github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-11 10:34:13 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #18074] issue: Global tools are not appearing in the "+" menu for the user chat #18482

New Issue
Closed
opened 2026-04-20 00:43:08 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-20 00:43:08 -05:00
Owner
Copy Link

Originally created by @avnerbarr on GitHub (Oct 6, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18074

Check Existing Issues

  • I have searched for any existing and/or related issues.
  • I have searched for any existing and/or related discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

0.6.32

Ollama Version (if applicable)

0.12.2

Operating System

MacOS 15.7

Browser (if applicable)

Chrome

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

I am following the instructions and added global tools.

  1. Notice that the documentation calls it "Tools", while in the UI it is called "External tools"
  2. In Admin settings , under "External tools" added several tools
Image Image

Documentation states:

🛠️ Global Tool Servers Look Different — And Are Hidden by Default!
If you've connected a Global Tool Server (i.e., one that’s admin-configured), it will not appear automatically in the input area like user tool servers do.

Instead:

Global tools are hidden by default and must be explicitly activated per user.
To enable them, you'll need to click on the ➕ button in the message input area (bottom left of the chat box), and manually toggle on the specific global tool(s) you want to use.
Here’s what that looks like:

Image

All tools in the global section are configured "Public" Accessible to all users

⚠️ Important Notes for Global Tool Servers:

They will not show up in the tool indicator popup until enabled from the ➕ menu.
Each global tool must be individually toggled on to become active inside your current chat.
Once toggled on, they function the same way as user tools.
Admins can control access to global tools via role-based permissions.

Image

Actual Behavior

In reality I don't see tools in the chat UNLESS, I've added them specifically under the "User tools"

Here is an example of this:

Image

Added a single tool (it also appears in the global section with other tools)

Image Image Image

None of these others (From global section) are showing (All configured as public):

Image

Steps to Reproduce

  1. Add tools to Admin section
  2. Set visibility to public
  3. try to use the tool in a chat - it doesn't appear
  4. Add the tool to the user tools
  5. The tool appears

Logs & Screenshots

Attached above

Additional Information

I am following the documentation best to my understanding. I hope I haven't misunderstood something. If so, it would seem to be not intuitive.

Thanks All!

Originally created by @avnerbarr on GitHub (Oct 6, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/18074 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version 0.6.32 ### Ollama Version (if applicable) 0.12.2 ### Operating System MacOS 15.7 ### Browser (if applicable) Chrome ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior I am following the instructions and added global tools. 1. Notice that the documentation calls it "Tools", while in the UI it is called "External tools" 2. In Admin settings , under "External tools" added several tools <img width="293" height="234" alt="Image" src="https://github.com/user-attachments/assets/cb4c4a2c-d04f-406b-ac70-9b065ca37cc0" /> <img width="2405" height="571" alt="Image" src="https://github.com/user-attachments/assets/b016d7a9-a8bd-4c53-87cb-0c88dde65741" /> Documentation states: > 🛠️ Global Tool Servers Look Different — And Are Hidden by Default! > If you've connected a Global Tool Server (i.e., one that’s admin-configured), it will not appear automatically in the input area like user tool servers do. > > Instead: > > Global tools are hidden by default and must be explicitly activated per user. > To enable them, you'll need to click on the ➕ button in the message input area (bottom left of the chat box), and manually toggle on the specific global tool(s) you want to use. > Here’s what that looks like: <img width="915" height="619" alt="Image" src="https://github.com/user-attachments/assets/dbeaeac9-3e11-4f02-aa03-8c456a6d97c7" /> All tools in the global section are configured "Public" Accessible to all users > ⚠️ Important Notes for Global Tool Servers: > > They will not show up in the tool indicator popup until enabled from the ➕ menu. > Each global tool must be individually toggled on to become active inside your current chat. > Once toggled on, they function the same way as user tools. > Admins can control access to global tools via role-based permissions. <img width="530" height="627" alt="Image" src="https://github.com/user-attachments/assets/e2acd1d1-5d50-4d6e-9182-799afec265ca" /> ### Actual Behavior In reality I don't see tools in the chat UNLESS, I've added them specifically under the "User tools" Here is an example of this: <img width="318" height="262" alt="Image" src="https://github.com/user-attachments/assets/9d993f85-229a-4aef-9817-238ee253900e" /> Added a single tool (it also appears in the global section with other tools) <img width="1205" height="496" alt="Image" src="https://github.com/user-attachments/assets/f3b13d39-60b6-49d3-9b69-cfd1fdf8045d" /> <img width="487" height="275" alt="Image" src="https://github.com/user-attachments/assets/c7d7681f-e7d7-4408-a153-868a1b677062" /> <img width="370" height="127" alt="Image" src="https://github.com/user-attachments/assets/2394b571-8eb8-4ef0-8a46-f965d635fd3a" /> None of these others (From global section) are showing (All configured as public): <img width="1008" height="404" alt="Image" src="https://github.com/user-attachments/assets/1df2cafb-e024-4467-9451-1f549bfff9dd" /> ### Steps to Reproduce 1. Add tools to Admin section 2. Set visibility to public 3. try to use the tool in a chat - it doesn't appear 4. Add the tool to the user tools 5. The tool appears ### Logs & Screenshots Attached above ### Additional Information I am following the documentation best to my understanding. I hope I haven't misunderstood something. If so, it would seem to be not intuitive. Thanks All!
GiteaMirror added the bug label 2026-04-20 00:43:08 -05:00
GiteaMirror commented 2026-04-20 00:43:09 -05:00
Author
Owner
Copy Link

@rgaricano commented on GitHub (Oct 6, 2025):

Check permissions.

Info:

Flow Diagrams

Workspace Tools (Native Python Tools) Flow

graph TB
    subgraph "Tool Creation"
        UserCreate["User initiates tool creation<br/>Workspace > Tools > Create"]
        PermCheck{"Permission Check<br/>user.role == 'admin' OR<br/>workspace.tools permission?"}
        CreateTool["POST /api/tools/create<br/>backend/open_webui/routers/tools.py:260"]
        LoadModule["load_tool_module_by_id()<br/>Execute Python code"]
        StoreDB["Store in Tool table<br/>user_id, access_control, specs"]
    end
    
    subgraph "Access Control Configuration"
        DefaultPrivate["Default: access_control = {}<br/>(Private, since v0.6.3)"]
        AccessModal["User clicks lock icon<br/>Access Control Modal"]
        SetAccess{"Set Access Level"}
        PublicAccess["access_control = None<br/>(Public to all users)"]
        GroupAccess["access_control = {read/write groups}<br/>(Specific groups)"]
        PrivateAccess["access_control = {}<br/>(Owner only)"]
    end
    
    subgraph "Tool Visibility & Usage"
        GetTools["GET /api/tools<br/>Retrieve available tools"]
        FilterTools{"Filter by access_control"}
        AdminBypass["Admin with BYPASS_ADMIN_ACCESS_CONTROL<br/>sees ALL tools"]
        UserFilter["User sees:<br/>- Own tools<br/>- Public tools (access_control=None)<br/>- Group-accessible tools"]
        IntegrationMenu["Tools appear in<br/>Message Input Integration Menu"]
    end
    
    UserCreate --> PermCheck
    PermCheck -->|"Denied"| PermError["HTTP 401 Unauthorized"]
    PermCheck -->|"Allowed"| CreateTool
    CreateTool --> LoadModule
    LoadModule --> StoreDB
    StoreDB --> DefaultPrivate
    
    DefaultPrivate --> AccessModal
    AccessModal --> SetAccess
    SetAccess --> PublicAccess
    SetAccess --> GroupAccess
    SetAccess --> PrivateAccess
    
    PublicAccess --> GetTools
    GroupAccess --> GetTools
    PrivateAccess --> GetTools
    
    GetTools --> FilterTools
    FilterTools --> AdminBypass
    FilterTools --> UserFilter
    AdminBypass --> IntegrationMenu
    UserFilter --> IntegrationMenu

External Tool Servers Flow

graph TB
    subgraph "External Tool Configuration"
        AdminConfig["Admin configures in<br/>Admin Settings > Tools"]
        UserConfig["User configures in<br/>Chat Settings > Tools"]
        
        GlobalServer["Global Tool Server<br/>TOOL_SERVER_CONNECTIONS env var<br/>or Admin UI"]
        DirectServer["Direct Tool Server<br/>User-level connection"]
        
        ServerType{"Server Type"}
        OpenAPIServer["OpenAPI Server<br/>Prefix: server:{id}"]
        MCPServer["MCP Server<br/>Prefix: server:mcp:{id}"]
    end
    
    subgraph "Permission Requirements"
        GlobalPerm["Global: Admin only<br/>to configure"]
        DirectPerm{"Direct Tool Permission<br/>USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS"}
        DirectAllowed["User can add<br/>direct connections"]
        DirectDenied["User cannot add<br/>direct connections"]
    end
    
    subgraph "Tool Server Visibility"
        GetToolsList["GET /api/tools<br/>Lists all available tools"]
        GlobalAccess{"Global server<br/>access_control check"}
        DirectAccess["Direct servers<br/>visible to owner only"]
        
        GlobalVisible["Visible if:<br/>- User is admin OR<br/>- User in allowed groups"]
        GlobalHidden["Hidden from user"]
        
        IntegrationMenu2["Appear in Integration Menu<br/>with server prefix"]
    end
    
    AdminConfig --> GlobalServer
    UserConfig --> DirectServer
    
    GlobalServer --> ServerType
    DirectServer --> DirectPerm
    
    ServerType --> OpenAPIServer
    ServerType --> MCPServer
    
    DirectPerm -->|"Enabled"| DirectAllowed
    DirectPerm -->|"Disabled"| DirectDenied
    
    OpenAPIServer --> GetToolsList
    MCPServer --> GetToolsList
    DirectAllowed --> GetToolsList
    
    GetToolsList --> GlobalAccess
    GetToolsList --> DirectAccess
    
    GlobalAccess -->|"Has access"| GlobalVisible
    GlobalAccess -->|"No access"| GlobalHidden
    
    GlobalVisible --> IntegrationMenu2
    DirectAccess --> IntegrationMenu2

Visibility Conditions Table

Tool Integration Menu Visibility Conditions

Tool Type User Role Permission Required Access Control Visible in Integration Menu? Identifier Format
Workspace Tool (Native Python) Admin None (always allowed) Any ✅ Yes (all tools) tool_id
Workspace Tool User workspace.tools = true access_control = None (Public) ✅ Yes tool_id
Workspace Tool User workspace.tools = true access_control = {} (Private) ✅ Yes (if owner) tool_id
Workspace Tool User workspace.tools = true Custom groups ✅ Yes (if in allowed group) tool_id
Workspace Tool User workspace.tools = false Any ❌ No (cannot create/see) N/A
Global External Tool Server (OpenAPI) Admin None Any ✅ Yes (all servers) server:{server_id}
Global External Tool Server (OpenAPI) User None access_control allows user's groups ✅ Yes server:{server_id}
Global External Tool Server (OpenAPI) User None access_control denies user ❌ No N/A
Global External Tool Server (MCP) Admin None Any ✅ Yes (all servers) server:mcp:{server_id}
Global External Tool Server (MCP) User None access_control allows user's groups ✅ Yes server:mcp:{server_id}
Global External Tool Server (MCP) User None access_control denies user ❌ No N/A
Direct External Tool Server Admin None N/A (owner-only) ✅ Yes (own connections) direct_server:{serverIdx}
Direct External Tool Server User features.direct_tool_servers = true N/A (owner-only) ✅ Yes (own connections) direct_server:{serverIdx}
Direct External Tool Server User features.direct_tool_servers = false N/A ❌ No (cannot configure) N/A

Key Permission Environment Variables

Permission Environment Variable Default Controls
Workspace Tools Access USER_PERMISSIONS_WORKSPACE_TOOLS_ACCESS false Can users create native Python tools?
Direct Tool Servers USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS false Can users add direct external tool connections?
Admin Bypass BYPASS_ADMIN_ACCESS_CONTROL true Do admins see all tools regardless of access control?
<!-- gh-comment-id:3370750541 --> @rgaricano commented on GitHub (Oct 6, 2025): Check permissions. Info: ## Flow Diagrams ### Workspace Tools (Native Python Tools) Flow ```mermaid graph TB subgraph "Tool Creation" UserCreate["User initiates tool creation<br/>Workspace > Tools > Create"] PermCheck{"Permission Check<br/>user.role == 'admin' OR<br/>workspace.tools permission?"} CreateTool["POST /api/tools/create<br/>backend/open_webui/routers/tools.py:260"] LoadModule["load_tool_module_by_id()<br/>Execute Python code"] StoreDB["Store in Tool table<br/>user_id, access_control, specs"] end subgraph "Access Control Configuration" DefaultPrivate["Default: access_control = {}<br/>(Private, since v0.6.3)"] AccessModal["User clicks lock icon<br/>Access Control Modal"] SetAccess{"Set Access Level"} PublicAccess["access_control = None<br/>(Public to all users)"] GroupAccess["access_control = {read/write groups}<br/>(Specific groups)"] PrivateAccess["access_control = {}<br/>(Owner only)"] end subgraph "Tool Visibility & Usage" GetTools["GET /api/tools<br/>Retrieve available tools"] FilterTools{"Filter by access_control"} AdminBypass["Admin with BYPASS_ADMIN_ACCESS_CONTROL<br/>sees ALL tools"] UserFilter["User sees:<br/>- Own tools<br/>- Public tools (access_control=None)<br/>- Group-accessible tools"] IntegrationMenu["Tools appear in<br/>Message Input Integration Menu"] end UserCreate --> PermCheck PermCheck -->|"Denied"| PermError["HTTP 401 Unauthorized"] PermCheck -->|"Allowed"| CreateTool CreateTool --> LoadModule LoadModule --> StoreDB StoreDB --> DefaultPrivate DefaultPrivate --> AccessModal AccessModal --> SetAccess SetAccess --> PublicAccess SetAccess --> GroupAccess SetAccess --> PrivateAccess PublicAccess --> GetTools GroupAccess --> GetTools PrivateAccess --> GetTools GetTools --> FilterTools FilterTools --> AdminBypass FilterTools --> UserFilter AdminBypass --> IntegrationMenu UserFilter --> IntegrationMenu ``` ### External Tool Servers Flow ```mermaid graph TB subgraph "External Tool Configuration" AdminConfig["Admin configures in<br/>Admin Settings > Tools"] UserConfig["User configures in<br/>Chat Settings > Tools"] GlobalServer["Global Tool Server<br/>TOOL_SERVER_CONNECTIONS env var<br/>or Admin UI"] DirectServer["Direct Tool Server<br/>User-level connection"] ServerType{"Server Type"} OpenAPIServer["OpenAPI Server<br/>Prefix: server:{id}"] MCPServer["MCP Server<br/>Prefix: server:mcp:{id}"] end subgraph "Permission Requirements" GlobalPerm["Global: Admin only<br/>to configure"] DirectPerm{"Direct Tool Permission<br/>USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS"} DirectAllowed["User can add<br/>direct connections"] DirectDenied["User cannot add<br/>direct connections"] end subgraph "Tool Server Visibility" GetToolsList["GET /api/tools<br/>Lists all available tools"] GlobalAccess{"Global server<br/>access_control check"} DirectAccess["Direct servers<br/>visible to owner only"] GlobalVisible["Visible if:<br/>- User is admin OR<br/>- User in allowed groups"] GlobalHidden["Hidden from user"] IntegrationMenu2["Appear in Integration Menu<br/>with server prefix"] end AdminConfig --> GlobalServer UserConfig --> DirectServer GlobalServer --> ServerType DirectServer --> DirectPerm ServerType --> OpenAPIServer ServerType --> MCPServer DirectPerm -->|"Enabled"| DirectAllowed DirectPerm -->|"Disabled"| DirectDenied OpenAPIServer --> GetToolsList MCPServer --> GetToolsList DirectAllowed --> GetToolsList GetToolsList --> GlobalAccess GetToolsList --> DirectAccess GlobalAccess -->|"Has access"| GlobalVisible GlobalAccess -->|"No access"| GlobalHidden GlobalVisible --> IntegrationMenu2 DirectAccess --> IntegrationMenu2 ``` ## Visibility Conditions Table ### Tool Integration Menu Visibility Conditions | Tool Type | User Role | Permission Required | Access Control | Visible in Integration Menu? | Identifier Format | |-----------|-----------|---------------------|----------------|------------------------------|-------------------| | **Workspace Tool (Native Python)** | Admin | None (always allowed) | Any | ✅ Yes (all tools) | `tool_id` | | Workspace Tool | User | `workspace.tools` = true | `access_control = None` (Public) | ✅ Yes | `tool_id` | | Workspace Tool | User | `workspace.tools` = true | `access_control = {}` (Private) | ✅ Yes (if owner) | `tool_id` | | Workspace Tool | User | `workspace.tools` = true | Custom groups | ✅ Yes (if in allowed group) | `tool_id` | | Workspace Tool | User | `workspace.tools` = false | Any | ❌ No (cannot create/see) | N/A | | **Global External Tool Server (OpenAPI)** | Admin | None | Any | ✅ Yes (all servers) | `server:{server_id}` | | Global External Tool Server (OpenAPI) | User | None | `access_control` allows user's groups | ✅ Yes | `server:{server_id}` | | Global External Tool Server (OpenAPI) | User | None | `access_control` denies user | ❌ No | N/A | | **Global External Tool Server (MCP)** | Admin | None | Any | ✅ Yes (all servers) | `server:mcp:{server_id}` | | Global External Tool Server (MCP) | User | None | `access_control` allows user's groups | ✅ Yes | `server:mcp:{server_id}` | | Global External Tool Server (MCP) | User | None | `access_control` denies user | ❌ No | N/A | | **Direct External Tool Server** | Admin | None | N/A (owner-only) | ✅ Yes (own connections) | `direct_server:{serverIdx}` | | Direct External Tool Server | User | `features.direct_tool_servers` = true | N/A (owner-only) | ✅ Yes (own connections) | `direct_server:{serverIdx}` | | Direct External Tool Server | User | `features.direct_tool_servers` = false | N/A | ❌ No (cannot configure) | N/A | ### Key Permission Environment Variables | Permission | Environment Variable | Default | Controls | |------------|---------------------|---------|----------| | Workspace Tools Access | `USER_PERMISSIONS_WORKSPACE_TOOLS_ACCESS` | `false` | Can users create native Python tools? | | Direct Tool Servers | `USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS` | `false` | Can users add direct external tool connections? | | Admin Bypass | `BYPASS_ADMIN_ACCESS_CONTROL` | `true` | Do admins see all tools regardless of access control? |
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#18482
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?