Tools and the Tool Registry
Tools are how the agent acts on the world. A model that can only talk is limited to advice; tools let it read files, run commands, search code, and hand work to sub-agents. The engine keeps all available tools in a single registry and offers them to the model on each turn.
The eight built-in tools
Section titled “The eight built-in tools”Every engine ships with eight built-in tools:
- Read, Write, Edit: file access. Read loads a file, Write creates or overwrites one, Edit makes a targeted change.
- Bash: runs a shell command.
- Grep, Glob: search. Grep matches content, Glob matches filenames.
- Delegate: starts sub-agents that run tasks in parallel and return their results.
- ToolSearch: finds and loads tool schemas on demand.
These are the same eight tools in the desktop and on the command line, because both run the same engine.
Concurrency
Section titled “Concurrency”The registry separates tools that only read from tools that change state. Concurrency-safe tools (Read, Grep, Glob) can run in parallel, so the agent can search several places at once. Tools that change state (Write, Edit, Bash) run one at a time, so two writes never race. This split lets the agent move quickly on reads while keeping mutations ordered.
Deferred tools and ToolSearch
Section titled “Deferred tools and ToolSearch”A large set of tools costs prompt tokens just to list. To keep that cost down, tools can be deferred: their names are visible, but their full schemas load only when needed. ToolSearch is how the agent pulls a deferred tool’s schema into scope before calling it. It takes a single query string and returns every deferred tool whose name or description contains that substring, so the agent loads exactly the schemas it needs. This keeps the prompt small when a server exposes dozens of tools that the agent rarely needs all at once.
Where MCP and plan-mode tools fit
Section titled “Where MCP and plan-mode tools fit”The registry combines three sources: the eight built-ins, any tools provided by connected MCP servers, and a read-only subset used in plan mode. When tool names from different sources collide, MCP tools are auto-prefixed as mcp__{server}__{tool} so names stay unique.
Tool calls are gated by permissions. An allow list and auto-approve settings decide which calls run without asking. See Permissions and Sandboxing for how that gating works.