- Workspace: set, pick (macOS Finder), get_config
- File: list, read, write, append, rename, search, delete
- Shell: bash_terminal (sandboxed to workspace)
- Knowledge: save, search, list, update, delete, clear (persistent JSON)
- Web: fetch URL, search DuckDuckGo
- Math: safe eval (mathjs), datetime
- Crypto: UUID, password (no modulo bias)
- Encode: base64 encode/decode
- Sub-agent: consult_expert with 9 specialist roles

Security: path sandboxing, binary detection, safe math eval