Ada gives customer-service agents sandboxed Python tools with controlled network access

Ada released code tools and a unified Tools API on August 21, 2026. A code tool can run restricted Python during a conversation, either by itself or around an external API call, before returning a smaller structured result to the AI agent. Network access is deny-by-default and limited to explicitly allowed domains plus the customer’s own Ada instance. Tools can be authored through Ada’s MCP Server, where changes go through a staged change set before promotion, or written directly through the Platform API. The new Tools API exposes list, get, create, update and delete operations for both HTTP/API tools and code tools.

Customer-service agents often need exact arithmetic, normalization, eligibility checks or data reduction that should not be delegated to probabilistic model reasoning. Ada’s new runtime gives operators a way to put that logic beside the agent without standing up a separate microservice for every small transformation. The useful change is the combination of deterministic code, network guardrails and an API/MCP authoring path; the trade-off is that the sandbox is deliberately constrained and direct Platform API writes bypass the staged MCP review flow.

A code tool can call an external endpoint, reshape or calculate over the response, and return only the fields the agent needs. Ada positions this for tasks such as refund calculations, code-to-label mapping, date or currency formatting and trimming large API payloads. Moving those operations into deterministic code can reduce both prompt volume and model drift.

Ada supports a restricted subset of Python rather than a general-purpose runtime. Runs have about five seconds of compute time and roughly 65 seconds end-to-end including network calls. Results must be simple structured values; tools cannot return files or images. Imports are limited to a small set of standard modules and classes are not supported.

Code tools use Ada’s fetch mechanism and can reach only domains placed on an allowlist plus the customer’s own Ada instance. Internal and metadata addresses are blocked, redirects are not followed, and each run is limited to ten requests with a 1 MB response cap per request. Those limits reduce SSRF-style exposure and bound accidental fan-out, but operators still need to control which domains are trusted.

When a tool is authored through Ada’s MCP Server, an AI assistant can generate the code and configuration into a change set that is staged and tested before promotion. A Platform API write applies directly. Teams using both paths should make that distinction explicit in deployment policy so a convenience API does not bypass the review process they expect from MCP-authored changes.

The Tools API provides a common inventory and CRUD surface for HTTP tools and code tools. Authorization headers are never returned, and sensitive environment values are write-only. That makes programmatic tool management easier, but it also turns the Tools API into a privileged configuration surface that should be scoped and audited accordingly.