Fix: Main Agent Has No Exec Tools But Sub-Agents Do

You've set up OpenClaw, everything seems fine, but your main agent only gets these tools:

• sessions_list
• sessions_history
• sessions_send
• sessions_spawn
• session_status

No exec, no read, no write — nothing useful for actually doing work.

But here's the weird part: sub-agents spawned from main DO get exec tools. What's going on?

The Cause: Group/Channel Tool Restrictions

This almost always means a group or channel tool policy is being applied to your chat session. Sub-agents aren't in that group context, so they keep full tools — but your main agent is restricted.

These restrictions live under your channel config, not under the global tools.* settings.

Where to Look

Telegram Groups

Check:

openclaw config get channels.telegram.groups

Look for:

• channels.telegram.groups.<groupId>.tools
• channels.telegram.groups.<groupId>.toolsBySender
• channels.telegram.groups."*".tools (the default for all groups)

Discord Servers

Check:

openclaw config get channels.discord.guilds

Look for:

• channels.discord.guilds.<guildId>.tools
• channels.discord.guilds.<guildId>.channels.<channelId>.tools
• Any toolsBySender entries

What You're Looking For

If any of these have an allow list that doesn't include exec, or a deny list that blocks it, your main agent will be restricted.

Example of a restrictive config:

channels:
  telegram:
    groups:
      "*":  # Default for all groups
        tools:
          allow:
            - sessions_list
            - sessions_history
            - sessions_send
            - sessions_spawn
            - session_status

This would explain exactly why you only get sessions tools!

Quick Sanity Check

In WebChat, check which session key you're attached to. If it's something like:

• agent:main:telegram:group:...
• agent:main:discord:channel:...

...then group tool policy applies. WebChat shows the same restricted toolset because it's the same session.

The Fix

Option 1: Remove the Restriction

If you want exec tools in groups:

# Remove the tool allowlist entirely
openclaw config unset channels.telegram.groups."*".tools

# Or add exec to the allowed tools
openclaw config set channels.telegram.groups."*".tools.alsoAllow ["exec", "read", "write"]

Option 2: Use DMs Instead

Group restrictions typically don't apply to DMs. If you need full tools, use a direct message session instead of a group.

Option 3: Check Per-Agent Overrides

Even if global tools.* is unset, an agent can override at:

• agents.list[].tools.profile
• agents.list[].tools.allow/deny/byProvider

Check:

openclaw config get agents.list

After Changes

Restart the gateway:

openclaw gateway restart

Documentation

• Tool Policy Reference
• Group/Channel Tool Restrictions
• Exec Tool Details

Based on a question from the OpenClaw Discord #help channel. Thanks to the community for debugging this together!