Every capability surfaces as a step in the plan you can watch, faces the same approval gate, runs locally where it can, and lands in a trace you can replay. /tools prints the live registry with each tool's tier; a tool's tier can be overridden with /policy risk <tool> <tier> [--save].

tool	tier	does
`read_file`	read_only	read a workspace file
`write_file`	side_effecting	write a workspace file (pre-write snapshot backs `/undo`; the gate shows a diff)
`edit_file`	side_effecting	anchored string replace inside a file
`list_directory`	read_only	list a workspace directory
`search_files`	read_only	content regex search across files
`find_files`	read_only	find files by name glob
`run_shell`	destructive	run a shell command in the workspace — always gated
`web_search`	read_only · untrusted	keyless DuckDuckGo search — no key, no account
`web_extract`	read_only · untrusted	fetch a page and extract its text locally (`trafilatura`); only the page's own host is contacted
`calculate`	read_only	whitelisted-AST arithmetic; refuses a bare value
`current_time`	read_only	the machine's own clock
`search_knowledge_base`	read_only · untrusted	retrieve from your ingested documents (RAG)
`remember`	side_effecting	store a durable fact
`recall`	read_only	read durable facts back
`ask_user`	read_only	pause with one question; your answer resumes the turn
`mcp_<server>_<tool>`	your declaration	any tool from a configured MCP server

::files

File tools are sandboxed to the workspace (database/workspace/ by default). Every write takes a pre-write snapshot so /undo can revert a turn's file changes. The approval gate renders a write as a colored unified diff, says no change for a byte-identical rewrite, names an existing binary file as binary, and flags a path the sandbox will refuse as REFUSED.

::shell

run_shell hands the command to the host shell — PowerShell on Windows, /bin/sh on macOS/Linux — so write commands in your platform's native syntax. It is registered destructive, so it always hits the gate: the human seeing and approving the exact command is the safety boundary, not a path jail. Every run is a bounded foreground run with a timeout (shell.timeout, default 60 s); the child's environment is scrubbed of secret-shaped variables (shell.env_scrub); a command killed by a signal counts as a failed run. Prefix grants (/policy allow) let a reviewed command run unprompted next time, with the argument tail screened at every use.

::web

The web tools are API-less by design — a product whose pitch is "your data stays yours" shouldn't steer your search queries through a keyed SaaS backend. For deeper research the agent plans multiple search + read steps, visible in the rail and traced, rather than hiding them in a monolithic research tool. Both tools' output is untrusted and passes through the injection quarantine. web.max_results sets results per search.

::math and time

calculate evaluates arithmetic through a whitelisted AST — and refuses an expression that is a bare value, so a made-up number cannot be laundered into a "computed" result. current_time reads the machine clock, so "today" is computed, never guessed from memory.

::what is not a tool

http_request was removed. The MCP client is the integration surface: it does the same job with per-server trust declarations, outgoing-argument secret redaction, and connection status the generic tool never had — and with it gone, the list of ways anything can leave your machine is shorter to verify.