> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seriora.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools

> Every tool the model can call, what it does, and which permission class it falls in.

seri ships seven tools, plus two the model reaches indirectly. Connecting an [MCP
server](/guides/mcp) adds one more, named `mcp`, through which every remote tool is called.

## File tools

| Tool         | Class | Does                                                                      |
| ------------ | ----- | ------------------------------------------------------------------------- |
| `read_file`  | read  | read a file's contents as text                                            |
| `write_file` | write | write a file, with an optional `LF` or `CRLF` line ending                 |
| `edit`       | write | a pure string transform: old string to new string. It never touches disk. |

`edit` returning a string rather than writing one is why it takes no path. The model has to follow
it with `write_file` to land the change, and it is also why `edit` takes no checkpoint of its own.

## Search tools

| Tool   | Class | Does                                             |
| ------ | ----- | ------------------------------------------------ |
| `grep` | read  | search for a pattern under a path, using ripgrep |
| `glob` | read  | list files under a path matching a glob          |

`grep` defaults to returning only the names of matching files, which is what most searches need
and costs a fraction of the tokens. `content` and `count` modes are opt-in.

Both cap their results, and both say when they were capped. A capped result is explicitly not a
complete answer, because re-running the same search can return a different subset.

seri unpacks its own ripgrep build to `~/.seri/rg/<key>/` on the first search of each release.
Deleting that directory is safe, and a run that cannot write there falls back to a temporary copy.

## Shell tools

| Tool         | Class | Does                         |
| ------------ | ----- | ---------------------------- |
| `bash`       | write | run a command via bash       |
| `powershell` | write | run a command via PowerShell |

Both cap each stream at 30,000 characters and say which stream was cut. A cut drops the middle
and keeps both ends, so redirect to a file and read the part you need rather than assuming you
got everything.

Both are killed after 2 minutes, with whatever they printed first, and set a `timedOut` flag.
Pass `timeoutMs` up to 600,000 for a command you expect to take longer.

Neither can be approved permanently. See [Permissions](/guides/permissions).

## The two indirect ones

| Tool                 | Class | Does                                                              |
| -------------------- | ----- | ----------------------------------------------------------------- |
| `dispatch_subagents` | read  | run up to three [subagents](/guides/subagents) on their own tasks |
| `skill`              | read  | run one of your [skills](/guides/skills)                          |

Both are classified as reads, and neither writes anything itself. `dispatch_subagents` hands the
child the parent's own permission mode, so a child's `bash` re-enters the same gate rather than
escaping it. `skill` reads one file you put under `.seri/skills/` yourself.

## Permission classes

| Class | Tools                                                                              |
| ----- | ---------------------------------------------------------------------------------- |
| read  | `read_file`, `grep`, `glob`, `dispatch_subagents`, `skill`                         |
| write | `write_file`, `edit`, `bash`, `powershell`, and every name seri does not recognise |

The read class is enumerated and everything else is a write, including names seri has never heard
of. That direction is deliberate: MCP opens the tool set to third parties, so absence from the
write list stops being evidence of safety.

## What takes a checkpoint

`write_file`, `bash` and `powershell`. Those are the three that can change the contents of the
filesystem. See [Checkpoints and undo](/guides/checkpoints).