diff --git a/scripts/dev-api.js b/scripts/dev-api.js
index b365bc7..5e3b7f6 100644
--- a/scripts/dev-api.js
+++ b/scripts/dev-api.js
@@ -3666,6 +3666,21 @@ function normalizeHermesMultilineList(value) {
     .filter(Boolean)
 }
 
+function normalizeHermesToolsetList(value, fieldName = 'agent.disabled_toolsets') {
+  const seen = new Set()
+  const normalized = []
+  for (const item of normalizeHermesMultilineList(value)) {
+    if (!/^[a-zA-Z0-9_.-]+$/.test(item)) {
+      throw new Error(`${fieldName} 只能包含字母、数字、下划线、点和短横线`)
+    }
+    if (!seen.has(item)) {
+      seen.add(item)
+      normalized.push(item)
+    }
+  }
+  return normalized
+}
+
 export function buildHermesSkillsConfigValues(config = {}) {
   const root = config && typeof config === 'object' && !Array.isArray(config) ? config : {}
   const skills = root.skills && typeof root.skills === 'object' && !Array.isArray(root.skills)
@@ -3694,6 +3709,30 @@ export function mergeHermesSkillsConfig(config = {}, form = {}) {
   return next
 }
 
+export function buildHermesAgentToolsetsConfigValues(config = {}) {
+  const root = config && typeof config === 'object' && !Array.isArray(config) ? config : {}
+  const agent = root.agent && typeof root.agent === 'object' && !Array.isArray(root.agent)
+    ? root.agent
+    : {}
+  const disabledToolsets = Array.isArray(agent.disabled_toolsets)
+    ? normalizeHermesMultilineList(agent.disabled_toolsets).join('\n')
+    : ''
+  return {
+    disabledToolsets,
+  }
+}
+
+export function mergeHermesAgentToolsetsConfig(config = {}, form = {}) {
+  const next = mergeConfigsPreservingFields({}, config && typeof config === 'object' && !Array.isArray(config) ? config : {})
+  const currentValues = buildHermesAgentToolsetsConfigValues(next)
+  const agent = next.agent && typeof next.agent === 'object' && !Array.isArray(next.agent)
+    ? mergeConfigsPreservingFields(next.agent, {})
+    : {}
+  agent.disabled_toolsets = normalizeHermesToolsetList(Object.hasOwn(form, 'disabledToolsets') ? form.disabledToolsets : currentValues.disabledToolsets)
+  next.agent = agent
+  return next
+}
+
 function validateHermesQuickCommands(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
     throw new Error('quick_commands 必须是 JSON 对象')
@@ -10433,6 +10472,27 @@ const handlers = {
     }
   },
 
+  hermes_agent_toolsets_config_read() {
+    const { configPath, exists, config } = readHermesConfigYamlObject()
+    return {
+      exists,
+      configPath,
+      values: buildHermesAgentToolsetsConfigValues(config),
+    }
+  },
+
+  hermes_agent_toolsets_config_save({ form } = {}) {
+    const { configPath, config } = readHermesConfigYamlObject()
+    const next = mergeHermesAgentToolsetsConfig(config, form || {})
+    const backup = writeHermesConfigYamlObject(configPath, next)
+    return {
+      ok: true,
+      configPath,
+      backup,
+      values: buildHermesAgentToolsetsConfigValues(next),
+    }
+  },
+
   hermes_unauthorized_dm_config_read() {
     const { configPath, exists, config } = readHermesConfigYamlObject()
     return {
diff --git a/src-tauri/src/commands/hermes.rs b/src-tauri/src/commands/hermes.rs
index b145e94..d46f69a 100644
--- a/src-tauri/src/commands/hermes.rs
+++ b/src-tauri/src/commands/hermes.rs
@@ -3856,6 +3856,62 @@ fn merge_hermes_quick_commands_config(
     Ok(())
 }
 
+fn normalize_hermes_toolset_list(raw: Option<String>) -> Result<Vec<String>, String> {
+    let mut normalized = Vec::new();
+    for item in normalize_hermes_multiline_list(raw) {
+        if !item
+            .chars()
+            .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '.' | '-'))
+        {
+            return Err(
+                "agent.disabled_toolsets 只能包含字母、数字、下划线、点和短横线".to_string(),
+            );
+        }
+        if !normalized.iter().any(|existing| existing == &item) {
+            normalized.push(item);
+        }
+    }
+    Ok(normalized)
+}
+
+fn build_hermes_agent_toolsets_config_values(config: &serde_yaml::Value) -> Value {
+    let root = config.as_mapping();
+    let disabled_toolsets = root
+        .and_then(|map| yaml_get_mapping(map, "agent"))
+        .map(|map| yaml_string_sequence_field(map, "disabled_toolsets").join("\n"))
+        .unwrap_or_default();
+
+    serde_json::json!({
+        "disabledToolsets": disabled_toolsets,
+    })
+}
+
+fn merge_hermes_agent_toolsets_config(
+    config: &mut serde_yaml::Value,
+    form: &Value,
+) -> Result<(), String> {
+    let current = build_hermes_agent_toolsets_config_values(config);
+    let disabled_toolsets =
+        normalize_hermes_toolset_list(form_string(form, "disabledToolsets").or_else(|| {
+            current["disabledToolsets"]
+                .as_str()
+                .map(ToString::to_string)
+        }))?;
+
+    let root = ensure_yaml_object(config)?;
+    let agent = yaml_child_object(root, "agent")?;
+    agent.insert(
+        yaml_key("disabled_toolsets"),
+        serde_yaml::Value::Sequence(
+            disabled_toolsets
+                .into_iter()
+                .map(serde_yaml::Value::String)
+                .collect(),
+        ),
+    );
+    Ok(())
+}
+
 fn normalize_hermes_unauthorized_dm_behavior(
     value: Option<String>,
     strict: bool,
@@ -6069,6 +6125,30 @@ pub fn hermes_quick_commands_config_save(form: Value) -> Result<Value, String> {
     }))
 }
 
+#[tauri::command]
+pub fn hermes_agent_toolsets_config_read() -> Result<Value, String> {
+    let (config_path, exists, config) = read_hermes_channel_yaml_config()?;
+    ensure_yaml_object(&mut config.clone())?;
+    Ok(serde_json::json!({
+        "exists": exists,
+        "configPath": config_path.to_string_lossy(),
+        "values": build_hermes_agent_toolsets_config_values(&config),
+    }))
+}
+
+#[tauri::command]
+pub fn hermes_agent_toolsets_config_save(form: Value) -> Result<Value, String> {
+    let (config_path, _exists, mut config) = read_hermes_channel_yaml_config()?;
+    merge_hermes_agent_toolsets_config(&mut config, &form)?;
+    let backup = write_hermes_yaml_config(&config_path, &config)?;
+    Ok(serde_json::json!({
+        "ok": true,
+        "configPath": config_path.to_string_lossy(),
+        "backup": backup,
+        "values": build_hermes_agent_toolsets_config_values(&config),
+    }))
+}
+
 #[tauri::command]
 pub fn hermes_unauthorized_dm_config_read() -> Result<Value, String> {
     let (config_path, exists, config) = read_hermes_channel_yaml_config()?;
@@ -12515,6 +12595,118 @@ streaming:
     }
 }
 
+#[cfg(test)]
+mod hermes_agent_toolsets_config_tests {
+    use super::{build_hermes_agent_toolsets_config_values, merge_hermes_agent_toolsets_config};
+    use serde_json::json;
+
+    #[test]
+    fn agent_toolsets_values_have_empty_defaults() {
+        let config: serde_yaml::Value = serde_yaml::from_str("{}").unwrap();
+        let values = build_hermes_agent_toolsets_config_values(&config);
+        assert_eq!(values["disabledToolsets"], "");
+    }
+
+    #[test]
+    fn agent_toolsets_values_read_yaml_sequence() {
+        let config: serde_yaml::Value = serde_yaml::from_str(
+            r#"
+agent:
+  disabled_toolsets:
+    - memory
+    - web
+    - browser
+"#,
+        )
+        .unwrap();
+
+        let values = build_hermes_agent_toolsets_config_values(&config);
+        assert_eq!(values["disabledToolsets"], "memory\nweb\nbrowser");
+    }
+
+    #[test]
+    fn merge_agent_toolsets_config_preserves_unrelated_yaml() {
+        let mut config: serde_yaml::Value = serde_yaml::from_str(
+            r#"
+model:
+  provider: anthropic
+agent:
+  disabled_toolsets:
+    - memory
+  max_turns: 80
+  custom_flag: keep-agent
+streaming:
+  enabled: true
+"#,
+        )
+        .unwrap();
+
+        merge_hermes_agent_toolsets_config(
+            &mut config,
+            &json!({
+                "disabledToolsets": " terminal \n browser \n\n memory\nbrowser ",
+            }),
+        )
+        .unwrap();
+
+        assert_eq!(config["model"]["provider"].as_str(), Some("anthropic"));
+        assert_eq!(config["streaming"]["enabled"].as_bool(), Some(true));
+        assert_eq!(
+            config["agent"]["disabled_toolsets"][0].as_str(),
+            Some("terminal")
+        );
+        assert_eq!(
+            config["agent"]["disabled_toolsets"][1].as_str(),
+            Some("browser")
+        );
+        assert_eq!(
+            config["agent"]["disabled_toolsets"][2].as_str(),
+            Some("memory")
+        );
+        assert_eq!(config["agent"]["max_turns"].as_i64(), Some(80));
+        assert_eq!(config["agent"]["custom_flag"].as_str(), Some("keep-agent"));
+    }
+
+    #[test]
+    fn merge_agent_toolsets_config_writes_empty_sequence() {
+        let mut config: serde_yaml::Value = serde_yaml::from_str(
+            r#"
+agent:
+  disabled_toolsets:
+    - memory
+  custom_flag: keep-agent
+"#,
+        )
+        .unwrap();
+
+        merge_hermes_agent_toolsets_config(&mut config, &json!({ "disabledToolsets": "  \n " }))
+            .unwrap();
+
+        assert!(config["agent"]["disabled_toolsets"]
+            .as_sequence()
+            .unwrap()
+            .is_empty());
+        assert_eq!(config["agent"]["custom_flag"].as_str(), Some("keep-agent"));
+    }
+
+    #[test]
+    fn merge_agent_toolsets_config_rejects_invalid_values() {
+        let mut config = serde_yaml::Value::Mapping(serde_yaml::Mapping::new());
+        let err = merge_hermes_agent_toolsets_config(
+            &mut config,
+            &json!({ "disabledToolsets": "bad tool" }),
+        )
+        .unwrap_err();
+        assert!(err.contains("agent.disabled_toolsets"));
+        let err = merge_hermes_agent_toolsets_config(
+            &mut config,
+            &json!({ "disabledToolsets": "../secret" }),
+        )
+        .unwrap_err();
+        assert!(err.contains("agent.disabled_toolsets"));
+    }
+}
+
 #[cfg(test)]
 mod hermes_unauthorized_dm_config_tests {
     use super::{build_hermes_unauthorized_dm_config_values, merge_hermes_unauthorized_dm_config};
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 9ee5229..9e750a9 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -269,6 +269,8 @@ pub fn run() {
             hermes::hermes_skills_config_save,
             hermes::hermes_quick_commands_config_read,
             hermes::hermes_quick_commands_config_save,
+            hermes::hermes_agent_toolsets_config_read,
+            hermes::hermes_agent_toolsets_config_save,
             hermes::hermes_unauthorized_dm_config_read,
             hermes::hermes_unauthorized_dm_config_save,
             hermes::hermes_security_config_read,
diff --git a/src/engines/hermes/pages/config.js b/src/engines/hermes/pages/config.js
index bcf0e47..d5c3fb0 100644
--- a/src/engines/hermes/pages/config.js
+++ b/src/engines/hermes/pages/config.js
@@ -52,6 +52,10 @@ const QUICK_COMMANDS_DEFAULTS = {
   quickCommandsJson: '{}',
 }
 
+const AGENT_TOOLSETS_DEFAULTS = {
+  disabledToolsets: '',
+}
+
 const UNAUTHORIZED_DM_DEFAULTS = {
   unauthorizedDmBehavior: 'pair',
 }
@@ -155,6 +159,7 @@ export function render() {
   let memoryValues = { ...MEMORY_DEFAULTS }
   let skillsValues = { ...SKILLS_DEFAULTS }
   let quickCommandsValues = { ...QUICK_COMMANDS_DEFAULTS }
+  let agentToolsetsValues = { ...AGENT_TOOLSETS_DEFAULTS }
   let unauthorizedDmValues = { ...UNAUTHORIZED_DM_DEFAULTS }
   let securityValues = { ...SECURITY_DEFAULTS }
   let displayValues = { ...DISPLAY_DEFAULTS }
@@ -172,6 +177,7 @@ export function render() {
   let memoryLoading = true
   let skillsLoading = true
   let quickCommandsLoading = true
+  let agentToolsetsLoading = true
   let unauthorizedDmLoading = true
   let securityLoading = true
   let displayLoading = true
@@ -189,6 +195,7 @@ export function render() {
   let memorySaving = false
   let skillsSaving = false
   let quickCommandsSaving = false
+  let agentToolsetsSaving = false
   let unauthorizedDmSaving = false
   let securitySaving = false
   let displaySaving = false
@@ -206,6 +213,7 @@ export function render() {
   let memoryError = null
   let skillsError = null
   let quickCommandsError = null
+  let agentToolsetsError = null
   let unauthorizedDmError = null
   let securityError = null
   let displayError = null
@@ -226,7 +234,7 @@ export function render() {
   }
 
   function isBusy() {
-    return loading || runtimeLoading || compressionLoading || toolGuardrailsLoading || memoryLoading || skillsLoading || quickCommandsLoading || unauthorizedDmLoading || securityLoading || displayLoading || humanDelayLoading || streamingLoading || executionLimitsLoading || ioSafetyLoading || privacyLoading || browserLoading || terminalLoading || saving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || securitySaving || displaySaving || humanDelaySaving || streamingSaving || executionLimitsSaving || ioSafetySaving || privacySaving || browserSaving || terminalSaving
+    return loading || runtimeLoading || compressionLoading || toolGuardrailsLoading || memoryLoading || skillsLoading || quickCommandsLoading || agentToolsetsLoading || unauthorizedDmLoading || securityLoading || displayLoading || humanDelayLoading || streamingLoading || executionLimitsLoading || ioSafetyLoading || privacyLoading || browserLoading || terminalLoading || saving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || securitySaving || displaySaving || humanDelaySaving || streamingSaving || executionLimitsSaving || ioSafetySaving || privacySaving || browserSaving || terminalSaving
   }
 
   function option(labelKey, value, selected) {
@@ -243,7 +251,7 @@ export function render() {
   }
 
   function renderRuntimePanel() {
-    const disabled = loading || saving || runtimeLoading || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || runtimeLoading || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel">
         <div class="hm-panel-header">
@@ -291,7 +299,7 @@ export function render() {
   }
 
   function renderCompressionPanel() {
-    const disabled = loading || saving || compressionLoading || compressionSaving || runtimeSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || compressionLoading || compressionSaving || runtimeSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-compression-panel">
         <div class="hm-panel-header">
@@ -341,7 +349,7 @@ export function render() {
   }
 
   function renderToolGuardrailsPanel() {
-    const disabled = loading || saving || toolGuardrailsLoading || toolGuardrailsSaving || runtimeSaving || compressionSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || toolGuardrailsLoading || toolGuardrailsSaving || runtimeSaving || compressionSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-guardrails-panel">
         <div class="hm-panel-header">
@@ -403,7 +411,7 @@ export function render() {
   }
 
   function renderMemoryPanel() {
-    const disabled = loading || saving || memoryLoading || memorySaving || skillsSaving || quickCommandsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || memoryLoading || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-memory-panel">
         <div class="hm-panel-header">
@@ -453,7 +461,7 @@ export function render() {
   }
 
   function renderSkillsConfigPanel() {
-    const disabled = loading || saving || skillsLoading || skillsSaving || quickCommandsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || skillsLoading || skillsSaving || quickCommandsSaving || agentToolsetsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-skills-panel">
         <div class="hm-panel-header">
@@ -485,7 +493,7 @@ export function render() {
   }
 
   function renderQuickCommandsConfigPanel() {
-    const disabled = loading || saving || quickCommandsLoading || quickCommandsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || quickCommandsLoading || quickCommandsSaving || agentToolsetsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-quick-commands-panel">
         <div class="hm-panel-header">
@@ -510,8 +518,34 @@ export function render() {
     `
   }
 
+  function renderAgentToolsetsConfigPanel() {
+    const disabled = loading || saving || agentToolsetsLoading || agentToolsetsSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    return `
+      <div class="hm-panel hm-config-runtime-panel hm-config-agent-toolsets-panel">
+        <div class="hm-panel-header">
+          <div>
+            <div class="hm-panel-title">${t('engine.hermesAgentToolsetsConfigTitle')}</div>
+            <div class="hm-channel-panel-desc">${t('engine.hermesAgentToolsetsConfigDesc')}</div>
+          </div>
+          <div class="hm-panel-actions">
+            <span class="hm-muted">${agentToolsetsSaving ? t('engine.hermesConfigStatusSaving') : agentToolsetsLoading ? t('engine.hermesConfigStatusLoading') : t('engine.hermesAgentToolsetsConfigStatusReady')}</span>
+            <button class="hm-btn hm-btn--cta hm-btn--sm" id="hm-agent-toolsets-save" ${disabled ? 'disabled' : ''}>${t('engine.hermesAgentToolsetsConfigSave')}</button>
+          </div>
+        </div>
+        <div class="hm-panel-body">
+          ${renderError(agentToolsetsError)}
+          <label class="hm-field hm-field--wide">
+            <span class="hm-field-label">${t('engine.hermesAgentToolsetsConfigDisabledToolsets')}</span>
+            <textarea id="hm-agent-disabled-toolsets" class="hm-input" spellcheck="false" rows="4" ${disabled ? 'disabled' : ''}>${esc(agentToolsetsValues.disabledToolsets)}</textarea>
+          </label>
+          <div class="hm-channel-footnote">${t('engine.hermesAgentToolsetsConfigFootnote')}</div>
+        </div>
+      </div>
+    `
+  }
+
   function renderUnauthorizedDmConfigPanel() {
-    const disabled = loading || saving || unauthorizedDmLoading || unauthorizedDmSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || securitySaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || unauthorizedDmLoading || unauthorizedDmSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || securitySaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-unauthorized-dm-panel">
         <div class="hm-panel-header">
@@ -541,7 +575,7 @@ export function render() {
   }
 
   function renderSecurityConfigPanel() {
-    const disabled = loading || saving || securityLoading || securitySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || securityLoading || securitySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-security-panel">
         <div class="hm-panel-header">
@@ -583,7 +617,7 @@ export function render() {
   }
 
   function renderDisplayConfigPanel() {
-    const disabled = loading || saving || displayLoading || displaySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || securitySaving || humanDelaySaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || displayLoading || displaySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || securitySaving || humanDelaySaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-display-panel">
         <div class="hm-panel-header">
@@ -647,7 +681,7 @@ export function render() {
   }
 
   function renderHumanDelayConfigPanel() {
-    const disabled = loading || saving || humanDelayLoading || humanDelaySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || securitySaving || streamingSaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || humanDelayLoading || humanDelaySaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || securitySaving || streamingSaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-human-delay-panel">
         <div class="hm-panel-header">
@@ -685,7 +719,7 @@ export function render() {
   }
 
   function renderStreamingPanel() {
-    const disabled = loading || saving || streamingLoading || streamingSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || securitySaving || executionLimitsSaving || terminalSaving
+    const disabled = loading || saving || streamingLoading || streamingSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || securitySaving || executionLimitsSaving || terminalSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-streaming-panel">
         <div class="hm-panel-header">
@@ -737,7 +771,7 @@ export function render() {
   }
 
   function renderExecutionLimitsPanel() {
-    const disabled = loading || saving || executionLimitsLoading || executionLimitsSaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving
+    const disabled = loading || saving || executionLimitsLoading || executionLimitsSaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-execution-limits-panel">
         <div class="hm-panel-header">
@@ -809,7 +843,7 @@ export function render() {
   }
 
   function renderIoSafetyPanel() {
-    const disabled = loading || saving || ioSafetyLoading || ioSafetySaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving
+    const disabled = loading || saving || ioSafetyLoading || ioSafetySaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-io-safety-panel">
         <div class="hm-panel-header">
@@ -849,7 +883,7 @@ export function render() {
   }
 
   function renderPrivacyPanel() {
-    const disabled = loading || saving || privacyLoading || privacySaving || browserSaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || ioSafetySaving
+    const disabled = loading || saving || privacyLoading || privacySaving || browserSaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || ioSafetySaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-privacy-panel">
         <div class="hm-panel-header">
@@ -877,7 +911,7 @@ export function render() {
   }
 
   function renderBrowserPanel() {
-    const disabled = loading || saving || browserLoading || browserSaving || privacySaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || ioSafetySaving
+    const disabled = loading || saving || browserLoading || browserSaving || privacySaving || terminalSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving || ioSafetySaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-browser-panel">
         <div class="hm-panel-header">
@@ -921,7 +955,7 @@ export function render() {
   }
 
   function renderTerminalPanel() {
-    const disabled = loading || saving || terminalLoading || terminalSaving || browserSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving
+    const disabled = loading || saving || terminalLoading || terminalSaving || browserSaving || runtimeSaving || compressionSaving || toolGuardrailsSaving || memorySaving || skillsSaving || quickCommandsSaving || agentToolsetsSaving || unauthorizedDmSaving || streamingSaving || executionLimitsSaving
     return `
       <div class="hm-panel hm-config-runtime-panel hm-config-terminal-panel">
         <div class="hm-panel-header">
@@ -1017,6 +1051,7 @@ export function render() {
       ${renderMemoryPanel()}
       ${renderSkillsConfigPanel()}
       ${renderQuickCommandsConfigPanel()}
+      ${renderAgentToolsetsConfigPanel()}
       ${renderUnauthorizedDmConfigPanel()}
       ${renderSecurityConfigPanel()}
       ${renderDisplayConfigPanel()}
@@ -1046,6 +1081,7 @@ export function render() {
     el.querySelector('#hm-memory-save')?.addEventListener('click', saveMemory)
     el.querySelector('#hm-skills-config-save')?.addEventListener('click', saveSkillsConfig)
     el.querySelector('#hm-quick-commands-save')?.addEventListener('click', saveQuickCommandsConfig)
+    el.querySelector('#hm-agent-toolsets-save')?.addEventListener('click', saveAgentToolsetsConfig)
     el.querySelector('#hm-unauthorized-dm-save')?.addEventListener('click', saveUnauthorizedDmConfig)
     el.querySelector('#hm-security-save')?.addEventListener('click', saveSecurityConfig)
     el.querySelector('#hm-display-save')?.addEventListener('click', saveDisplayConfig)
@@ -1093,6 +1129,11 @@ export function render() {
     quickCommandsValues = { ...QUICK_COMMANDS_DEFAULTS, ...(data?.values || {}) }
   }
 
+  async function loadAgentToolsetsConfig() {
+    const data = await api.hermesAgentToolsetsConfigRead()
+    agentToolsetsValues = { ...AGENT_TOOLSETS_DEFAULTS, ...(data?.values || {}) }
+  }
+
   async function loadUnauthorizedDmConfig() {
     const data = await api.hermesUnauthorizedDmConfigRead()
     unauthorizedDmValues = { ...UNAUTHORIZED_DM_DEFAULTS, ...(data?.values || {}) }
@@ -1151,6 +1192,7 @@ export function render() {
     memoryLoading = true
     skillsLoading = true
     quickCommandsLoading = true
+    agentToolsetsLoading = true
     unauthorizedDmLoading = true
     securityLoading = true
     displayLoading = true
@@ -1168,6 +1210,7 @@ export function render() {
     memoryError = null
     skillsError = null
     quickCommandsError = null
+    agentToolsetsError = null
     unauthorizedDmError = null
     securityError = null
     displayError = null
@@ -1282,6 +1325,14 @@ export function render() {
       quickCommandsLoading = false
       draw()
     }
+    try {
+      await loadAgentToolsetsConfig()
+    } catch (err) {
+      agentToolsetsError = humanizeError(err, t('engine.hermesAgentToolsetsConfigLoadFailed') || 'Load agent toolsets config failed')
+    } finally {
+      agentToolsetsLoading = false
+      draw()
+    }
     try {
       await loadUnauthorizedDmConfig()
     } catch (err) {
@@ -1353,6 +1404,9 @@ export function render() {
       try {
         await loadQuickCommandsConfig()
       } catch {}
+      try {
+        await loadAgentToolsetsConfig()
+      } catch {}
       try {
         await loadUnauthorizedDmConfig()
       } catch {}
@@ -1564,6 +1618,31 @@ export function render() {
     }
   }
 
+  async function saveAgentToolsetsConfig() {
+    const form = {
+      disabledToolsets: el.querySelector('#hm-agent-disabled-toolsets')?.value || '',
+    }
+    agentToolsetsSaving = true
+    agentToolsetsError = null
+    draw()
+    try {
+      const result = await api.hermesAgentToolsetsConfigSave(form)
+      agentToolsetsValues = { ...AGENT_TOOLSETS_DEFAULTS, ...(result?.values || form) }
+      await refreshRawAfterStructuredSave()
+      const backup = result?.backup || ''
+      toast({
+        message: t('engine.hermesAgentToolsetsConfigSaveSuccess'),
+        hint: backup ? t('engine.hermesConfigBackupHint', { path: backup }) : '',
+      }, 'success')
+    } catch (err) {
+      agentToolsetsError = humanizeError(err, t('engine.hermesAgentToolsetsConfigSaveFailed') || 'Save agent toolsets config failed')
+      toast(agentToolsetsError, 'error')
+    } finally {
+      agentToolsetsSaving = false
+      draw()
+    }
+  }
+
   async function saveUnauthorizedDmConfig() {
     const form = {
       unauthorizedDmBehavior: el.querySelector('#hm-unauthorized-dm-behavior')?.value || 'pair',
diff --git a/src/lib/tauri-api.js b/src/lib/tauri-api.js
index e5dae35..df41da8 100644
--- a/src/lib/tauri-api.js
+++ b/src/lib/tauri-api.js
@@ -521,6 +521,8 @@ export const api = {
   hermesSkillsConfigSave: (form) => invoke('hermes_skills_config_save', { form }),
   hermesQuickCommandsConfigRead: () => invoke('hermes_quick_commands_config_read'),
   hermesQuickCommandsConfigSave: (form) => invoke('hermes_quick_commands_config_save', { form }),
+  hermesAgentToolsetsConfigRead: () => invoke('hermes_agent_toolsets_config_read'),
+  hermesAgentToolsetsConfigSave: (form) => invoke('hermes_agent_toolsets_config_save', { form }),
   hermesUnauthorizedDmConfigRead: () => invoke('hermes_unauthorized_dm_config_read'),
   hermesUnauthorizedDmConfigSave: (form) => invoke('hermes_unauthorized_dm_config_save', { form }),
   hermesSecurityConfigRead: () => invoke('hermes_security_config_read'),
diff --git a/src/locales/modules/engine.js b/src/locales/modules/engine.js
index bdfbc1d..107101a 100644
--- a/src/locales/modules/engine.js
+++ b/src/locales/modules/engine.js
@@ -665,6 +665,15 @@ export default {
   hermesQuickCommandsConfigSaveFailed: _('保存快捷命令失败', 'Save quick commands failed', '儲存快捷命令失敗'),
   hermesQuickCommandsConfigJson: _('quick_commands JSON 映射', 'quick_commands JSON map', 'quick_commands JSON 映射'),
   hermesQuickCommandsConfigFootnote: _('键名会变成斜杠命令，例如 status 对应 /status。每个命令必须是对象，type 只能为 exec 或 alias；exec 需要 command，alias 的 target 必须以 / 开头。', 'Keys become slash commands, for example status maps to /status. Each command must be an object with type exec or alias; exec needs command, and alias target must start with /.', '鍵名會變成斜線命令，例如 status 對應 /status。每個命令必須是物件，type 只能是 exec 或 alias；exec 需要 command，alias 的 target 必須以 / 開頭。'),
+  hermesAgentToolsetsConfigTitle: _('全局工具开关', 'Global tool switches', '全域工具開關'),
+  hermesAgentToolsetsConfigDesc: _('在 CLI 和所有 Gateway 渠道里统一禁用指定工具集，适合公网部署、只读模式或临时收紧高风险能力。', 'Disable selected toolsets globally across CLI and all Gateway channels. Useful for public deployments, read-only mode, or temporarily reducing high-risk capabilities.', '在 CLI 和所有 Gateway 渠道裡統一停用指定工具集，適合公開部署、唯讀模式或暫時收緊高風險能力。'),
+  hermesAgentToolsetsConfigStatusReady: _('结构化列表', 'structured list', '結構化清單'),
+  hermesAgentToolsetsConfigSave: _('保存工具开关', 'Save tool switches', '儲存工具開關'),
+  hermesAgentToolsetsConfigSaveSuccess: _('全局工具集配置已保存，建议重启 Hermes Gateway 生效', 'Global toolset settings saved. Restart Hermes Gateway to take effect.', '全域工具集設定已儲存，建議重啟 Hermes Gateway 生效'),
+  hermesAgentToolsetsConfigLoadFailed: _('加载全局工具集配置失败', 'Load global toolset settings failed', '載入全域工具集設定失敗'),
+  hermesAgentToolsetsConfigSaveFailed: _('保存全局工具集配置失败', 'Save global toolset settings failed', '儲存全域工具集設定失敗'),
+  hermesAgentToolsetsConfigDisabledToolsets: _('禁用工具集（每行一个）', 'Disabled toolsets, one per line', '停用工具集（每行一個）'),
+  hermesAgentToolsetsConfigFootnote: _('常见值包括 terminal、browser、memory、web。该设置会覆盖平台级工具配置；留空表示不做全局禁用。高级 agent 字段会保留在 raw YAML 中。', 'Common values include terminal, browser, memory, and web. This setting overrides platform-level tool configuration; leave it empty for no global disables. Advanced agent fields stay in raw YAML.', '常見值包括 terminal、browser、memory、web。此設定會覆蓋平台級工具設定；留空表示不做全域停用。進階 agent 欄位會保留在 raw YAML 中。'),
   hermesUnauthorizedDmConfigTitle: _('未授权私信', 'Unauthorized DMs', '未授權私訊'),
   hermesUnauthorizedDmConfigDesc: _('控制陌生用户直接私信 Hermes 时的全局响应策略，适合公网部署时减少无效打扰或保留配对入口。', 'Control the global response when unknown users send Hermes a direct message. Useful for public deployments that need fewer unsolicited replies or a pairing entry point.', '控制陌生使用者直接私訊 Hermes 時的全域回應策略，適合公開部署時減少無效打擾或保留配對入口。'),
   hermesUnauthorizedDmConfigStatusReady: _('结构化配置', 'structured settings', '結構化設定'),
diff --git a/tests/hermes-agent-toolsets-config.test.js b/tests/hermes-agent-toolsets-config.test.js
new file mode 100644
index 0000000..1c5a8ae
--- /dev/null
+++ b/tests/hermes-agent-toolsets-config.test.js
@@ -0,0 +1,70 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  buildHermesAgentToolsetsConfigValues,
+  mergeHermesAgentToolsetsConfig,
+} from '../scripts/dev-api.js'
+
+test('Hermes Agent 工具集配置读取会提供上游默认值', () => {
+  const values = buildHermesAgentToolsetsConfigValues({})
+
+  assert.deepEqual(values, {
+    disabledToolsets: '',
+  })
+})
+
+test('Hermes Agent 工具集配置读取会回显全局禁用列表', () => {
+  const values = buildHermesAgentToolsetsConfigValues({
+    agent: {
+      disabled_toolsets: ['memory', 'web', 'browser'],
+    },
+  })
+
+  assert.equal(values.disabledToolsets, 'memory\nweb\nbrowser')
+})
+
+test('Hermes Agent 工具集配置保存会去重并保留未知字段', () => {
+  const next = mergeHermesAgentToolsetsConfig({
+    model: { provider: 'anthropic' },
+    agent: {
+      disabled_toolsets: ['memory'],
+      max_turns: 80,
+      custom_flag: 'keep-agent',
+    },
+    streaming: { enabled: true },
+  }, {
+    disabledToolsets: ' terminal \n browser \n\n memory\nbrowser ',
+  })
+
+  assert.deepEqual(next.model, { provider: 'anthropic' })
+  assert.deepEqual(next.streaming, { enabled: true })
+  assert.deepEqual(next.agent.disabled_toolsets, ['terminal', 'browser', 'memory'])
+  assert.equal(next.agent.max_turns, 80)
+  assert.equal(next.agent.custom_flag, 'keep-agent')
+})
+
+test('Hermes Agent 工具集配置保存空输入会写入空数组', () => {
+  const next = mergeHermesAgentToolsetsConfig({
+    agent: {
+      disabled_toolsets: ['memory'],
+      custom_flag: 'keep-agent',
+    },
+  }, {
+    disabledToolsets: '  \n ',
+  })
+
+  assert.deepEqual(next.agent.disabled_toolsets, [])
+  assert.equal(next.agent.custom_flag, 'keep-agent')
+})
+
+test('Hermes Agent 工具集配置保存会拒绝非法工具集名称', () => {
+  assert.throws(
+    () => mergeHermesAgentToolsetsConfig({}, { disabledToolsets: 'bad tool' }),
+    /agent\.disabled_toolsets/,
+  )
+  assert.throws(
+    () => mergeHermesAgentToolsetsConfig({}, { disabledToolsets: '../secret' }),
+    /agent\.disabled_toolsets/,
+  )
+})
diff --git a/tests/hermes-config-page-ui.test.js b/tests/hermes-config-page-ui.test.js
index 347525b..c3202ac 100644
--- a/tests/hermes-config-page-ui.test.js
+++ b/tests/hermes-config-page-ui.test.js
@@ -58,6 +58,15 @@ test('Hermes 配置页会暴露快捷命令结构化配置字段', () => {
   }
 })
 
+test('Hermes 配置页会暴露全局禁用工具集结构化配置字段', () => {
+  for (const id of [
+    'hm-agent-toolsets-save',
+    'hm-agent-disabled-toolsets',
+  ]) {
+    assert.match(source, new RegExp(`id="${id}"`), `缺少 ${id}`)
+  }
+})
+
 test('Hermes 配置页会暴露未授权 DM 全局策略字段', () => {
   for (const id of [
     'hm-unauthorized-dm-save',
@@ -199,6 +208,7 @@ test('Hermes 配置页新增结构化配置不会暴露翻译 key', () => {
     key.includes('MemoryConfig') ||
     key.includes('SkillsConfig') ||
     key.includes('QuickCommandsConfig') ||
+    key.includes('AgentToolsetsConfig') ||
     key.includes('UnauthorizedDmConfig') ||
     key.includes('SecurityConfig') ||
     key.includes('HumanDelayConfig') ||