Present a regular file from the Agent VM as an opaque MCP artifact resource. The VM filesystem path is not exposed in artifact metadata.

Execute an arbitrary shell command on the dedicated disposable Linux agent VM. Oversized stdout/stderr use bounded head/tail previews plus separate artifacts. Use this for commands that complete on their own. For servers, watchers, REPLs, or other long-running/interactive commands, use process_start instead. Do not launch Codex, Antigravity CLI (agy), or Claude Code agent work through exec; use agent_start so coding agents run in persistent Herdr workspaces. Harmless --help/--version probes remain allowed.

Read a bounded UTF-8 text file or 1-based line range with structured line metadata. Use shell tools for binary or very large files.

List one directory level as deterministic structured name/type entries, including dotfiles. This tool is intentionally non-recursive.

Apply a strict standard unified diff relative to cwd. All hunks are validated before mutation; context mismatch rejects the entire patch without fuzzy or partial fallback.

Create an isolated managed Git worktree backed by shared repository storage. Returns an immutable workspace ID and path for use as cwd with existing tools.

Rediscover managed Git workspaces from durable filesystem and Git worktree state, including repository, HEAD/branch, and dirty status.

Remove a managed Git worktree by immutable workspace ID. Dirty workspaces are refused unless force is explicitly true.

Discover the Herdr agent runtime, configured persistent session, installed coding harnesses, active and suspended MCP-managed logical agents, native/runtime IDs, lifecycle states, resumability/legacy status, and per-harness installed skills/resume support.

Start a persistent interactive coding agent in a dedicated Herdr workspace. Use this, not exec or process_start, for coding-harness work; it is required for long-running, parallel, or cross-turn Codex/agy/Claude tasks. Production persistence requires the separately managed Herdr service; startup trust/auth prompts are reported, never auto-approved.

Inspect one MCP-managed Herdr agent, including lifecycle state and detected interactions that require an orchestration policy decision. requiresDecision means the caller must apply its delegation policy; it does not imply automatic human escalation.

Read bounded terminal transcript from an MCP-managed Herdr agent. Use recent-unwrapped for orchestration-oriented text inspection.

Submit a task to an MCP-managed coding agent after a positive readiness check. Preflight or pre-spawn rejection is not submitted; timeout/cancellation after Herdr starts is possibly submitted and unsafe to auto-retry.

Send only bounded control/navigation keys to an MCP-managed agent terminal after the orchestrator has inspected the current interaction and determined the action is authorized under the caller delegation policy. The runtime does not grant approval or decide whether human escalation is required. Arbitrary text must use agent_prompt instead.

Suspend an idle or finished MCP-managed logical agent by closing its dedicated Herdr workspace while retaining a uniquely attributed native harness session ID. Use at a task/turn boundary to release runtime resources; legacy agents and sessions without verified native attribution fail clearly. This is distinct from agent_stop, which discards the logical agent.

Resume a suspended logical coding-agent session by creating a fresh Herdr workspace and launching the harness with its verified native session/conversation ID. This continues the same conversation; start a new agent for independent work. Fails clearly when native resume is unavailable.

Stop an MCP-managed agent with destructive terminal semantics: close its dedicated Herdr workspace when active, or discard its durable logical metadata when suspended. This never stops the shared Herdr session or other agents.

Import a host-provided file into the Agent VM without routing file bytes through model context.

Inspect whether named CLI commands are available on the VM. Curated commands also include category, summary, and detected version metadata.

Start a long-running or interactive non-agent shell command and keep it alive across MCP tool calls. Returns a processId for process_read, process_write, and process_kill. Do not use process_start for Codex, Antigravity CLI (agy), or Claude Code agent work; use agent_start because Herdr provides dedicated parallel workspaces and survives MCP/conversation lifecycle changes.

List process sessions created by process_start so persistent processes can be rediscovered across MCP client or conversation changes.

Read incremental stdout/stderr and status from a process started by process_start. Pass the returned next offsets on later reads to receive only new output.

Write to stdin of a running process started by process_start.

Send SIGTERM, SIGINT, or SIGKILL to a process group started by process_start.

Run a read-only Agent VM maintenance audit: auto-discover managed/custom tools, check update sources, service/repository health, APT updates, and project dependency drift. Unknown newly discovered tools are surfaced in coverage.untracked instead of being silently omitted.

Discover the VM execution environment: host/runtime details, curated CLI capabilities, native MCP tools, and connected upstream MCP bridges.

Report configured upstream MCP bridges, their connection state, and forwarded tool-name mappings.