Analyzed: March 31, 2026 leak snapshot
src/tools.ts is the source of truth for which built-in tools can exist in this snapshot. The user-facing tool name can differ from the class or module name, especially when a tool exports a constant from a sibling constants.ts or prompt.ts file.

How to read this catalog

This page uses the module or class names that are directly registered in getAllBaseTools() inside src/tools.ts. For strict registry-level, per-item coverage, use: For each tool, the table lists:
  • Registration source
  • What the tool does from the implementation role implied by its module
  • Where its schema and prompt text live
  • Whether approval is usually involved
  • Notable gates or quirks visible in the registry
If a tool’s exact field list was not practical to transcribe safely from this snapshot, the page points to the schema file instead of guessing.

Always-present core tools

ModulePurposeSchema / prompt sourceApproval notesRegistry notes
AgentToolSpawns or delegates work to subagents.src/tools/AgentTool/High-risk. Delegation is permission-sensitive.Always registered. Central to agentic workflows.
TaskOutputToolEmits structured task output back into the loop.src/tools/TaskOutputTool/No separate user approval expected.Internal output shaper.
BashToolRuns shell commands in the active workspace or sandbox.src/tools/BashTool/One of the primary approval-gated tools.Always present unless hidden behind REPL/simple mode presentation.
GlobToolFile-name and path pattern search.src/tools/GlobTool/Normally auto-allowed.Omitted when embedded search tools are available in the build.
GrepToolContent search across files.src/tools/GrepTool/Normally auto-allowed.Omitted when embedded search tools are available.
ExitPlanModeV2ToolExits plan mode and returns to normal execution.src/tools/ExitPlanModeTool/May prompt depending on plan-mode policy.Always available in this snapshot.
FileReadToolReads file contents into context.src/tools/FileReadTool/Usually auto-allowed inside workspace.Core primitive.
FileEditToolApplies targeted in-place edits.src/tools/FileEditTool/Approval-sensitive because it mutates files.Core primitive.
FileWriteToolWrites or replaces full file contents.src/tools/FileWriteTool/Approval-sensitive.Core primitive.
NotebookEditToolEdits notebook-style files.src/tools/NotebookEditTool/Approval-sensitive.Separate from plain text editing.
WebFetchToolFetches a specific URL.src/tools/WebFetchTool/Domain and network policy can require approval.Always present.
TodoWriteToolWrites task/todo state.src/tools/TodoWriteTool/Usually low-risk.Present even when task-v2 is disabled.
WebSearchToolPerforms internet search.src/tools/WebSearchTool/Subject to network policy.Always present in this snapshot.
TaskStopToolStops a running worker or task.src/tools/TaskStopTool/Normally safe.Used heavily in coordinator flows.
AskUserQuestionToolInterrupts for explicit user input.src/tools/AskUserQuestionTool/User-facing by design.Core interaction primitive.
SkillToolInvokes project or installed skills.src/tools/SkillTool/Approval depends on the skill and its allowed tools.Bridge between model and slash-command-style skills.
EnterPlanModeToolSwitches the session into plan mode.src/tools/EnterPlanModeTool/May prompt depending on session policy.Always present.
BriefToolProduces condensed summaries / brief output.src/tools/BriefTool/Low-risk.Always registered.
ListMcpResourcesToolLists MCP resources exposed by connected servers.src/tools/ListMcpResourcesTool/Usually low-risk; depends on server trust.Exposed separately from normal MCP tools.
ReadMcpResourceToolReads a specific MCP resource.src/tools/ReadMcpResourceTool/Low-to-medium risk depending on server and resource.Always registered.
ToolSearchToolSearches the active tool space.src/tools/ToolSearchTool/Low-risk.Only present when optimistic tool search is enabled.

Anthropic-internal or product-gated tools

ModulePurposeGate visible in src/tools.tsApproval notesNotes
ConfigToolAnthropic-internal configuration surface.USER_TYPE === 'ant'Unknown externally.Not expected in public builds.
TungstenToolAnthropic-internal tool surface.USER_TYPE === 'ant'Unknown externally.Public behavior unclear in this version.
SuggestBackgroundPRToolSuggests background PR work.USER_TYPE === 'ant' via lazy requireLikely approval-sensitive.Internal-only feature path.
REPLToolWraps primitive tools inside REPL mode.USER_TYPE === 'ant' and REPL enabledReplaces direct primitive tool exposure in REPL mode.Registry hides REPL_ONLY_TOOLS when active.

Feature-gated productivity and orchestration tools

ModulePurposeGateApproval notesNotes
TaskCreateToolCreates task-v2 entries.isTodoV2Enabled()Low-risk metadata write.Present only when task-v2 is on.
TaskGetToolReads a task-v2 entry.isTodoV2Enabled()Low-risk.Task-v2 read primitive.
TaskUpdateToolUpdates a task-v2 entry.isTodoV2Enabled()Low-risk metadata write.Task-v2 write primitive.
TaskListToolLists task-v2 entries.isTodoV2Enabled()Low-risk.Task-v2 enumeration primitive.
SendMessageToolContinues an existing worker with new instructions.Always lazy-loadedMedium risk; can redirect running agents.Central to coordinator mode.
ListPeersToolLists available peers.UDS_INBOX featureLow-risk.Peer-to-peer integration path.
TeamCreateToolCreates an agent team / swarm.isAgentSwarmsEnabled()High-risk because it expands delegation.Lazy-loaded to avoid cycles.
TeamDeleteToolDeletes an agent team / swarm.isAgentSwarmsEnabled()Medium risk.Swarm teardown.
VerifyPlanExecutionToolVerifies completed work against a plan.CLAUDE_CODE_VERIFY_PLAN === 'true'Low-to-medium.Explicit verification helper.
WorkflowToolRuns bundled or configured workflows.WORKFLOW_SCRIPTS featureDepends on workflow contents.Initializes bundled workflows on load.
SleepToolSuspends or schedules delayed agent continuation.PROACTIVE or KAIROS featureLow-risk.Also creates ephemeral progress updates.
CronCreateToolCreates a cron trigger.AGENT_TRIGGERS featureMedium-to-high, because it creates autonomous follow-up work.Scheduling subsystem.
CronDeleteToolDeletes a cron trigger.AGENT_TRIGGERS featureMedium risk.Scheduling cleanup.
CronListToolLists cron triggers.AGENT_TRIGGERS featureLow-risk.Scheduling inspection.
RemoteTriggerToolCreates or handles remote triggers.AGENT_TRIGGERS_REMOTE featureMedium-to-high.Trigger bridge for remote execution.
MonitorToolMonitoring / watch-style automation.MONITOR_TOOL featureMedium risk.Monitoring semantics are product-gated.
SendUserFileToolSends a user file into another flow.KAIROS featureMedium risk because it transfers file data.Product-specific.
PushNotificationToolPushes a notification to the user.KAIROS or KAIROS_PUSH_NOTIFICATIONLow-risk.Notification channel.
SubscribePRToolSubscribes to PR activity.KAIROS_GITHUB_WEBHOOKS featureMedium risk due to external integration.GitHub webhook-related.
EnterWorktreeToolEnters isolated worktree mode.isWorktreeModeEnabled()Medium-to-high.Changes working execution environment.
ExitWorktreeToolLeaves worktree mode.isWorktreeModeEnabled()Medium risk.Restores prior environment.

Shell, browser, and debug surfaces

ModulePurposeGateApproval notesNotes
PowerShellToolWindows-native shell execution.isPowerShellToolEnabled()Primary approval-gated tool on Windows.Loaded lazily through getPowerShellTool().
WebBrowserToolRicher browser automation than fetch/search.WEB_BROWSER_TOOL featureHigh-risk due to interactive browsing.Separate from fetch/search.
TerminalCaptureToolCaptures terminal-panel output.TERMINAL_PANEL featureLow-to-medium.Tied to terminal panel UI.
OverflowTestToolTesting tool for overflow behavior.OVERFLOW_TEST_TOOL featureTesting only.Non-production utility.
CtxInspectToolContext-collapse inspection and debugging.CONTEXT_COLLAPSE featureLow-risk.Debug/inspection helper.
SnipToolHistory snipping / transcript surgery.HISTORY_SNIP featureMedium risk.Affects transcript/history shape.
TestingPermissionToolTest-only permission surface.NODE_ENV === 'test'Testing only.Never expected in normal usage.

External-integration tools

ModulePurposeGateApproval notesNotes
LSPToolQueries connected language servers for semantic code context.ENABLE_LSP_TOOLUsually low-risk read-only, but still external-process dependent.Backed by src/services/lsp/.
ListMcpResourcesToolLists MCP resources.AlwaysDepends on server trust.Separate from per-server MCP tools.
ReadMcpResourceToolReads an MCP resource.AlwaysDepends on server trust.Resource channel, not action tool.

Input schema pattern

Claude Code does not define tool inputs as ad hoc dictionaries. Each tool owns a Zod schema that is projected into prompt-facing JSON schema. Typical source locations are:
  • schemas.ts
  • prompt.ts
  • constants.ts
  • the tool module itself when the schema is small
Examples visible in the source tree:
  • src/tools/LSPTool/schemas.ts
  • src/tools/LSPTool/prompt.ts
  • src/tools/BashTool/
  • src/tools/PowerShellTool/
For exact field-level input contracts, use the individual module directories rather than assuming the class name is the complete interface.

Approval behavior by class of tool

The approval system is shared, but tool families predictably map to approval intensity:
  • File mutation: FileEditTool, FileWriteTool, NotebookEditTool
  • Shell execution: BashTool, PowerShellTool
  • Delegation and teams: AgentTool, SendMessageTool, TeamCreateTool
  • Remote or browser actions: WebBrowserTool, remote trigger tools
  • Read-only tools: file read, search, many MCP resource calls, most LSP usage
The actual decision still passes through src/utils/permissions/permissions.ts and any tool-specific checks.

Registry-level quirks worth knowing

  • CLAUDE_CODE_SIMPLE collapses the tool surface to a minimal set.
  • REPL mode replaces several primitive tools with REPLTool.
  • Blanket deny rules can remove tools before the model even sees them.
  • ListMcpResourcesTool, ReadMcpResourceTool, and synthetic output tools are treated specially in getTools().
  • Tool search is added optimistically and deferred at request time.