Tools

Below is the complete list of 23 built-in tools the Kodik agent can use. Availability depends on the current mode and that mode’s switch in Harness settings. Harness lists only tools structurally offered in the selected mode and summarizes the rest as not offered. File access is governed by .kodikignore rules.

When a model returns several independent tool calls in one turn, Kodik starts every admitted call concurrently, regardless of tool type. This includes built-in and MCP tools, file mutations, terminal commands, browser actions, and sub-agent child tools. Mutations that resolve to the same file or notebook preserve the model’s call order, including relative-path aliases, while unrelated resources still run concurrently. A call that still needs approval waits for confirmation, and dependent work remains sequential when one result is needed to form the next call.

Built-in tool names do not change with the selected model. Every tool-capable model edits files through the same create_file, edit_file, and delete_file interface, so changing models cannot silently change the file-operation contract.

Tool reference

Tool	Purpose	Notes
read_file	Read file contents	Supports line ranges via the ranges parameter. Files larger than the model’s context window cannot be read directly. Respects .kodikignore.
edit_file	Edit one file	Modifies one existing file with one or more exact { old_string, new_string } replacements. The agent copies old_string from the current file and provides a different new_string; an empty new_string deletes the match. Read the file first; multi-file work uses one call per file, and independent calls can run concurrently. An edit that cannot be applied is rejected on its own — the rest still apply, and the result names each rejected edit by its position. If none apply, the file is untouched. Complete-file replacements keep an exact, fully reviewable diff without the preview cost growing quadratically. Fuzzy recovery from a model’s whitespace or context drift is bounded; an overly ambiguous old_string leaves the whole file untouched and tells the agent to re-read it with more unique surrounding lines. Checks linter diagnostics for the written editor-model version after editing; a file without diagnostic activity does not incur a blind one-second wait.
create_file	Create one file	Creates one new text file from its complete literal contents, automatically creates missing parent directories, and refuses to overwrite an existing path. Empty content creates an empty file. Multi-file creation uses one call per file, and independent calls can run concurrently.
delete_file	Delete one file	Deletes one whole existing file. To remove text while keeping the file, the agent uses edit_file with an empty new_string; it does not delete and recreate a file to recover from a failed edit. Multi-file deletion uses one call per file, and independent calls can run concurrently.
edit_notebook	Edit a Jupyter notebook	Supports insert, edit, delete operations on code and markdown cells. Languages: Python, JS, TS, R, Julia, SQL. Edited notebooks follow the file-change display setting; open notebook editors are refreshed and saved after tool edits, and dirty notebooks must be saved or discarded first. Notebook edits appear in the File Changes review panel and participate in checkpoint restore like any other file edit.
shell	Run a terminal command	mode is optional and defaults to foreground. With no foreground_timeout_ms, a foreground command waits for completion without a hard total-duration deadline; five minutes without output promotes the same process to the background. An explicit timeout provides an earlier safety net. Use mode: "background" for known persistent processes.
get_terminal_output	Get background terminal output	Takes the terminal_id returned by shell and returns new output plus the command’s current lifecycle state. Use it only for an on-demand progress check; completion is delivered automatically.
kill_terminal	Stop a background process	Takes the terminal_id returned by shell, stops the command, frees its terminal, and returns the same lifecycle result shape with captured output. Auto-approved.
glob	Find files by pattern	Supports patterns like **/*.ts.
rg	Full-text search (ripgrep)	Regex search with ripgrep options. Respects .kodikignore.
codebase_search	Semantic search over the codebase	Uses the local index — see Indexing.
read_lints	Read linter diagnostics	Returns errors and warnings from VS Code for one or more files (or the whole workspace).
web_fetch	Fetch URL contents	HTTPS only (plain HTTP allowed only for localhost). Returns the page as Markdown. 30-second timeout.
web_search	Search the web	Kodik provider only. Returns ranked results (title, URL, snippet) and usually a synthesized answer. Billed per search from your credit balance.
browser	Drive the integrated browser	Available in modes where the mode policy allows it when the browser tool is enabled in Harness. Opens pages, can reuse open browser tabs, launch a dev server, take screenshots, read and clear bounded console output, inspect, resize, navigate, and interact with the page.
todo_write	Manage a task list	Creates and updates task items for multi-step sessions.
memory	Save notes to memory	Writes notes to workspace/global memory or to session memory for the current task. See Memory.
sub_agent	Delegate a subtask to a sub-agent	Launches a sub-agent with its own context. With background: true it returns immediately and the sub-agent reports back when it settles. See Sub-agents.
agent_status	Check on background sub-agents	Omit agent_id to list every background sub-agent in the current chat. With an id from a background sub_agent launch, reports that sub-agent’s status, goal, and elapsed time; wait: true blocks until it settles and returns its full report. See Sub-agents.
ask_questions	Ask clarifying questions	Asks concise questions when ambiguity would change the implementation.
check_understanding	Check understanding	Runs a short comprehension check in Educator mode.
create_lesson	Create lessons	Builds an interactive HTML lesson and opens it in the Integrated Browser in Educator mode.
generate_plan	Generate plans	Produces a reviewable implementation plan in Plan mode.
MCP tools	Any tools from MCP servers	Depend on connected servers. See MCP.

Connected MCP tools are appended to the same Harness tool list in every mode, including Plan, Ask, and Educator. Their selected-mode switches affect the next turn; MCP Settings continues to own server and tool configuration. Harness includes only active MCP tools in prompt guidance and totals. An MCP tool may have server-defined side effects even when the selected mode keeps Kodik’s built-in workspace tools read-only.

Details

read_file

The ranges parameter accepts an array of {start_line, end_line} objects and lets you read only the sections you need from a large file. If the file exceeds the size limit (derived from the model’s context window), read_file returns an informational message recommending rg or ranges instead.

read_file("src/server.ts", ranges=[{start_line: 1, end_line: 50}])

shell, get_terminal_output, and kill_terminal

shell runs one-shot commands in foreground mode by default, waiting for their final status and output. When foreground_timeout_ms is omitted, there is no hard total-duration deadline; a host safety watchdog moves the same process to the background only after five minutes without output. The model can set foreground_timeout_ms as an explicit earlier safety net. Reaching either limit does not kill or restart the command: the same process continues in the background and returns a terminal_id. For known persistent processes (dev servers, watchers, log streams), the agent can choose mode: "background" immediately. Completion updates the original shell result automatically; get_terminal_output is only for an on-demand progress snapshot or fresh logs before completion. shell, get_terminal_output, and kill_terminal all report the same lifecycle fields, including running state, terminal ID, exit code, and captured-output metadata.

The shell is for running commands, not for reading or searching files: the agent uses read_file, rg, and glob for that, and create_file, edit_file, and delete_file to change files. Because command output is captured from a terminal, text taken from it cannot preserve tabs, so an edit built from cat output would not match the file on disk.

Kodik runs these commands in the real integrated terminal. Shell integration is the terminal’s command-tracking protocol: when the selected shell supports it, Kodik receives exact command boundaries and exit codes. If integration is unavailable, Kodik still runs and captures the command, but reports Completion Unverified instead of inventing success or failure. Results stay scoped to the command that produced them; when a background process exits during an active turn, the model receives its real exit code when available and its final output.

If a command explicitly terminates its login shell, such as a status wrapper ending in exit 0, Kodik settles the command from the terminal process exit and preserves its final output and exit code. That dead terminal is discarded, and the next command starts in a fresh terminal automatically.

A running command keeps its terminal busy. Concurrent and later shell calls open another integrated terminal, so independent commands from the same model turn can start together and npm run dev can keep running while commands such as ls, tests, or HTTP checks execute alongside it. Finished terminals are reused for later commands.

Agent commands are excluded from the shell’s history in bash, zsh, fish, and PowerShell, so history search and arrow-up in your own terminals recall only your commands. This is controlled by the chat.tools.terminal.preventShellHistory setting (on by default); in bash and zsh the exclusion works by prepending a space to the dispatched command.

# Start a dev server in the background
terminal_id = shell("npm run dev", mode="background")

# Retrieve progress logs when needed
get_terminal_output(terminal_id=terminal_id)

codebase_search

Uses a vector index that is built automatically. Search is meaning-based rather than keyword-based. Requires the index to exist — see Indexing.

web_fetch

Opens a headless browser, loads the page, and returns its content as Markdown. Output is truncated at 60 KB. Plain HTTP is blocked except for localhost.

web_search

Lets the agent discover current information it doesn’t have a link for: latest library versions and APIs, unfamiliar error messages, breaking changes, official documentation pages. Searches run server-side through the Kodik backend, so no search-provider API keys live on your machine, and each successful search is billed as a flat amount against the same credit balance as model usage — failed searches are never charged. The agent composes the two web tools: search to discover, then web_fetch the most promising result to read it in full.

Available only on the Kodik provider. On Ollama and custom/bring-your-own-key providers the tool is not offered, since searches there can’t be served or billed. Approval has its own auto-approve toggle (webSearch) — see Auto-Approve.

A completed search shows in the chat as a collapsed card with the query and the result count. Expand it to browse the results the agent saw — title, URL, and snippet for each — and click a result to open it in your browser.

browser

Drives the same Integrated Browser surface you see in Kodik. The agent opens its own temporary, isolated tab by default. A tab you opened remains private until you focus it and explicitly approve sharing it with the current chat; releasing that access does not close your tab. The agent can start a preview at a URL, optionally run a dev-server command first and wait for the URL to respond, then stop the preview and the server it started.

Use browser for browser-rendered work. It can list the tabs owned by or shared with the current chat, select an attributed popup or child tab by its session ID, capture viewport, element, clip, or full-page screenshots, read and clear the bounded console buffer, resize to mobile/tablet/desktop breakpoints, navigate/reload/back/forward, inspect an element’s HTML/styles/box through typed browser diagnostics, and read a compact accessibility snapshot across open shadow roots and frames. It can click, fill fields, press key combinations, select options, check controls, hover, drag, and scroll either the page or a nested container. If semantic targeting is impossible, it can use coordinates tied to a recent screenshot; stale or unrelated screenshot coordinates are rejected.

Snapshot references are valid only for the current observation. The agent can target controls strictly by role/name, label, placeholder, text, test ID, link target, CSS, and frame, and wait for URL, load, network idle, text, element, popup, dialog, file-chooser, or download state; waits are bounded and cancelable, and ambiguous or stale targets fail instead of silently hitting the first match. JavaScript dialogs are reported before the page resumes, uploads are limited to approved workspace files, and agent downloads are saved in temporary session-owned storage. If an owned browser view is lost, the next browser action makes one bounded reconnect, reloads the last page, and reopens the visible tab.

For authenticated flows, run Kodik: Save Browser Credential and bind the credential to its exact http:// or https:// origin. The agent sees only its label and opaque ID; Kodik fills the stored username/password below the model-visible boundary and refuses reuse after an origin change. Clipboard reads/writes and credential selection require approval. diagnostics reports bounded page errors, failed requests, performance metrics, and asset state, while activity shows a secret-redacted audit trail. Browser pages are always treated as untrusted observations. A CAPTCHA, passkey, MFA, or device-approval challenge pauses automation for user takeover; use the pause control in the Browser toolbar to take or return control yourself.

Opening arbitrary URLs, launching dev servers, and interacting with pages follow your auto-approval settings. The deprecated eval compatibility action cannot run arbitrary JavaScript: it accepts only literals/arithmetic, approved page or element property reads, and lesson-state data; assignments and function calls are rejected. Screenshots captured by the agent appear inline in the chat; click a screenshot thumbnail to open the full image in an editor tab.

.kodikignore

Tools including read_file, rg, and shell check .kodikignore before accessing files. Files matching patterns in .kodikignore are not accessible to the agent. See Ignore files.