Retrieve a full system health snapshot: CPU usage, core count, memory, swap, disk usage, and uptime.

Use this as the first tool when diagnosing system performance issues or answering questions like "why is my machine slow?" or "how much disk space is left?". For deeper investigation, follow up with get_top_processes, get_disk_usage, or get_network_info.

This is a read-only operation with no side effects. Takes ~0.5 seconds due to CPU sampling.

Returns a Markdown report with sections: CPU, Memory, Swap, and Disks. Each section shows current usage as absolute values and percentages. Disk partitions that require elevated privileges are silently skipped.

List the top resource-consuming processes sorted by CPU or memory usage.

Use this to identify which processes are consuming the most resources. Use sort_by="memory" (default) to find memory hogs, or sort_by="cpu" to find CPU-intensive processes. Use get_system_overview first for the big picture, then this tool to drill down into specific processes. To search for a specific process by name, use find_process instead.

This is a read-only operation with no side effects. When sorting by CPU, takes ~0.5 seconds for accurate sampling; memory sorting is instant.

Returns a Markdown table with columns: PID, Name, CPU%, Mem%, RSS, Status. Processes that exit during enumeration or require elevated access are skipped.

Args: sort_by: Sort criterion — "cpu" for CPU usage or "memory" for RAM usage. Default: "memory". Any value other than "cpu" is treated as "memory". limit: Maximum number of processes to return. Range: 1-50. Default: 10. Values outside the range are clamped automatically.

Show detailed disk usage for all mounted partitions with I/O statistics.

Use this for disk space analysis — identifying full partitions, comparing filesystem usage, or checking I/O throughput. For a quick disk summary as part of overall system health, use get_system_overview instead.

This is a read-only operation with no side effects.

Returns a Markdown table with columns: Mount, Device, Total, Used, Free, Usage%, FS type. Also includes cumulative disk I/O since boot (total bytes read/written). Partitions requiring elevated privileges are silently skipped.

Show all network interfaces with IP addresses, link speed, status, and traffic counters.

Use this to check network connectivity, find the machine's IP addresses, or investigate network throughput. Not suitable for packet-level analysis or firewall rule inspection.

This is a read-only operation with no side effects.

Returns a Markdown report grouped by interface. Each interface shows: UP/DOWN status, link speed in Mbps, IPv4/IPv6 addresses, and cumulative bytes sent/received since boot. Loopback and virtual interfaces are included.

Search for running processes by name using case-insensitive partial matching.

Use this to locate specific processes — for example, find_process("chrome") returns all Chrome-related processes. Use get_top_processes instead when you want to see the highest resource consumers regardless of name. After finding a process, you can use its PID with kill_process to terminate it.

This is a read-only operation with no side effects.

Returns a Markdown table with columns: PID, Name, CPU%, Mem%, RSS, User, Status. Returns a plain text message if no processes match. Processes that exit during enumeration or require elevated access are skipped.

Args: name: Process name or substring to search for. Matching is case-insensitive and partial — "fire" matches "firefox", "Firewall", etc.

Terminate a process by its PID. This is a DESTRUCTIVE operation.

Use this only after identifying the target process with find_process or get_top_processes. Always confirm the PID and process name with the user before calling this tool. Killing system processes may cause instability.

Side effects: sends a signal to the target process.

• Default (force=False): sends SIGTERM, allowing the process to clean up gracefully.

• force=True: sends SIGKILL, immediately terminating the process without cleanup. May require elevated privileges (sudo) for processes owned by other users.

Returns a confirmation message with the process name, or an error message if the process does not exist or access is denied.

Args: pid: The numeric process ID to terminate. Use find_process or get_top_processes to discover valid PIDs. force: If False (default), send SIGTERM for graceful shutdown. If True, send SIGKILL for immediate termination — use only when SIGTERM fails or the process is unresponsive.

List all listening TCP/UDP ports with the process that owns each one.

Use this to check what services are running and which ports are in use. Helpful for debugging "port already in use" errors or checking if a server is actually listening. For general network interface info, use get_network_info instead.

This is a read-only operation with no side effects.

Returns a Markdown table with columns: Proto, Local Address, Port, PID, Process. Only shows LISTEN (TCP) and bound (UDP) sockets. Connections requiring elevated privileges show "N/A" for PID and process name.

Retrieve battery charge level, power source, and estimated time remaining.

Use this when the user asks about battery life, charging status, or power source. Only available on laptops and devices with a battery. On desktops or VMs without a battery, returns a message indicating no battery was detected.

This is a read-only operation with no side effects.

Returns a Markdown report with: charge percentage, plugged-in status, estimated time remaining (if on battery), and a low-battery warning when charge drops below 20%.

Run a quick health check and return warnings for any metrics outside normal ranges.

Use this as a fast diagnostic — it checks CPU, memory, swap, disk, and battery and only reports problems. If everything is healthy, it says so. Use get_system_overview for full metrics regardless of health status.

This is a read-only operation with no side effects. Takes ~0.5 seconds due to CPU sampling.

Returns a Markdown list of warnings (high CPU, low memory, full disk, etc.) or a confirmation that all metrics are within normal ranges. Each warning includes the current value and the threshold that was exceeded.