Tiny load probe: send requests requests (max 200) with concurrency workers (max 20) and report status counts, errors and latency percentiles. Use only against systems you own.

Return the most recent audit log entries (JSON lines), if auditing is enabled.

Test whether a TCP connection to host:port succeeds, with connect time.

Query CIM/WMI classes via Get-CimInstance (Windows only), e.g. Win32_OperatingSystem, Win32_LogicalDisk, Win32_NetworkAdapterConfiguration, Win32_Service. filter is a WQL WHERE clause such as "DriveType=3". Read-only.

Convert between json, yaml, toml, csv, xml and psd1 (PowerShell data files). Provide either path or text. from_format is inferred from the file extension when omitted. With output_path the result is written there; otherwise it is returned. Reading psd1 needs pwsh (restricted language mode, no code execution); XML uses @attr / #text conventions.

Create a file (and parent dirs) with the given content.

Delete a file or directory (recursively).

Resolve a hostname to its addresses using the system resolver.

Replace old_string with new_string in a file. Fails unless it matches exactly once (or replace_all is true). dry_run=true returns a unified diff without writing.

Apply several edits atomically. Each edit is {"old_string": ..., "new_string": ..., optional "replace_all": "true"}. Edits apply in order; if any fails nothing is written.

Environment variables of the server process. Values of secret-looking names are redacted.

Format Python code with ruff; check_only=True only reports.

Return usage docs and examples for a tool group (filesystem, search, shell, git, python, web-fetch, data-conversion, api-testing, diagnostics) or 'index'. Call this after a tool error.

Stage files.

Show who last changed each line of a file (read-only). Optionally limit to a line range.

Create a new branch (and optionally switch to it). Never overwrites an existing branch.

List branches with their last commit and upstream (read-only). all_branches includes remotes.

Commit staged changes.

Show git diff (optionally staged and/or for one path).

Summarise changes per file (read-only), compact for large diffs. base compares with a revision.

Initialise a new git repository (non-destructive; existing repos are left intact).

Show recent commits.

Push a branch (default: current) to a remote. Force pushes and ref deletion are not supported. tags=true pushes tags instead of a branch.

List configured remotes and their URLs (read-only). Credentials in URLs are masked.

Show a commit's message and diff (read-only). stat_only=true gives only the file summary.

List stashes (read-only).

Show short git status.

Switch to an existing branch. Git refuses if it would overwrite local changes.

Create a tag (annotated if message given). Never moves or replaces an existing tag.

Find files by glob pattern (e.g. '**/*.py'), relative to path. Skips git-ignored files unless respect_gitignore=false. Use offset to page.

Regex search file contents. Returns path:line: text matches. Skips git-ignored files (and .git, node_modules, .venv) unless respect_gitignore=false. Use offset to page.

Send an HTTP request (localhost and private addresses allowed) and report status, timing, redacted headers and a truncated body. Optional assertions: expect_status, expect_json ({"data.items[0].id": 5} path->value), expect_contains (substring of body), max_latency_ms. Result begins with PASS/FAIL when assertions are given.

Lint Python code with ruff (optionally auto-fix).

List directory entries; directories end with '/'.

List TCP/UDP sockets with owning process. May need elevated rights to see other users' PIDs.

List processes (pid, name, user, cpu%, memory) sorted by 'memory' or 'cpu' or 'pid'.

List services (systemd on Linux, Get-Service on Windows, launchctl on macOS). state: e.g. running / stopped (Windows) or running / failed / active (systemd).

Extract code from a markdown file. Only fenced blocks tagged with language are kept unless extract_all_blocks is true. Prose becomes comments when include_prose is true.

NIC configuration: addresses, netmask, MAC, MTU, speed and up/down state, plus I/O counters.

Convert documents with pandoc (docx, html, md, rst, pdf output needs a LaTeX engine...). Runs in --sandbox mode so the document cannot read other files or run filters.

Show the active policy file path and contents, and where the audit log is written.

Extract values from a json/yaml/toml/csv/xml/psd1 file with a path expression such as 'servers[0].name', 'users[].email' or '.port'. Returns JSON (a list of matches).

Recent system events. Linux: journalctl (source = unit name, level = minimum severity). Windows: Get-WinEvent (source = log name, default 'System'; level = exact level). macOS: log show. level: critical|error|warning|info|verbose.

Read a text file. Lines are 1-based and inclusive; end_line=-1 reads to EOF.

Replace lines start_line..end_line (1-based, inclusive) with new_text. Use end_line=start_line-1 to insert before start_line.

Run a shell command and return exit code, stdout and stderr. The working directory must be inside the workspace (default: the workspace root). The command itself is NOT confined: a shell can still reach any path the server's user can.

Run pytest on a path with optional extra args (e.g. '-k name -x').

Convert a script into literate markdown: column-0 comment blocks (and PowerShell <# #> blocks) become prose, everything else becomes fenced code. Heuristic and meant for documentation; markdown_to_script reverses it.

Detailed status of one service.

OS, kernel, uptime, CPU, load, memory, swap and disk usage for this machine.

Add a todo (status pending) to the workspace scratchpad and return the updated list.

List the workspace todo scratchpad. Optional status filter: pending, in_progress, done.

Remove one todo from the scratchpad by id; returns the updated list.

Change a todo's status (pending, in_progress, done) and/or text; returns the updated list.

Download a web page (after explicit user confirmation), sanitise it and save it as a local markdown file. Returns the file path only; read the file to consume it. Executable/archive/ document extensions and non-text content types are rejected; scripts, forms, iframes, event handlers and unsafe links are stripped. Private/loopback addresses are blocked.

Show the workspace root this server is confined to and whether confinement is active.