Free tools Windows power users keep installed
One-click scans. No signup required.
A Microsoft Foundry toolbox is a named, versioned collection of tool configurations that an agent reaches through a single MCP-compatible endpoint. It removes per-agent tool wiring, but it doesn’t make tool calls trustworthy by itself. That depends on four things you control: separate identities at each boundary, downstream credentials kept in project connections, a minimal tool set, and an agent runtime that enforces approval before every invocation. This guide covers each, based on Microsoft Learn documentation checked in October 2026.
How the toolbox pattern works
A toolbox bundles tool definitions, including MCP servers and other tool types, behind one endpoint. The agent discovers what is available through the MCP tools/list method and invokes tools through the same endpoint.
As an Amazon Associate I earn from qualifying purchases.
Microsoft describes tool names as namespaced by server label, in the form {server_label}.{tool_name}. That matters when you write allow lists or debug discovery: a filter for search will not match docs.search.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFoundry’s hosted-agent integrations are documented for Python and .NET. Other runtimes can connect with an MCP Streamable HTTP client and an Azure token scoped to https://ai.azure.com/.default, but they must implement the hosted-agent runtime contract themselves.
#1 Best Overall
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Choosing an endpoint: default-following or pinned
| Endpoint | Behavior | Use it for |
|---|---|---|
| Unversioned consumer endpoint | Serves the toolbox’s default_version. Promoting a new default changes what it serves, with no change to the agent endpoint and no redeploy. |
Production agents that should pick up promoted versions. |
| Version-specific endpoint | Targets an immutable version. | Testing a version before you promote it. |
The consequence: promotion is a change to live agent behavior. Test the candidate on its version-specific endpoint first, then promote.
Two trust boundaries, two identities
Agent to toolbox
The agent authenticates to the toolbox endpoint with its Microsoft Entra identity and the https://ai.azure.com/.default scope.
Toolbox to downstream service
The toolbox’s project connection sets the downstream authentication mode. Microsoft documents anonymous access, shared credentials, service identities, and signed-in-user identity. Keep downstream credentials on the connection, never in agent code, and store shared keys and OAuth secrets as secrets in project connections.
Rank #2
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
| Identity model | What the downstream service sees | Trade-off |
|---|---|---|
| Shared or service credential | One identity for every caller | Simple, but every user gets the same downstream access. |
| Signed-in user (delegated) | The individual caller | Preserves per-user permissions, but needs caller context forwarded correctly and user consent. |
Getting per-user delegation right
- The downstream call must use the signed-in user’s identity, and the hosted-agent integration must forward the current request’s caller context.
- Do not hard-code or reuse the per-request call ID, which Microsoft explicitly warns against.
- Confirm the user has the right role and downstream permissions, and complete consent when prompted.
- Cross-tenant token exchange is not supported in the documented toolbox flow.
- Test with two users who have different permissions and check that each sees only data they may access. A successful call alone proves nothing about delegation.
Approval is a runtime control, not a prompt
A toolbox tool can carry _meta.tool_configuration.require_approval:
always: the runtime should show the proposed tool name and arguments, wait for explicit approval, and invoke only afterward. This repeats for every call.never: the tool can be invoked without a prompt.
The endpoint does not itself block a call marked always. Enforcement belongs to the agent runtime. Microsoft’s hosted-agent guidance is blunt about the alternative:
“A system-prompt instruction alone doesn’t enforce approval.” — Microsoft Learn, Use a toolbox with a hosted agent in Microsoft Foundry
Rank #3
Sale
Microsoft Surface Laptop (2026), 13.8-inch Premium Performance Laptop, Snapdragon X2 Elite Processor, Touchscreen Display, 16GB RAM, 512GB SSD Storage, Windows 11 Copilot+ PC Built for AI, Black
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
If your runtime can’t pause and resume, or reject the exact pending call, Microsoft advises using never rather than pretending always is protecting you. In that case, rely on narrow tool exposure and downstream permissions instead.
Least privilege in configuration
For a custom MCP server, Microsoft documents three authentication options: key-based credentials, Microsoft Entra managed identity, and OAuth identity passthrough. Choose the one the downstream service actually expects. For an Entra-protected Function App, the configured audience must match the app’s allowed audience, and the Foundry project identity must have access.
Expose only the subset of tools the agent needs, and give managed identities only the roles the tools require.
Rank #4
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 15" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 19 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 19 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- Two USB-C / USB4[4] ports and a microSD card reader for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
Optional gateway governance
Foundry’s AI gateway can route eligible MCP traffic through Azure API Management. Documented controls include authentication, rate limits, IP restrictions, routing, and centralized logging and metrics.
- Preview: Microsoft labels the feature preview, so check current availability before depending on it.
- Eligibility: routing applies to new MCP tools created in the Foundry portal that do not use managed OAuth.
- Policy caution: don’t strip required authentication headers. Microsoft specifically warns against deleting
Authorizationunless the MCP server doesn’t need it. - Verification: confirm the tool endpoint points at the gateway URL, then inspect API Management logs and metrics for requests and policy responses.
Troubleshooting checklist
Tools list is empty
Possible causes: missing connection credentials (the toolbox can’t retrieve manifests), an invalid allow-list name, a provisioning issue, or an unreachable source. Check that the toolbox has a default version and that tool and server labels match. Confirm MCP initialization and tools/list return the expected manifest.
Allow-list filter matches nothing
Check exact names, including the server-label prefix.
Best Value
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
401 or 403 errors
Work out which boundary failed. A rejection at the toolbox endpoint is an agent-to-toolbox problem (identity, scope). A rejection after the toolbox calls the tool is a downstream authorization failure on the connection or the user’s permissions.
Tool calls fail on hosted toolbox MCP
Microsoft’s toolbox article notes that non-streaming tools/call is unsupported and recommends stream=True.
SDK and endpoint instructions change between releases, so confirm exact syntax in the current Microsoft Learn pages before copying configuration into production.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
