[ENHANCEMENT] Programmatic tool calling

[sjhatfield]

Problem (one or two sentences)

Programmatic tool calling allows an agent to write code to call tools more efficiently within a secure, sandboxed container. This avoids multiple round-trips to the model.

Anthropic page: programmatic-tool-calling
Minimal, secure Python interpreter written in Rust specifically for this purpose: monty

Context (who is affected and when)

This feature should help everyone who uses Roo

Desired behavior (conceptual, not technical)

Instead of calling multiple tools, the agent writes a short snippet of Python code, which includes the tool execution and pre/post-processing of results. This code snippet is executed in a sandboxed container

Constraints / preferences (optional)

No response

Request checklist

• I've searched existing Issues and Discussions for duplicates
• This describes a specific problem with clear context and impact

Roo Code Task Links (optional)

No response

Acceptance criteria (optional)

No response

Proposed approach (optional)

No response

Trade-offs / risks (optional)

No response

[roomote]

I'd like to help with this issue, but I need some clarification to ensure I implement the right solution. This is a substantial feature, so I want to make sure we're aligned on scope and approach before proceeding.

Questions:

1. Scope of initial implementation: Should we start with a focused subset of tools (e.g. read_file, write_to_file, execute_command, search_files) or aim to support all tools from the start?

2. Sandbox environment: The issue mentions monty (a minimal Python interpreter in Rust). Should this be the target runtime, or are you open to other sandboxing approaches (e.g. a WASM-based Python like Pyodide, or a Docker-based sandbox)?

3. Model integration: Anthropic's programmatic tool calling docs describe a specific flow where Claude generates Python code that calls tool functions. Should this be Anthropic-specific initially, or should the architecture support other providers that may adopt a similar pattern?

4. User control: Should there be a setting to enable/disable programmatic tool calling? Should it require separate auto-approval from regular tool calls?

5. Activation: Should this be opt-in (user enables it in settings), always-on for supported models, or triggered by model capability detection?

Please tag @roomote in your response with the answers, and I'll be happy to propose an implementation plan once I have this information.

[sjhatfield]

@roomote

Answers:

1. Scope of initial implementation: Should we start with a focused subset of tools (e.g. read_file, write_to_file, execute_command, search_files) or aim to support all tools from the start?

Starting with a subset of the basic tools would be an appropriate place to start.

2. Sandbox environment: The issue mentions monty (a minimal Python interpreter in Rust). Should this be the target runtime, or are you open to other sandboxing approaches (e.g. a WASM-based Python like Pyodide, or a Docker-based sandbox)?

Definitely open to other approaches. Docker would work for me, I imagine most users are familiar and are maybe already using docker for MCPs.

3. Model integration: Anthropic's programmatic tool calling docs describe a specific flow where Claude generates Python code that calls tool functions. Should this be Anthropic-specific initially, or should the architecture support other providers that may adopt a similar pattern?

It should be provider agnostic, but I'm not sure who, beyond anthropic support it. You should do some research.

4. User control: Should there be a setting to enable/disable programmatic tool calling? Should it require separate auto-approval from regular tool calls?

Yes, the feature should be behind an enable/disable option. Yes, tools should require approval to be used in the programmatic context.

5. Activation: Should this be opt-in (user enables it in settings), always-on for supported models, or triggered by model capability detection?

I think this feature is relatively new so not sure who supports it beyond Anthropic but it would be nice if we could detect which models support it and turn it on for those (still requiring tools be approved).

[roomote]

Thanks for the detailed answers @sjhatfield! I have seen your comment and will start exploring the codebase to design an implementation plan for programmatic tool calling. I will open a draft PR to share progress once I have something concrete. Stay tuned!

[roomote]

Opened a draft PR with the foundational architecture for programmatic tool calling: #11508

This includes:

• supportsProgrammaticToolCalling model capability flag (set on Anthropic Claude Sonnet 4.5, Opus 4.x)
• enableProgrammaticToolCalling user setting for opt-in
• Docker-based sandbox executor with resource limits and security constraints
• Python tool SDK with IPC bridge for read_file, write_to_file, execute_command, search_files, list_files
• 27 passing tests

The architecture is provider-agnostic so other models that support programmatic tool calling can be added by setting the flag. Still needs integration with the task pipeline and UI in follow-up PRs. Feedback welcome!