Skip to main content

Built-in Tools

Rusty provides a set of built-in tools that the LLM can invoke during a conversation. Each tool has a defined permission level and purpose.
ToolPermissionDescription
file_readReadOnlyRead file contents with optional offset and limit
file_writeWriteCreate or overwrite files
file_editWriteExact string match-and-replace editing
apply_patchWriteApply unified diff patches
bashClassifiedExecute shell commands
grepReadOnlyRegex search across files
globReadOnlyFile pattern matching
web_fetchReadOnlyFetch content from URLs (with SSRF protection)
web_searchReadOnlySearch the web for current information
todowriteNoneStructured task list management
agentNoneSpawn sub-agents for complex tasks

Permission Levels

Tools operate under one of four permission levels:
  • None: No special permissions required. Always allowed.
  • ReadOnly: Can read data but cannot modify files or system state.
  • Write: Can create or modify files in the working directory.
  • Execute: Can run system commands. The bash tool is classified per-command.

Path Sandboxing

All file tools enforce path sandboxing. Paths are canonicalized and validated to ensure they remain within the working directory. The sandbox is TOCTOU-hardened against symlink races: all operations use openat2() with RESOLVE_BENEATH on Linux, and equivalent atomic lookups on macOS. Attempts to access files outside the sandbox are rejected.

Tool Definitions

Each tool exposes:
  • Name: Unique identifier
  • Description: What the tool does
  • Input schema: JSON Schema defining accepted parameters
  • Permission level: What permissions the tool requires
The LLM receives tool definitions at the start of a conversation and can invoke them by name with structured arguments.