Built-in tools
The model works through a registry of 45 built-in tools, plus every connected MCP server's tools (exposed as mcp__<server>__<tool>). Any agent can be restricted to a subset via allowed_tools — in its profile, in the Agent tool call, or globally with --allowed-tools / --disallowed-tools.
Read-only tools run without prompts; mutating tools go through the permission engine.
Files
Canonical names match Claude Code (Read / Write / Edit). Older FileRead / FileWrite / FileEdit names still resolve via aliases.
| Tool | What it does |
|---|---|
Read | Read a file (line ranges for big files; images and other binary formats handled natively) |
Write | Create or overwrite a file |
Edit | Exact string replacement, rendered as a word-level structured diff |
ApplyPatch | Multi-hunk patch apply (Codex-style) across one or more files |
NotebookEdit | Replace / insert / delete cells in a Jupyter notebook |
Access outside the workspace (cwd + --add-dir roots) asks first (confirmOutsideWorkspace).
Shell
| Tool | What it does |
|---|---|
Bash | Run a shell command (Unix). A built-in classifier separates read-only from state-changing commands: read-only runs free, mutating asks (bashPromptForWrites). Destructive patterns (rm -rf /, force-push to protected refs, …) are hard-blocked. Optional OS sandbox. |
PowerShell | Registered on Windows instead of Bash. .ps1 scripts containing Chinese are saved as UTF-8 with BOM, so Windows PowerShell 5.1 reads them as Unicode and quotes and pipes stay intact |
exec_command | Start an interactive command in a persistent PTY session — REPLs, debuggers, installers, dev servers. If it doesn't finish within yield_time_ms, returns a session_id to continue with write_stdin. Same read-only classifier and sandbox as Bash; prompts like a command in Default/AcceptEdits modes. Session quotas are tunable via HIPMMCODE_PTY_PER_AGENT / _PER_THREAD / _PER_WORKSPACE / _PER_TENANT / HIPMMCODE_MAX_PTY_SESSIONS. |
write_stdin | Feed input (e.g. "" for Ctrl-C) to an exec_command session and collect only the new output since the last call; also resizes the terminal (rows/cols) and terminates the session (terminate: true). Empty chars polls without writing. |
A command that reaches its timeout is not killed: it moves to the background with the output so far and keeps running, and the session gets a notice when it finishes. Ctrl+B sends a running foreground command to the background by hand.
Search
| Tool | What it does |
|---|---|
Grep | Regex content search (ripgrep-style, filters, context lines) |
Glob | Filename pattern matching (**/*.rs), sorted by mtime |
ToolSearch | Find deferred / niche tools by keyword when the full catalog is too large to expose at once |
Web
| Tool | What it does |
|---|---|
WebSearch | Real-time search — native Anthropic / DeepSeek-Anthropic / Gemini; xAI Responses web_search on Grok; AnySearch elsewhere. Unified Sources: footer. See Web search |
WebFetch | Fetch a URL and read it as text |
Image generation
| Tool | What it does |
|---|---|
GenerateImage | Generate an image from a text prompt on the active channel and save it to output_path (default: cwd). OpenAI / openai-codex: /images/generations with size / quality. xAI / xai-oauth: xAI Imagine (grok-imagine-image*) — OpenAI size/quality are mapped or ignored; the wire body uses Imagine aspect_ratio + b64_json (never send raw OpenAI-only enums that xAI rejects with 400). |
Video generation
| Tool | What it does |
|---|---|
GenerateVideo | Qwen Token Plan video, and Grok video billed on a platform plan. Qwen: native video on qwen-token-plan or qwen-token-plan-anthropic—not a Skill. Uses the configured sk-sp-... key for happyhorse-1.1-t2v (text only), happyhorse-1.1-i2v (exactly one public/data-URL first frame), or happyhorse-1.1-r2v (1–9 public/data-URL reference images); current Personal and Team lists include all three. Parameters include resolution (720P/1080P), ratio, duration (3–15 seconds), and output_path. A new high-Credit task passes the permission gate before submission. HiPMMCode reserves a brand-new pinned destination, stores its task_id, polls it, and immediately downloads the short-lived result to a local MP4. Supplying task_id resumes the same task without another paid POST; platform sessions must also pass an explicit output_path, and a scoped recovery_token can recover the rare case where submission succeeded but its private receipt could not be saved. No existing entry, including an empty file, is overwritten. |
Speech synthesis
| Tool | What it does |
|---|---|
GenerateSpeech | Qwen Token Plan speech, and Grok TTS billed on a platform plan. Qwen: native TTS on either direct Token Plan chat channel—also not a Skill. Reuses the configured sk-sp-... through the official WebSocket and qwen-audio-3.0-tts-plus (Personal and Team). Defaults to the Plus-compatible voice longanlingxin, MP3 at 22050 Hz; supports compatible voices, MP3/WAV/Opus/PCM, volume/rate/pitch, one language hint, and the model's instruction control (100 weighted units). It asks before consuming Credits, streams and validates the complete audio, then capability-atomically saves it to a newly reserved local path. No existing entry, including an empty file, is overwritten. |
Multi-agent
| Tool | Key parameters |
|---|---|
Agent | Spawn a teammate: name, prompt, agent (profile), provider/model (any channel), background (return immediately with an id), allowed_tools, isolation: "worktree" (own git worktree), subagent_type: "fork" (inherit parent transcript), effort. A non-empty name creates an addressable resident in the session's implicit team; there is no model-visible team create/delete step. |
SendMessage | Message another agent, the lead, or a /renamed live session on this machine |
ListPeers | List the current session's implicit-team members and local @ cross-session peers |
Advisor | Ask a stronger model for a second opinion at a decision point (advisorModel) |
Task management
| Tool | What it does |
|---|---|
TaskCreate | Add a task (subject, description, metadata) to the shared list |
TaskList / TaskGet | List tasks / read one in full |
TaskUpdate | Update status/owner/dependencies (blocks / blockedBy) |
TaskOutput | Read a background teammate's output (blocking poll with block_ms) |
TaskStop | Stop a background teammate |
Planning & flow
| Tool | What it does |
|---|---|
EnterPlanMode / ExitPlanMode | Read-only planning phase → present the plan for approval before touching anything |
TodoWrite | The agent's own visible todo list (drawn live in the task tree) |
AskUserQuestion | Structured multiple-choice question to you (supports headless webhook routing) |
Sleep | Pause N ms (waiting on background work) |
Scheduling & monitoring
| Tool | What it does |
|---|---|
CronCreate / CronList / CronDelete | Schedule recurring or one-shot prompts (cron syntax; durable via native .hipmmcode/scheduled_tasks.json + hipmmcode cron daemon; a legacy .claude file is read only when the native file is absent) |
ScheduleWakeup | Self-paced wake-up for /loop dynamic mode |
Monitor / MonitorList / MonitorStop | Watch a long-running command's output stream and get notified per matching line. v0.11.0+: Now reachable on all channels (deferred-tool gate fixed) |
PushNotification | Send a terminal/desktop notification |
Monitor tool availability (v0.11.0+)
The Monitor tool is now callable on every provider channel. Previously it was hidden on OpenAI/codex paths. The deferred-tool gate now activates only when the deferred pool is genuinely large (≥10% of context window).
Workspace isolation
| Tool | What it does |
|---|---|
EnterWorktree / ExitWorktree | Switch the session into an isolated git worktree (and back, keep-or-remove). Also per-agent via Agent(isolation: "worktree") and manually via /worktree |
Knowledge & code intelligence
| Tool | What it does |
|---|---|
Skill | Load a skill's full playbook on demand (progressive disclosure — see Skills) |
SaveMemory | Write a durable memory file (see Sessions & memory) |
LSP | Language-server operations: definitions, references, hover, symbols, diagnostics (alias: Lsp) |
CodebaseGraph | Tree-sitter code intelligence without installing rust-analyzer/tsserver: goToDefinition, findReferences, documentSymbol, workspaceSymbol (Rust / TS / JS / Python / Go) |
Artifact | Publish / update / list / visibility / delete hosted HTML artifacts (same surface as /publish; see Publishing artifacts) |
McpConfig | Let the agent add / remove / list MCP servers itself ("connect the Notion MCP server") — mutating changes are permission-gated |
MCP (dynamic)
| Tool | What it does |
|---|---|
mcp__<server>__<tool> | Every tool of every connected MCP server, namespaced |
ListMcpResources / ReadMcpResource | Enumerate / read MCP resources |
RefreshMcpTools | Re-run tools/list over already-connected MCP servers and publish the changed schemas before the next model request — pick up a server's new/renamed tools without restarting the session. A failed refresh keeps the previous catalog, stale concurrent results can't overwrite newer ones, and a disconnected server is never silently redialed. |
Multimodal input
Not a tool, but part of the same pipeline: files you drag, @-mention, or /paste attach to your message. Images are analyzed on vision-capable models. On DeepSeek, pixels go up through the Files API and deepseek-flash reads them on the selected model — there is no one-turn detour. Videos on video-capable channels (Gemini, Kimi/Moonshot, …) — the model sees actual frames, not a filename. Inline cap 32 MB (HIPMMCODE_VIDEO_MAX_MB). Non-capable models receive a graceful text placeholder naming which models can view the file.
Tool result truncation (v0.11.0+)
Oversized tool results are now automatically clamped at the dispatch layer to prevent context overflow:
| Tool category | Truncation limit |
|---|---|
| MCP tools | 50,000 characters |
| Bash / PowerShell | 30,000 characters |
| Grep / Glob / ToolSearch | 20,000 characters |
| Others (default) | 100,000 characters |
When a result exceeds its limit, the overflow is spilled to disk and the tool result includes a pointer to the spilled file that can be read with the Read tool. This prevents a single huge MCP result or shell output from blowing the context window.
Tools that already self-truncate (like Read with line ranges) are left alone.