Return a compact machine/runtime health summary. Request optional sections or detailed=true only when deeper diagnostics are needed.

Read-only control-plane handshake: build commit/HEAD/staleBuild, worker PID/uptime, tunnel ownership, contract fingerprint, capability count, and the last control restart receipt.

Read-only. Compare the live worker tool surface against a fresh probe of the current build. Returns added/removed/changed tool names and fingerprintMatch. A mismatch means the worker serves a stale build.

Bounded mutation. Restarts the worker only when it demonstrably serves a stale build (worker-behind-dist or surface mismatch); no-op with a reason when fresh. Returns immediately; the restart lands seconds later, so poll runtime_info for the new worker. Refuses when unsupervised.

Privileged autonomous update: requires MCP_ALLOW_SELF_UPDATE=1. Refuses on dirty tree, non-main branch, unpushed commits, divergence, or fetch failure. Otherwise fast-forward-only pull of origin/main, build, full verification, supervised restart, and a post-restart handshake receipt. Returns before the restart lands; poll runtime_info.

Read operating-system, CPU, memory, uptime, Node.js, and host identity information without invoking a shell.

List operating-system processes with bounded structured results.

List local TCP/UDP endpoints and owning PIDs, optionally filtered by port, PID, or protocol.

List environment variable names and optionally non-sensitive values. Secret-like variables are always redacted.

Read filesystem capacity and free-space information for a path allowed by the current machine access policy.

Read local network-interface addresses and metadata without making an outbound network request.

Read recent redacted machine-operation audit records.

Search recent redacted audit records by text.

Read a UTF-8 text file with line and byte limits. Returns the file SHA-256; pass it back as "expected_sha256" when writing to detect concurrent changes.

Read multiple UTF-8 text files in one bounded call. Each file keeps its own line/byte limits and SHA-256; failures are reported per file so one missing file does not discard the other reads.

Load the effective ChatGPT Pilot context chain for a project: user-global ~/.pilot/GPT.md, repository AGENTS.md, and repository GPT.md, with explicit precedence and provenance. Runtime/system security remains non-overridable.

Explain where Pilot context came from and, for an optional literal query, show matching lines plus the highest-priority matching context source.

Read a bounded coding-oriented project snapshot in one call: Git status, top-level tree, package/scripts, project type hints, common agent instruction files, and Pilot GPT.md context provenance.

List files, directories, and symlinks with size and modification time, without running a shell command.

Find files recursively by glob. Build output and dependency directories such as node_modules, .git, dist, and target are skipped unless "include_ignored" is true.

Get file or directory metadata and an optional SHA-256 hash for regular files.

Inspect a local PNG, JPEG, or WebP image and return dimensions, size, and SHA-256.

Download an HTTPS PNG, JPEG, or WebP image to the machine. Blocks local and private hosts, limits redirects and size, and sends no cookies or credentials.

Search file contents and return structured path, line, column, and text matches. Uses ripgrep when installed and falls back to a built-in scanner otherwise. Supports surrounding context lines, a per-file match cap, and a files-only mode for cheap surveys.

Create a UTF-8 text file, or replace one when "overwrite" is true. Prefer edit_file or update_file for changes to an existing file.

Replace exact text in an existing UTF-8 file. Supply either old_text/new_text or an edits array. Array edits are validated in memory then written atomically, so a failed edit never leaves a partial file.

Replace an inclusive 1-based line range in an existing UTF-8 text file. Line numbers shift after every edit, so read the file again between updates.

Run a shell command inside the configured workspace root and wait for it to finish. Use start_process for anything long-running.

Execute one binary with an explicit argv vector, without shell parsing or quoting. Prefer this over shell_command for scripts, Git helpers, and structured command invocation.

Start a background process inside the configured workspace and return its PID. Poll it with read_process_output.

Get the status, runtime, and current output offsets for a managed background process.

Read captured stdout and stderr from a managed background process. Pass the previous "next_stdout_offset" and "next_stderr_offset" values as "since_stdout" and "since_stderr" to receive only new output, and "wait_ms" to block until output arrives or the process exits.

Write UTF-8 text to the standard input of a live process started by start_process. Recovered processes remain inspectable after restart but their stdin cannot be reattached.

Wait until a managed background process exits or the timeout expires. Returns the exit code and output offsets without requiring repeated process_status calls; a timeout does not stop the process.

Stop a managed background process and its child tree by PID.

Add, update, move, or delete files inside the configured workspace using Codex patch format. Run with "dry_run" first when the context lines are uncertain.

Run the detected project verification pipeline with a fast, normal, or strict profile. This executes repository-defined build/test scripts but does not stage or commit files.

Read the current Git branch, upstream tracking state, and working-tree status without running a shell command.

Read local-vs-remote branch state using structured Git commands. Set refresh=true to fetch the selected branch first so ahead/behind is based on current remote state.

Read the Git working-tree or staged diff without running a shell command, optionally limited to specific paths.

Read structured Git commit history without shell interpolation.

Read one Git revision and its patch or statistics with bounded output.

List local Git branches and optionally remote branches with current/upstream metadata.

Stage explicit repository paths using Git directly, without shell interpolation.

Create a local Git commit from staged changes, optionally staging tracked-file modifications with --all.

Verify the project, stage only explicit paths, and create a local commit. Refuses pre-existing staged changes so unrelated work cannot be committed accidentally.

Switch to an existing Git branch, or create and switch to a new branch. Force/discard modes are intentionally not exposed.

Push a Git branch to a remote using Git directly. This is an external mutation and is approval-gated by the developer policy.

Safely publish only selected files. Fetches the remote branch, refuses selected-path drift, copies only those files into an isolated temporary worktree rooted at the remote tip, optionally verifies there, commits, then pushes without changing the caller worktree/index/branch.

Create a persistent workspace todo in .pilot/todos.json. Todos survive Pilot restarts and can be linked to learning observations.

List persistent workspace todos with bounded status, tag, and text filters.

Update a persistent todo, including status transitions to in_progress, done, or cancelled. Completed todos are retained as history rather than silently deleted.

Record an evidence-backed task outcome and reusable learning candidates. This never changes Skills, Capabilities, GPT.md, or memory by itself.

Inspect bounded learning observations and candidates, including their evidence, target, confidence, and promotion status.

Promote one evidence-backed learning candidate. Memory lessons are written to the existing lessons drawer; Skill/Capability/GPT targets become proposals only and never silently self-modify Pilot.

Roll back a learning proposal or remove a previously promoted memory lesson. Code, Skills, Capabilities, and GPT.md are never modified by this tool.

List registered remote machines. Selectors may be id, name, hostname, alias, IP address, or host:port. This call does not contact remote machines.

Check health and latency of one registered remote machine selected by id, name, hostname, alias, IP address, or host:port.

List and cache tool capabilities exposed by one registered remote machine. Cache entries live for 60 seconds and are replaced when a refreshed capability fingerprint changes.

Run a remote MCP tool only after the gateway verifies that the registered remote tool declares readOnlyHint=true. Mutating or unannotated tools fail closed and must use machine_call instead.

Run one MCP tool on a registered remote machine. This is the high-authority routing path; the remote machine still enforces its own policy, workspace boundary, approvals, and audit log.

Execute model-generated Python in a persistent IPython/Jupyter kernel. Variables, imports, and helper functions survive across calls sharing session_id. Use await tools.(...) or await call(name, args) for MCP capabilities, await describe() for the declared catalog, and result(value) to return structured data. The kernel is an unrestricted control environment, not a sandbox, so this tool is available only with --dangerously-open-machine.