Tools

Effect is what a call can change: none (it only reads; never asks), project (it changes files or runs something; asks in build and defender mode, and in auto mode only when risky), or per call (decided from the arguments). Together means several such calls in one step run at the same time.

Modes. Plan mode has only the tools whose effect is none, plus the read-only helpers. Build, auto and defender have them all; defender also has read_playbook.

• Reading and searching
• Changing files
• Running commands
• Planning
• Git
• Asking you
• Security
• Sub-agents
• Finding more tools
• Paths, sizes and what is skipped

Reading and searching

read_file

Read a text file, with numbered lines (12<tab>text; the numbers are not in the file).

Effect none, together. A window says which lines it shows (app.go (lines 200-399 of 812)). Binary files and directories are refused, and so are files over 10 MB. Reading a file also remembers its content, so a later edit can tell whether someone changed it in between.

list_files

The files and folders under a path, folders ending in /.

Effect none, together. At most 500 entries; it says so when there are more.

glob_files

Files whose path matches a pattern, newest first.

Effect none, together. At most 500 paths.

grep_files

Search file contents. Uses ripgrep when it is installed (and so honours .gitignore), a built-in search otherwise.

Effect none, together.

Changing files

write_file

Create a file, or replace all of it. Folders on the way are created.

Effect project. If the file was read earlier in the session and has changed since (you edited it, another tool did), the write is refused until it is read again: Friday never overwrites what it has not seen.

edit_file

Replace exact text in a file.

Effect project. Refused, with the reason, when the text is not found, occurs more than once, or the file changed since it was read. Line numbers pasted from read_file output are recognised and stripped; a file with Windows line endings matches text written with plain newlines.

Running commands

run_command

Run a shell command in the project root (sh -c, or cmd /C on Windows) and wait for it.

Effect per call:

• Read-only commands run unasked in every mode, and several in one step run together: git status, git diff, ls, cat, rg, grep, find (without -delete, -exec), sed -n …p, head, wc, version and help checks. Every part of a compound command must be read-only, and anything that redirects, substitutes ($( )), backgrounds (&) or sets a variable is not.
• Everything else asks in build and defender mode; in auto mode it asks only when risky (credentials, deleting work, pushing, publishing, deploying, sudo, chmod 777).
• Command rules speak first: allow runs unasked (except in defender mode), ask always asks, forbid is refused with your reason. See Configuration → Command rules.
• Refused outright, whatever the mode: recursive forced rm, find -delete, git reset --hard, git clean -f, git checkout -- ., mkfs, dd if=, writing to a raw disk, the fork bomb.

The result is exit <code> and the output (stdout, then stderr), each kept to 200,000 characters. When the time runs out, the command and everything it started are stopped. A command that looks like a server or watcher (npm start, vite, --watch) gets 15 seconds; if it is still running then, it is stopped and the model is told it is a long-running process. A missing program is named, with a request not to retry it.

As proof. A successful run of a test, build, typecheck or smoke command counts as evidence that a change works. From weakest to strongest: a check (build, typecheck, lint), tests, a smoke run of the assembled program (a script Friday wrote counts), an end-to-end suite. Reading files or printing text does not count, and the result says when a run was not accepted as proof and why.

Planning

todo_write

The checklist for the task, shown with /todos.

Effect none. Unknown ids are reported, the others still applied; repeating an update that changes nothing is answered with "already recorded". Not given to sub-agents.

todo_read

The checklist as it is. Effect none, together. Found with tool_search.

Git

All read-only (effect none, together), with arguments checked so an option can never pose as a ref.

Asking you

ask_user

One question, when a decision is yours to make.

Effect none. Dismissing the question tells the model to decide and say what it assumed. Only the main conversation has it; a sub-agent's question would reach you without the context to answer it.

Security

Defender mode's tools. Its instructions list the playbooks by id, and tell the model to read the two or three that fit the project before it starts looking.

scan_secrets

Scan files for likely hardcoded credentials: cloud, GitHub, Google, Slack, Stripe and model API keys, private key blocks, JSON Web Tokens, and credential-looking assignments.

Effect none, together. Findings come worst first (critical, high, medium), each as path:line: [severity] kind — value. A value shows only its first and last four characters, so the result never holds a secret in full. Sent from the start in defender mode; found with tool_search in the others.

read_playbook

Read one security playbook in full, by id: access control, misconfiguration, supply chain, injection, client-side, authentication, APIs, SSRF, secrets, dependencies, cryptography, infrastructure, error handling, business logic, input validation, logging, AI applications, threat intelligence, and hardening resources.

Effect none, together. Defender mode only. An unknown id is answered with the list of ids.

Sub-agents

Only the main conversation has these; a sub-agent never starts another. Full guide: Sub-agents.

delegate_readonly_task / delegate_task

Start a helper. delegate_readonly_task takes the read-only roles (explore, plan, review, and your read-only ones) and several run together; delegate_task takes the others (general, verify, yours) and is not offered in plan mode.

Effect none: what the helper does is approved call by call, as Friday's own calls are. In the foreground the result is the helper's report; in the background it is the helper's id.

wait_agents

Wait for background helpers and collect their reports.

A report that already reached the conversation as a message is not given twice; the result says where it is.

send_agent

A running helper reads it at its next step. A finished helper is re-opened with it as a follow-up, keeping everything it read, in the foreground or background as it ran before.

close_agent

Stop a running helper (id); what it found so far becomes its report. Found with tool_search.

Finding more tools

tool_search

Present only while some tools are not sent with every request (see ARCHYMEDES_DEFER_TOOLS in Configuration). It ranks those tools by how well their names and descriptions match the query and makes the matches available from the next step. Calling such a tool by its exact name works without searching first.

Paths, sizes and what is skipped

• Every path is relative to the project root, or absolute inside it. Paths outside the project, ~ paths, and links that lead out of it are refused.
• Listing, globbing and the built-in search skip .git, node_modules, .hg, .svn, dist, target, vendor, __pycache__, .venv, .next and the engine's own go-sessions.
• A tool result over 40,000 characters (9,000 for a sub-agent) keeps its start and end, and says how many characters were left out in the middle. Cuts never split a character.