What a Voice Agent Can Actually Do On a Call — and Why It Stops at Eight Tools

Six things, not sixteen

A voice agent that can only talk is a recording with better manners. What makes a call useful is the small number of things the agent can do in the middle of one — and that number is genuinely small here, on purpose.

Six actions cover almost every real call. All six arrive switched off, and an agent is capped at eight enabled tools in total. The last section explains why the cap is the interesting part.

1. Schedule a callback

"Call me back after five" is the single most common thing a person says to a phone agent that a phone agent usually cannot handle. Here it resolves: the relative time is worked out against your workspace clock, checked against your calling hours so nothing gets scheduled into a window you do not dial in, and the callback can be cancelled from the console before it fires.

Getting this right matters more than it looks. A callback booked in the wrong timezone rings somebody at eleven at night, and that is not a bug your customer forgives.

2. Capture a lead mid-call

The agent records a name, an email, a phone number and what the person actually wanted — without stopping the conversation to run a form. Partial details are accepted, because a caller who gives a name and a number and then has to go is still a lead, and an interrogation that demands all four gets you none of them.

Every captured lead deep-links back to the conversation it came out of, so the person following up reads what was said instead of a four-field summary. It is a per-agent switch, and it is the first one to turn on.

3. Hand over to a person

Escalation triggers are chosen per agent: hand over when the agent cannot answer, hand over when the caller asks for a person or is upset, or neither.

The part worth knowing is how "neither" is enforced. Turning escalation off does not add a polite line to the prompt. It removes the tool. There is nothing to call, so the behaviour cannot happen regardless of how the call goes. The same rule holds for every tool here: off means absent, not discouraged.

When the agent does escalate, the reasoning it wrote about why lands in an internal note the customer never sees, so whoever picks it up reads why before they respond.

4. Search the knowledge base

Instead of improvising a policy, the agent answers from your material — a website crawl one to three levels deep, a sitemap import, text you pasted, or files you uploaded as txt, md, csv, or the text layer of a PDF. There is no OCR, so a scanned price list is not a knowledge source; that one catches people out.

CSV chunking is row-aware, which matters on a phone call more than anywhere else: a price separated from its product produces a confident wrong answer, and a confident wrong answer spoken aloud is harder to walk back than a wrong answer in a chat window.

One knowledge base serves all 37 reply languages, so the Tamil caller and the English caller get the same refund policy rather than two versions that drifted apart.

5. Call something you have connected

For anything that is not in a document — an order status, a record in your own system, a slot in a calendar — the agent can call a tool during the call.

• Shopify ships, in two lanes. A no-authentication Storefront connection for catalogue, cart and checkout, and an OAuth Admin connection for order status and tracking. Two lanes because "what the shop window shows anyone" and "this specific person's order" have genuinely different trust requirements.
• 21 pre-registered MCP server connections, plus a directory of 1,434 services generated from the official registry. Twenty of those addresses are hand-verified; the rest are listed as published. That is a real distinction and we would rather state it than let you assume every entry has been tested.
• Your own HTTP endpoints, through Actions — the agent calls a URL you own with arguments it worked out from what the caller said.
• Any MCP address you paste, if you run your own server.

Credentials sign in through an OAuth popup, are sealed with AES-256-GCM, and are unreadable by the dashboard database role even with a hand-written query.

6. End the call properly

An ending is a capability, not an absence of one. The agent closes the call rather than trailing off; a caller who has gone quiet gets a nudge and then the call ends rather than billing silence; and you can set a maximum call duration so a stuck call cannot run indefinitely.

What lands afterwards: an outcome on the campaign report, the transcript as part of the conversation's own message history — which is why a phone call and a WhatsApp thread with the same customer sit in one place — recording playback for 30–75 days depending on plan, a CSV export, and a signed call finished webhook to your endpoint with the outcome, the seconds and the campaign.

The caller is not a stranger

Before the agent speaks, history from the customer's other channels is injected as a short digest — capped at six messages and 700 characters — and phone callers are matched to their WhatsApp and web history by number.

Because caller ID is spoofable, records are linked rather than merged, and the default disclosure tier lets the agent say "we have spoken on WhatsApp before" while withholding what was said until the person verifies. You can loosen that. We ship the cautious default, because anyone can ring a number claiming to be your customer.

Off by default, eight per agent, both on purpose

Every tool an agent discovers arrives switched off. Enabling one is a separate deliberate act. And an agent stops at eight.

• These tools are reachable by a stranger. Anyone can dial your number. Nothing being on by default means nothing gets exposed because somebody clicked Next through a setup screen.
• Every tool schema is re-sent on every turn. Models get measurably worse at choosing as the list grows, and on a phone call a wrong tool choice costs you two seconds of dead air and the caller's patience. A twelve-tool agent is not more capable than an eight-tool one; it is less reliable with a longer prompt.

Platforms advertise thousands of integrations. The number that decides whether your call works is how many are live on one agent at once, and ours has a ceiling.

What the agent cannot do on a call

• Verify who somebody is. There is no caller authentication and no one-time-code check inside a call. The disclosure tier exists precisely because we do not have verification yet, and pretending otherwise would be worse than the gap.
• Fetch the full earlier conversation. The cross-channel digest is capped; there is no retrieval tool that pulls the whole history on demand.
• Reach the customer on another channel. The agent cannot decide mid-call to send a WhatsApp message.
• Score the call. There is no in-call sentiment number and no AI judge marking the conversation out of ten. You get the transcript, the outcome and the talk time.
• Run on a speech-to-speech model. The pipeline is cascaded — speech to text, a language model, then speech synthesis.

Get started

Turn on two tools, not eight: lead capture and escalation. Run twenty calls. Read the transcripts and the internal notes the agent wrote when it handed over — that list tells you which third tool you actually need.

Build a voice agent free →

No credit card required • Trial includes 25 voice minutes and 200 chat replies