Every capability is a tool call you can watch in the rail. Each one faces the same approval gate, runs locally where it can, and lands in a trace you can replay. Reading runs without asking; anything that changes or sends something asks first. /tools --all prints the live registry with each tool's tier, and /policy risk <tool> <tier> [--save] overrides a tier, except for run_shell, run_shortcut, send_message, create_skill, add_document, and remove_document, which always keep theirs. untrusted marks a tool whose output is outside content: it passes through the injection quarantine.

::toolkits

Tools come in toolkits, and any toolkit you don't use can be turned off. A toolkit that is off is unbound: the model isn't shown its tools and can't call them, the prompt is smaller, and Saturn can never reach that app. Ask for something it would do ("what's on my calendar tomorrow?") and Saturn says the toolkit is off and names the command that turns it back on. Everything starts on.

commands

/tools                      the toolkits: how many tools, on or off, what each is for
/tools mail                 one toolkit's tools, each with its risk tier
/tools off messages mail    turn toolkits off (saved to config.yaml)
/tools on messages          turn one back on
/tools off shell --session  for this session only
/tools --all                every tool in one list, with its toolkit

The toolkits are files, web, shell, knowledge, notes, calendar, mail, contacts, reminders, messages, shortcuts, desktop (the browser tab and the Finder selection), notifications, and skills. The core (the checklist, ask_user, memory, the calculator, and the clock) is always on. The choice is saved under toolkits: in config.yaml, and a change applies to your next request. Turning a toolkit on never changes what the gate asks about: its tools keep their tiers. An MCP server is listed as a toolkit too, and turned on and off from /mcp.

::files

tool	tier	does
`read_file`	read_only · untrusted	read a file; PDF, Word (`.docx`), and Excel (`.xlsx`) come back as text. Other binary files are refused by name.
`write_file`	side_effecting	create, replace, or append to a file (the gate shows a diff)
`edit_file`	side_effecting	anchored string replace inside a file
`move_file`	side_effecting	rename or move a file or folder; `/undo` moves it back
`delete_file`	side_effecting	move a file or folder to the Trash, never erase it; `/undo` puts it back, which is why it isn't `destructive`
`list_directory`	read_only	list a folder
`search_files`	read_only · untrusted	regex search across file contents
`find_files`	read_only	find files by name glob

::shell, web, math

tool	tier	does
`run_shell`	destructive · untrusted	run a shell command in the working folder. It always faces the gate.
`web_search`	read_only · untrusted	keyless DuckDuckGo search
`web_extract`	read_only · untrusted	fetch a page and extract its text locally (`trafilatura`)
`calculate`	read_only	arithmetic through a whitelisted AST, never `eval`
`current_time`	read_only	the machine's own clock, timezone, and weekday

::knowledge, memory, skills

tool	tier	does
`search_knowledge_base`	read_only · untrusted	retrieve passages from your ingested documents; with no query, list the documents it holds
`add_document` · `remove_document`	side_effecting	add a file to the knowledge base, or move one of its documents to the Trash. Both always ask, and headless runs refuse them.
`remember`	side_effecting	store a durable fact in a memory layer. It asks first, unless you typed the fact yourself (see memory).
`recall`	read_only	read durable facts back
`create_skill`	side_effecting	save a procedure as one of your skills. You read the whole skill first, and it always asks.

::the loop

tool	tier	does
`plan`	read_only	the agent's checklist for a multi-step task, shown in the rail
`ask_user`	read_only	pause with one question; your answer resumes the turn

::your mac

tool	tier	does
`search_notes` · `read_note`	read_only · untrusted	find and read Apple Notes
`create_note` · `append_note`	side_effecting	start a note, or add to the one with exactly that title
`list_calendar_events`	read_only · untrusted	events in a window, optionally narrowed to named calendars
`create_calendar_event` · `update_calendar_event`	side_effecting	add an event; move, rename, relocate, or rewrite the notes of one
`delete_calendar_event`	destructive	remove an event
`list_mail` · `search_mail` · `read_mail`	read_only · untrusted	list, search, and read Apple Mail
`draft_mail` · `reply_mail`	side_effecting	open an unsent draft or threaded reply. You press Send.
`update_mail`	side_effecting	mark read/unread, flag, move, or trash a list of messages in one approval
`search_contacts`	read_only · untrusted	a name to the addresses, numbers, and birthday on the card
`list_reminders`	read_only · untrusted	open and overdue reminders
`create_reminder` · `complete_reminder`	side_effecting	add a reminder, tick one off
`read_messages`	read_only · untrusted	your Messages history (needs Full Disk Access)
`find_group_chats`	read_only · untrusted	your group chats and who is in them
`send_message`	destructive	send an iMessage to one person or one existing group chat. It always asks.
`list_shortcuts`	read_only	the Shortcuts you have built
`run_shortcut`	destructive · untrusted	run one of them; it asks unless you allowed it by name
`read_browser_tab`	read_only · untrusted	the page in your front browser tab
`finder_selection`	read_only	the files selected in Finder
`schedule_notification`	side_effecting	a one-off desktop alert at a time you name

Plus any tool from a configured MCP server, registered as mcp_<server>_<tool> at the tier you declare (destructive by default). See mcp servers.

::working with files

The file tools reach the working folder (where you launched Saturn) and any folder added with /add-dir, nothing else. Every write, edit, move, and delete is snapshotted first, so /undo reverts the turn. Searches skip ~/Library, dependency folders (node_modules, .venv, …), and hidden folders, and stop at 50,000 entries. A content search has a 10-second budget and says when it was partial. On macOS it also asks Spotlight's index, which finds text inside PDF, Word, and Excel files. Every Spotlight hit is re-checked against the file itself and the same folder limits. Saturn refuses to write its own control files. See the trust stack.

::running commands

run_shell hands the command to /bin/sh in the working folder. It's destructive, so it always faces the gate: you seeing and approving the exact command is the safety boundary. Every run is a bounded foreground run with a timeout (shell.timeout, default 60 s). A command never reads your terminal: a prompt for input gets end-of-input at once. A non-zero exit or a timeout is a failed call the answer tells you about. The child's environment is stripped of secret-shaped variables (shell.env_scrub), and each run is recorded as untracked on the egress ledger. Shell effects can't be undone with /undo.

::the web, without a key

The web tools need no API key, by design: a product whose pitch is "your data stays yours" shouldn't route your queries through a keyed SaaS backend. web_extract contacts only the page's own host plus any host its redirects reach. Saturn follows each redirect itself, so every host is checked against the air-gap and written to the egress ledger before it's contacted. It stops reading at 5 MB. For deeper research the agent issues several search and read calls, each visible in the rail, instead of hiding them in one research tool. web.max_results (default 5) sets results per search.

::what is not a tool

–There's no clipboard tool. Saturn reads the clipboard only when you type @clipboard, and /copy writes the last answer to it.
–There's no send_mail. Mail is drafted, never sent: you press Send.
–There's no generic http_request. MCP is the integration surface, with your own trust declaration per server.