Tools

Every tool is a LangChain StructuredTool — the format deepagents expects. ToolProvider builds the list at agent construction, filters by role (for subagents) and by security profile, and wraps each in the rate limiter + audit + dedup pipeline before it reaches the LLM.

Core tools

File operations

Tool	Args	Purpose
`analyze_files_for_question`	`filePath`, `class_name?`, `function_name?`	Read a file, optionally filtered to a named symbol. Path validated against workspace.
`edit_file`	`filePath`, `mode: overwrite\|replace`, `content?`, `search?`, `replace?`	Safe replace or full overwrite. Search/replace is the surgical mode.
`ast_edit`	`filePath`, `nodeType`, `nodeName`, `newBody`	Tree-sitter-aware edit — replaces a named node’s body via byte ranges, re-indents, routes through diff review.
`compose_files`	`label`, `edits: [{filePath, mode, content?, search?, replace?}]`	Multi-file batch — one review, one commit conceptually.
`list_files`	`dirPath?`	Directory listing with type flags.
`find_files`	`query`	Fuzzy filename finder honoring `.gitignore` / `.codebuddyignore`.

Search

Tool	Args	Purpose
`ripgrep_search`	Pattern, glob, extra args	Fast regex over the workspace via bundled ripgrep
`search_symbols`	LSP-based query	Symbol search using the editor’s language servers
`search_vector_db`	`query: string`	Semantic search over indexed code chunks (see Semantic search)
`web_search`	`query`, `maxResults?`, `includeRawContent?`, `timeout?`	Web search via Tavily / Brave / Firecrawl (whichever key is set)

Editor & language server

Tool	Args	Purpose
`get_active_editor`	—	Active file, `languageId`, cursor/selection, visible ranges, dirty state (path-validated).
`lsp_query`	`filePath`, `kind: hover\|definition\|references\|signature`, `position`	Multiplexes over the `vscode.execute<Kind>Provider` commands.
`get_diagnostics`	Editor diagnostics API	Compiler errors, linter warnings, LSP diagnostics
`query_graph`	`operation: imported_by\|imports_of`, `filePath`	Reverse/forward import-graph queries (“who uses this?”), staleness-labeled by commit.

Execution

Tool	Args	Purpose
`run_terminal_command`	`command`, `background?`	Modal-approved shell command. Background mode for servers.
`manage_terminal`	`action: start\|execute\|read\|terminate`, `sessionId`, `command?`, `waitMs?`	Persistent terminal sessions with state.
`run_tests`	Framework-native args	Run configured test runner; structured pass/fail back.
`run_skill_script`	`skill`, `script`, action args	Runs an installed skill’s script (modal-gated). See Skills.

Debugging (Debug Adapter Protocol)

All 5 require an active vscode.debug session.

Tool	DAP request	Purpose
`debug_get_state`	`threads`	Threads + state
`debug_get_stack_trace`	`stackTrace`	Call stack
`debug_get_variables`	`scopes` → `variables`	Frame variables
`debug_evaluate`	`evaluate` (REPL context)	Expression eval
`debug_control`	`next`, `stepIn`, `stepOut`, `continue`, `pause`	Execution control

Browser (Playwright)

Tool	Args	Purpose
`browser`	`action`, plus action-specific args	Navigate, click, type, screenshot, snapshot, evaluate, hover, select, press key, wait, tab management. `evaluate` runs a regex-blocklisted expression (allow-list refactor tracked).
`open_web_preview`	`url`	Open in the editor’s built-in browser panel

Knowledge + reasoning

Tool	Args	Purpose
`think`	`thought: string`	Structured reasoning; output stays in LLM context
`manage_core_memory`	`action: add\|update\|delete\|search`, `memory: {...}`, `query?`	JSON-backed core memory. See Memory.
`manage_tasks`	`action: add\|update\|list`, `task: {id?, content?, status?, priority?}`	Task list for multi-step work
`get_architecture_knowledge`	`section?: all\|overview\|patterns\|call-graph\|middleware\|endpoints\|models`	Query pre-computed codebase analysis (12 KB cap)

Integrations

Tool	Args	Purpose
`git_ops`	Git-native write operations	branch, commit, stage, and other state-changing git actions
`git_read`	Read-only git operations	status, log, diff, blame (given to read-only roles)
`standup_intelligence`	`operation: ingest\|my_tasks\|blockers\|history`, `args: {notes?, person?, dateRange?}`	Parse + query standup notes
`team_graph`	`operation: person_profile\|...\|team_summary`, `args`	Team collaboration analytics

MCP tools

Dynamically loaded from configured MCP servers as LangChainMCPTool instances. Bypass role filtering — every subagent gets every MCP tool. See MCP.

Filtering pipeline

Each tool passes through, in order:

getToolsForRole(role) — filter by TOOL_ROLE_MAPPING (subagents only; main agent gets all)
Append MCP tools
PermissionScopeService.filter — remove tools the active security profile disallows
applyRateLimit — wraps in the sliding-window rate limiter (600/min global, 200/min per-tool)
Dedup wrapper — same (toolName, JSON.stringify(args)) returns cached result within one turn
Audit wrapper — records every invocation to .codebuddy/logs/audit.jsonl

Role mapping

Each subagent gets a filtered subset. Patterns are substring matches against tool names.

Role	Pattern set
`code-analyzer`	`analyze`, `lint`, `security`, `search`, `terminal`, `ripgrep_search`, `get_diagnostics`, `git_read`, `browser`
`doc-writer`	`search`, `read`, `web`, `edit_file`, `compose_files`, `standup_intelligence`, `team_graph`, `browser`
`debugger`	`debug_*`, `analyze`, `read`, `search`, `terminal`, `edit_file`, `get_diagnostics`, `browser`
`file-organizer`	`file`, `directory`, `terminal`, `git_ops`, `list_files`, `edit_file`, `compose_files`
`architect`	`search`, `think`, `standup_intelligence`, `team_graph`, `manage_core_memory`, `browser`
`reviewer`	`analyze`, `lint`, `review`, `git_read`, `get_diagnostics`, `search_symbols`, `standup_intelligence`
`tester`	`terminal`, `run_tests`, `edit_file`, `get_diagnostics`, `browser`
`architecture-expert`	`get_architecture_knowledge`, `search`, `ripgrep_search`, `search_vector_db`
`general-purpose`	Everything (deepagents-provided)

Security enforcement

Every tool passes through PermissionScopeService before being handed to any agent:

Profile	Effect
`restricted`	Read-only tools only — `analyze_files_for_question`, `search_*`, `list_files`, `get_diagnostics`, `lsp_query`, `get_active_editor`, `query_graph`, `git_read`, `think`, `web_search`
`standard`	Read/write + terminal with modal approval. Default.
`trusted`	Read/write + auto-approved terminal. Catastrophic patterns still deny.

Per-workspace custom rules in .codebuddy/permissions.json:

{
  "profile": "standard",
  "commandDenyPatterns": ["docker rm", "kubectl delete"],
  "toolBlocklist": ["browser"]
}

Details: Security.

Architecture — where the tool pipeline sits in the middleware stack
MCP — adding external tools
Subagents — how role filtering shapes each specialist