mcp, through which every remote tool is called.
File tools
edit returning a string rather than writing one is why it takes no path. The model has to follow
it with write_file to land the change, and it is also why edit takes no checkpoint of its own.
Search tools
grep defaults to returning only the names of matching files, which is what most searches need
and costs a fraction of the tokens. content and count modes are opt-in.
Both cap their results, and both say when they were capped. A capped result is explicitly not a
complete answer, because re-running the same search can return a different subset.
seri unpacks its own ripgrep build to ~/.seri/rg/<key>/ on the first search of each release.
Deleting that directory is safe, and a run that cannot write there falls back to a temporary copy.
Shell tools
Both cap each stream at 30,000 characters and say which stream was cut. A cut drops the middle
and keeps both ends, so redirect to a file and read the part you need rather than assuming you
got everything.
Both are killed after 2 minutes, with whatever they printed first, and set a
timedOut flag.
Pass timeoutMs up to 600,000 for a command you expect to take longer.
Neither can be approved permanently. See Permissions.
The two indirect ones
Both are classified as reads, and neither writes anything itself.
dispatch_subagents hands the
child the parent’s own permission mode, so a child’s bash re-enters the same gate rather than
escaping it. skill reads one file you put under .seri/skills/ yourself.
Permission classes
The read class is enumerated and everything else is a write, including names seri has never heard
of. That direction is deliberate: MCP opens the tool set to third parties, so absence from the
write list stops being evidence of safety.
What takes a checkpoint
write_file, bash and powershell. Those are the three that can change the contents of the
filesystem. See Checkpoints and undo.