Tools and approvals

What the agent can do in your project, how it is confined and how approvals work.

In Peridot Code (desktop) and the CLI the model can do more than talk. It can use tools. A tool call is a small, well-defined action that runs on your computer, inside your project folder. After each call the model sees the result and decides what to do next. This repeats until the task is done.

The tools#

Tool	What it does	Asks you first?
`list_files`	Lists a folder, optionally recursively (3 levels, 500 entries).	No
`read_file`	Reads a text file with line numbers. Supports `offset` and `limit` for long files (400 lines by default).	No
`search`	Searches file contents with a regular expression (up to 100 matches).	No
`write_file`	Creates a file or overwrites one completely. Missing folders are created.	Yes (edit)
`edit_file`	Replaces exact text in an existing file.	Yes (edit)
`run_command`	Runs a shell command in the project folder: tests, builds, git, package managers.	Yes (command)

Plugins can add more tools. See Plugins.

Limits of each tool#

Files larger than 400 KB and binary files cannot be read. The agent is told to use search or read part of the file instead.
Listing and searching skip .git, node_modules, dist, build, .next, .svelte-kit, target, __pycache__, .venv and release.
edit_file needs old_string to match exactly and to appear once, unless replace_all is set. If it does not match, the agent is told to read the file again and copy the text exactly.
run_command has a 2 minute timeout, and its output is cut to about 30,000 characters (the start and the end are kept).
An agent run stops after 40 steps and tells you so. Tell it to continue if you want more.

Confinement#

Everything is confined to the project folder you chose:

Paths are resolved relative to the project. A path that leaves it, with .., as an absolute path, or through a symlink, is refused.
Searching never follows symlinks.
Commands start in the project folder. A command can of course do anything your user account can do, which is why commands need your approval.
Commands do not receive Peridot's own secrets. Environment variables that look like tokens, passwords, API keys, cookies or credentials are removed before a command runs. SSH_AUTH_SOCK is kept so git over SSH still works.

Warning

Approval is your safety net. Read commands before approving, especially ones that delete, install or deploy. "Auto approval" skips the check.

Approvals#

By default the agent works in Manual mode. When it wants to edit a file or run a command, a card appears in the chat showing exactly what will happen:

for a command, the command line,
for an edit, the text being removed and the text being added,
for a new file, its content.

Choose Approve to run it or Deny to refuse. If you deny, the agent is told not to retry and to ask what you want instead.

Reading tools (list_files, read_file, search) never ask. They are shown quietly, or not at all.

Auto approval#

Switch the approval control in the input to Auto approval to let the agent edit and run without asking. The choice is remembered on this computer. Use it in projects under version control, where you can review and undo what happened. In the CLI, Shift + Tab cycles between the two modes.

Stopping#

The stop button (or Ctrl + C in the CLI) ends the run at once. A running command is killed, and any approval card that was waiting is denied.

With an AI team#

Bots use the same tools and the same approvals. Each bot only gets the tools you gave it, and a card shows which bot is asking. See How hand-offs work.

← The desktop app Team overview →