diff --git a/src/media/read-capability.ts b/src/media/read-capability.ts
new file mode 100644
index 00000000000..3ca74a5bd9b
--- /dev/null
+++ b/src/media/read-capability.ts
@@ -0,0 +1,29 @@
+import { resolveAgentWorkspaceDir } from "../agents/agent-scope.js";
+import { resolvePathFromInput } from "../agents/path-policy.js";
+import { resolveEffectiveToolFsRootExpansionAllowed } from "../agents/tool-fs-policy.js";
+import { resolveWorkspaceRoot } from "../agents/workspace-dir.js";
+import type { OpenClawConfig } from "../config/config.js";
+import { readLocalFileSafely } from "../infra/fs-safe.js";
+
+export function createAgentScopedHostMediaReadFile(params: {
+  cfg: OpenClawConfig;
+  agentId?: string;
+  workspaceDir?: string;
+}): ((filePath: string) => Promise<Buffer>) | undefined {
+  if (
+    !resolveEffectiveToolFsRootExpansionAllowed({
+      cfg: params.cfg,
+      agentId: params.agentId,
+    })
+  ) {
+    return undefined;
+  }
+  const inferredWorkspaceDir =
+    params.workspaceDir ??
+    (params.agentId ? resolveAgentWorkspaceDir(params.cfg, params.agentId) : undefined);
+  const workspaceRoot = resolveWorkspaceRoot(inferredWorkspaceDir);
+  return async (filePath: string) => {
+    const resolvedPath = resolvePathFromInput(filePath, workspaceRoot);
+    return (await readLocalFileSafely({ filePath: resolvedPath })).buffer;
+  };
+}