Show the workspace root this server is confined to and whether confinement is active.

Read a text file. Lines are 1-based and inclusive; end_line=-1 reads to EOF.

Create a file (and parent dirs) with the given content.

Replace old_string with new_string in a file. Fails unless it matches exactly once (or replace_all is true). dry_run=true returns a unified diff without writing.

Apply several edits atomically. Each edit is {"old_string": ..., "new_string": ..., optional "replace_all": "true"}. Edits apply in order; if any fails nothing is written.

Replace lines start_line..end_line (1-based, inclusive) with new_text. Use end_line=start_line-1 to insert before start_line.

List directory entries; directories end with '/'.

Delete a file or directory (recursively).

Regex search file contents. Returns path:line: text matches. Skips git-ignored files (and .git, node_modules, .venv) unless respect_gitignore=false. Use offset to page.

Find files by glob pattern (e.g. '**/*.py'), relative to path. Skips git-ignored files unless respect_gitignore=false. Use offset to page.

Run a shell command and return exit code, stdout and stderr. The working directory must be inside the workspace (default: the workspace root). The command itself is NOT confined: a shell can still reach any path the server's user can.

Show short git status.

Show git diff (optionally staged and/or for one path).

Show recent commits.

Stage files.

Commit staged changes.

Initialise a new git repository (non-destructive; existing repos are left intact).

Create a new branch (and optionally switch to it). Never overwrites an existing branch.

Switch to an existing branch. Git refuses if it would overwrite local changes.

Create a tag (annotated if message given). Never moves or replaces an existing tag.

Push a branch (default: current) to a remote. Force pushes and ref deletion are not supported. tags=true pushes tags instead of a branch.

Show who last changed each line of a file (read-only). Optionally limit to a line range.

Show a commit's message and diff (read-only). stat_only=true gives only the file summary.

List branches with their last commit and upstream (read-only). all_branches includes remotes.

List stashes (read-only).

List configured remotes and their URLs (read-only). Credentials in URLs are masked.

Summarise changes per file (read-only), compact for large diffs. base compares with a revision.

Run pytest on a path with optional extra args (e.g. '-k name -x').

Lint Python code with ruff (optionally auto-fix).

Format Python code with ruff; check_only=True only reports.

Download a web page (after explicit user confirmation), sanitise it and save it as a local markdown file. Returns the file path only; read the file to consume it. Executable/archive/ document extensions and non-text content types are rejected; scripts, forms, iframes, event handlers and unsafe links are stripped. Private/loopback addresses are blocked.

Convert between json, yaml, toml, csv, xml and psd1 (PowerShell data files). Provide either path or text. from_format is inferred from the file extension when omitted. With output_path the result is written there; otherwise it is returned. Reading psd1 needs pwsh (restricted language mode, no code execution); XML uses @attr / #text conventions.

Extract values from a json/yaml/toml/csv/xml/psd1 file with a path expression such as 'servers[0].name', 'users[].email' or '.port'. Returns JSON (a list of matches).

Convert a script into literate markdown: column-0 comment blocks (and PowerShell <# #> blocks) become prose, everything else becomes fenced code. Heuristic and meant for documentation; markdown_to_script reverses it.

Extract code from a markdown file. Only fenced blocks tagged with language are kept unless extract_all_blocks is true. Prose becomes comments when include_prose is true.

Convert documents with pandoc (docx, html, md, rst, pdf output needs a LaTeX engine...). Runs in --sandbox mode so the document cannot read other files or run filters.

Send an HTTP request (localhost and private addresses allowed) and report status, timing, redacted headers and a truncated body. Optional assertions: expect_status, expect_json ({"data.items[0].id": 5} path->value), expect_contains (substring of body), max_latency_ms. Result begins with PASS/FAIL when assertions are given.

Tiny load probe: send requests requests (max 200) with concurrency workers (max 20) and report status counts, errors and latency percentiles. Use only against systems you own.

OS, kernel, uptime, CPU, load, memory, swap and disk usage for this machine.

List processes (pid, name, user, cpu%, memory) sorted by 'memory' or 'cpu' or 'pid'.

List TCP/UDP sockets with owning process. May need elevated rights to see other users' PIDs.

NIC configuration: addresses, netmask, MAC, MTU, speed and up/down state, plus I/O counters.

Resolve a hostname to its addresses using the system resolver.

Test whether a TCP connection to host:port succeeds, with connect time.

List services (systemd on Linux, Get-Service on Windows, launchctl on macOS). state: e.g. running / stopped (Windows) or running / failed / active (systemd).

Detailed status of one service.

Recent system events. Linux: journalctl (source = unit name, level = minimum severity). Windows: Get-WinEvent (source = log name, default 'System'; level = exact level). macOS: log show. level: critical|error|warning|info|verbose.

Query CIM/WMI classes via Get-CimInstance (Windows only), e.g. Win32_OperatingSystem, Win32_LogicalDisk, Win32_NetworkAdapterConfiguration, Win32_Service. filter is a WQL WHERE clause such as "DriveType=3". Read-only.

Environment variables of the server process. Values of secret-looking names are redacted.

List the workspace todo scratchpad. Optional status filter: pending, in_progress, done.

Add a todo (status pending) to the workspace scratchpad and return the updated list.

Change a todo's status (pending, in_progress, done) and/or text; returns the updated list.

Remove one todo from the scratchpad by id; returns the updated list.

Show the active policy file path and contents, and where the audit log is written.

Return the most recent audit log entries (JSON lines), if auditing is enabled.

Return usage docs and examples for a tool group (filesystem, search, shell, git, python, web-fetch, data-conversion, api-testing, diagnostics) or 'index'. Call this after a tool error.