Configuration

The Tool module has no global settings form. Tools are plugins discovered from code, so there is nothing to configure for the base module beyond permissions.

Permissions

The module defines one permission:

Permission	Machine name	Grants
Administer tool	administer tool	Access to the Tool Explorer UI and its execute forms.

Grant administer tool only to trusted roles. A tool that runs behind the Explorer executes with the permissions of the acting user, but the Explorer itself is an administrative surface that lists every tool on the site.

Warning

Executing a tool can read data, write data, or trigger processes depending on the tool's operation. Treat administer tool as an administrative permission.

Access control

Each tool decides its own access in a checkAccess() method. When a tool runs, the runtime calls access() against the acting account. checkAccess() is abstract, so there is no default: a tool is only executable if its author implements the method and explicitly grants access.

The Drush tool:run command runs as anonymous by default, including when you pass --uid=0. For a tool that requires permissions, pass --uid with the ID of an enabled account that has those permissions. The tool's access checks and execution use that account. Pass --uid=1 only when you deliberately want superuser execution.

Config schema for tool inputs

A tool that accepts configuration should ship a config schema entry keyed tool.plugin.<plugin_id>. The Tool Explorer view page checks whether this schema exists and, when it is missing, prints a suggested schema built from the tool's input definitions. Copy that suggestion into config/schema/<module>.schema.yml in the module that provides the tool.

The suggested schema marks the root mapping FullyValidatable, which makes Drupal validate the stored values against their constraints. See Input and output definitions for how input definitions map to schema.