TOOL_DIRECTORY [T2]

Complete registry of the 40+ tools the LLM can invoke. Each tool has an input schema, permission model, and execution function. Registered in src/tools.ts, defined in src/Tool.ts (794 lines).

ALWAYS_ON: 20+ FEATURE_GATED: 15+ ANT_ONLY: 5+

All_Tools Core_IO Search Agent_System MCP_Protocol Planning Web Tasks

terminal CORE_IO

BashTool

src/tools/BashTool/

Execute shell commands with PTY support. Handles timeouts, background processes, sandboxing. The most-used tool.

ALWAYS_ON NEEDS_PERMISSION

description CORE_IO

FileReadTool

src/tools/FileReadTool/

Read files with line numbers (cat -n format). Supports images, PDFs, notebooks. Offset/limit for large files.

ALWAYS_ON NO_PERMISSION

edit_note CORE_IO

FileEditTool

src/tools/FileEditTool/

Exact string replacement in files. old_string/new_string with uniqueness check. replace_all mode available.

ALWAYS_ON NEEDS_PERMISSION

note_add CORE_IO

FileWriteTool

src/tools/FileWriteTool/

Write entire file contents. Requires prior Read. Overwrites existing files. Prefer Edit for modifications.

ALWAYS_ON NEEDS_PERMISSION

search SEARCH

GrepTool

src/tools/GrepTool/

Ripgrep-powered content search. Regex, glob filters, multiline, context lines. 3 output modes: content, files, count.

ALWAYS_ON* NO_PERMISSION

folder_open SEARCH

GlobTool

src/tools/GlobTool/

Fast file pattern matching. Supports **/*.ts globs. Returns paths sorted by modification time. Any codebase size.

ALWAYS_ON* NO_PERMISSION

psychology AGENT

AgentTool

src/tools/AgentTool/

Spawn autonomous subagents. Each gets its own context, tools, and conversation. Supports background execution and worktrees.

ALWAYS_ON NO_PERMISSION

send AGENT

SendMessageTool

src/tools/SendMessageTool/

Continue a previously spawned agent by sending a follow-up message. Resumes with full context preserved.

ALWAYS_ON NO_PERMISSION

help AGENT

AskUserQuestionTool

src/tools/AskUserQuestionTool/

Request clarification from the user. Pauses execution until the user responds. Used when genuinely stuck.

ALWAYS_ON NO_PERMISSION

add_task TASKS

TaskCreate / Update / List / Get

src/tools/TaskCreateTool/ + 3 more

Break work into tracked tasks. Create, update status (in_progress/completed), list, get details. Gated by TodoV2 flag.

CONDITIONAL NO_PERMISSION

output TASKS

TaskOutputTool / TaskStopTool

src/tools/TaskOutputTool/ + TaskStopTool/

Read output from running tasks. Stop tasks that are no longer needed. Essential for agent orchestration.

ALWAYS_ON NO_PERMISSION

account_tree PLANNING

EnterPlanMode / ExitPlanMode

src/tools/EnterPlanModeTool/ + ExitPlanModeTool/

Switch to plan mode for designing implementation strategies. Restricts to read-only tools. Exit when ready to execute.

ALWAYS_ON NO_PERMISSION

language WEB

WebFetchTool

src/tools/WebFetchTool/

Fetch URLs and extract content. Handles HTML, JSON, text. Converts HTML to readable markdown.

ALWAYS_ON NEEDS_PERMISSION

travel_explore WEB

WebSearchTool

src/tools/WebSearchTool/

Search the web via API. Returns ranked results with titles, URLs, snippets. Used for documentation lookups.

ALWAYS_ON NEEDS_PERMISSION

hub MCP

MCPTool / ListResources / ReadResource

src/tools/MCPTool/ + 2 more

Call tools on external MCP servers. List and read MCP resources. McpAuth handles OAuth for remote servers.

ALWAYS_ON NEEDS_PERMISSION

auto_awesome AI

SkillTool / ToolSearchTool

src/tools/SkillTool/ + ToolSearchTool/

Execute skills within conversation. ToolSearch lazily loads deferred tool schemas to keep system prompt small.

ALWAYS_ON NO_PERMISSION

checklist MISC

TodoWriteTool / NotebookEditTool

src/tools/TodoWriteTool/ + NotebookEditTool/

Manage todo lists for tracking work. Edit Jupyter notebooks (add/edit/delete cells). Both always available.

ALWAYS_ON NEEDS_PERMISSION

lock GATED

Feature-Gated Tools

15+ tools behind bun:bundle flags

SleepTool (PROACTIVE/KAIROS), CronTools (AGENT_TRIGGERS), RemoteTrigger, MonitorTool, WorkflowTool (WORKFLOW_SCRIPTS), SnipTool (HISTORY_SNIP), WebBrowserTool, and more.

FEATURE_GATED VARIES

shield INTERNAL

Anthropic-Internal Tools

USER_TYPE === 'ant'

REPLTool (sandboxed VM), ConfigTool (settings editor), TungstenTool, SuggestBackgroundPRTool. Excluded from external builds.

ANT_ONLY EXCLUDED

TOOL_ARCHITECTURE

Every tool implements the Tool interface from src/Tool.ts. The registry in tools.ts assembles the pool via getAllBaseTools(), applies feature gates, permission deny rules, and REPL mode filtering.

MCP tools are merged via assembleToolPool() which deduplicates by name, with built-ins taking precedence.

TOOL_EXECUTION_FLOW

LLM Response (tool_use block)
  │
  ├── Parse tool name + input JSON
  │
  ├── Permission Check (ToolPermissionContext)
  │   ├── Always-allow rules?  ──→ Execute
  │   ├── Always-deny rules?   ──→ Reject
  │   ├── Hook pre-checks?     ──→ Evaluate
  │   └── Prompt user?         ──→ Wait for approval
  │
  ├── Tool.execute(input, ToolUseContext)
  │   ├── ToolUseContext provides:
  │   │   ├── commands, tools, mcpClients
  │   │   ├── abortController, readFileState
  │   │   ├── getAppState / setAppState
  │   │   ├── messages (conversation history)
  │   │   └── agentId, agentType (for subagents)
  │   │
  │   └── Returns: ToolResult (text/image/error)
  │
  └── Feed result back to LLM → continue tool loop