Tools catalog¶
Generated from the architecture model
This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.
Side-effect classes (decision D21): read · sandbox · shared-write · external · production · publication · spend. Classes from shared-write upward require one approval per action bound to the exact version.
| Tool | Kind | Side-effect class | Owner service | Timeout (s) | Audit | Summary |
|---|---|---|---|---|---|---|
Apply patch (apply-patch) |
native | sandbox | ToolAdapterService | 60 | required | Apply a unified diff to the run's isolated workspace (git worktree); no shared system is touched until a change set is proposed. |
Browser session (browser-session) |
browser | sandbox | ToolAdapterService | 1800 | required | Sandboxed browser for reading pages and exercising UIs; navigation to allow-listed hosts only; form submission raises to external. |
Build and test (build-and-test) |
native | sandbox | ToolAdapterService | 3600 | required | Build and test the workspace in a sandbox; results as artifacts. |
Computer use (computer-use) |
computer-use | sandbox | ToolAdapterService | 1800 | required | Sandboxed desktop automation inside an isolated Windows environment; any effect beyond the sandbox is denied (technology radar: trial). |
Deploy to environment (deploy-environment) |
connector | production | ToolAdapterService | 1800 | required | Trigger a deployment pipeline for a Published release into an environment; production class, approval bound to the release manifest hash. |
Find references (find-references) |
native | read | RepositoryIntelligenceService | 30 | required | References and callers of a symbol. |
Get dependencies (get-dependencies) |
native | read | RepositoryIntelligenceService | 30 | required | Project, package, call and test-coverage edges of a path or symbol. |
Get git diff (get-git-diff) |
native | read | RepositoryIntelligenceService | 30 | required | Diff and status of a workspace or between revisions (read side). |
Graph query (graph-query) |
native | read | VectorMemoryService | 20 | required | Federated query over graph domains with temporal filters. |
HTTP call (http-call) |
connector | external | ToolAdapterService | 60 | required | Outbound HTTP through a connection (BC-16) with brokered credentials; external effect class by default, read when the connection declares idempotent reads. |
Knowledge search (knowledge-search) |
native | read | VectorMemoryService | 20 | required | Scoped hybrid retrieval with citations; the knowledge tool of every agent. |
List files (list-files) |
native | read | RepositoryIntelligenceService | 30 | required | File tree of a repository revision with filters; repository intelligence read tool. |
Azure DevOps MCP server (mcp-azure-devops) |
mcp-server | shared-write | McpServerRegistryService | 60 | required | Consumed MCP server for work items, pipelines and repositories; tool bindings carry read or shared-write classes per tool. |
Factory MCP server (exposed) (mcp-factory-exposed) |
mcp-server | read | McpServerRegistryService | 60 | required | The Factory's own authenticated MCP server for IDE clients: knowledge, repository and run tools under the caller's scope. |
GitHub MCP server (mcp-github) |
mcp-server | shared-write | McpServerRegistryService | 60 | required | Consumed MCP server for repositories, issues and pull requests; bindings per tool. |
Propose change set (propose-change-set) |
native | shared-write | ToolAdapterService | 120 | required | Push the workspace diff as a branch and open a pull request through a connection; the first shared-system write of a coding run (approval bound to the change-set hash). |
Publish asset (publish-asset) |
native | publication | ToolAdapterService | 120 | required | Submit a release candidate for publication through BC-04; publication class. |
Read file range (read-range) |
native | read | RepositoryIntelligenceService | 15 | required | Content by path and line range from the snapshot; never whole repositories. |
Search symbols (search-symbols) |
native | read | RepositoryIntelligenceService | 30 | required | Symbols by name, kind and container at a revision. |
Search text (search-text) |
native | read | RepositoryIntelligenceService | 30 | required | Full-text search within a repository revision returning ranges. |
Shell (allow-listed) (shell-sandbox) |
native | sandbox | ToolAdapterService | 1800 | required | Allow-listed commands (dotnet restore, build, test; git diff, status; npm test) in a sandbox with egress allow-list; block-listed commands are denied or escalated. |
Write file (write-file) |
native | sandbox | ToolAdapterService | 30 | required | Create, delete or move files inside the isolated workspace. |