An agent with builtin tools
+        systemMessage: You are a helpful assistant.
+        modelConfig: basic-model
+        deployment:
+          resources:
+            requests:
+              cpu: 200m
+              memory: 684Mi
+            limits:
+              cpu: 3000m
+              memory: 2Gi
+        tools:
+          - type: Builtin
+            builtin:
+              toolNames:
+                - ask_user