Tool surface

22 tools, every one schema-checked

Input and output JSON Schemas for all 22 tools are embedded in the binary. Responses are validated on the way out as well as the way in, so a malformed result is an error rather than something the model has to interpret.

Each group is labelled with the lowest capability mode that unlocks it.

  • read— bounded, non-mutating
  • write— mutating but contained
  • ship— local history and destructive operations

Discovery and read

read tier— bounded, non-mutating

Bounded reads with enforced tree, search, and file-size limits. Never leaves the approved root.

  • repo_list_roots

    List approved repositories

    Which configured, discovered, or previously selected dynamic repositories are available.

  • repo_tree

    Inspect repository tree

    To inspect repository structure or locate likely files by directory.

  • repo_fetch_file

    Fetch one file

    The user names a specific file or after repo_tree/repo_search identifies a relevant file.

  • repo_read_many

    Read bounded files

    To read a bounded set of explicit files or glob-matched files.

  • repo_fetch_image

    Fetch one image

    The model to look at an image such as a screenshot, diagram, or visual-oracle diff PNG.

Policy

read tier— bounded, non-mutating

Ask the server what it will allow before attempting it, and resume after an earlier write.

  • repo_policy_explain

    Explain repository policy

    A read, write, or cleanup policy question is blocked or the user asks what the model can access in a repo.

  • repo_last_write

    Read last write receipt

    What the last write operation changed or how to continue review/recovery after a previous write.

Writes

write tier— mutating but contained

Repo-relative writes checked against denied paths, symlink escapes, size caps, and secret values.

  • repo_write_file

    Write one repository file

    The user explicitly asks to write or precisely edit one allowed repository file.

  • repo_store_artifact

    Store a local artifact

    To save a generated image, downloaded output, binary blob, or other local artifact.

  • repo_write_changes

    Apply repository edit pack

    The user explicitly asks to apply a cohesive multi-file edit pack to allowed repository files.

  • repo_write_handoff

    Create session handoff

    For a local-only session handoff: skapa handoff, create handoff, skriv handoff, session handoff, resume note, fortsättningsanteckning, ny chatt context, or överlämning till nästa chatt.

Cleanup

ship tier— local history and destructive operations

Deletion of generated, untracked artifacts under an explicit path list. Refuses tracked files and never runs a shell.

  • repo_cleanup_paths

    Clean up generated paths

    The user explicitly asks to delete generated repo-local artifacts or local .chatgpt/ artifacts separately, or granular cleanup control is needed.

Commands

ship tier— local history and destructive operations

Configured recipes only, executed as argument vectors without a shell. Disabled until explicitly configured.

  • repo_run_list

    List runnable repository commands

    What commands, checks, builds, or test lanes can be run in a repository.

  • repo_run_command

    Run repository command

    To run a fast repository check and wait for the result, such as a formatter check, a linter, or a single-crate test.

  • repo_run_start

    Start background repository job

    To run a long repository job such as a full build, a workspace-wide test run, an oracle or compatibility lane, or an end-to-end suite.

  • repo_run_input

    Write to background job input

    Use this to answer a prompt or send data to a running job started by repo_run_start.

  • repo_run_status

    Check repository job status

    Whether a started job finished or what its exit code was.

  • repo_run_output

    Read repository job output

    What a started job printed, or when you need live build/test detail.

  • repo_run_cancel

    Cancel repository job

    To stop, abort, or kill a running repository job.

Attended desktop

ship tier— local history and destructive operations

Disabled by default. Screen capture requires one-shot local consent; desktop input is exposed only in an approved Windows support session.

  • capture_media

    Capture a local desktop screenshot or silent video

    Captures the local interactive desktop only when media.enabled is true in the local server config.

  • control_desktop

    Control attended desktop input

    Use only during an attended Windows support session when the user asks you to interact with the visible desktop.

Schemas live in the binary

The full input and output schema for every tool, plus annotations and examples, is documented in the repository.