> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools overview

> Code-reviewed functions that perform every action Assist takes.

## What are tools?

Tools are how Assist acts. Each one is a code-reviewed function that does one thing, such as scanning a disk, flushing the DNS cache or resetting an Okta password. Everything Assist does, on the device or in a connected cloud system, goes through a tool.

[Skills](/assist-skills-overview) decide what to do and when; tools do the work. The AI picks which tool to call and with what inputs, but it can't write commands or scripts, or do anything outside the tool list.

* **Read-only counterparts.** Tools that change something usually have a read-only partner, such as `get_*_info`, so skills can diagnose without changing anything.
* **Questions are tools too.** When Assist asks the employee to approve, choose or fill in a form, that pause is a tool, so it's checked and recorded like any other step.

<Card title="Skill and tool library" icon="book" horizontal href="https://github.com/idemeum/skills">
  Browse every tool's source and metadata on GitHub.
</Card>

## Tool metadata

Each tool declares its own metadata, and the [guardrails](/assist-guardrails) enforce it on every run:

| Property         | What it declares                                                                   |
| ---------------- | ---------------------------------------------------------------------------------- |
| Risk level       | Low, medium or high. Higher risk means stronger checks.                            |
| Destructive      | Whether it changes or removes anything.                                            |
| Requires consent | Whether the employee must approve it first.                                        |
| Supports preview | Whether it can show what would change before changing it.                          |
| Scope            | What it can touch, such as the employee's account, network settings or the system. |
| Audited          | Whether successful runs are recorded in the audit log. Failures always are.        |

For example, `kill_process` is medium risk, destructive, needs consent and supports preview, so Assist always shows a preview and waits for approval before it runs. The tool's metadata sets this, so neither the skill author nor the AI can skip it.

Inputs are checked against a strict schema before any tool runs, and tools refuse protected targets, such as system processes, whatever the plan says.

## Why deterministic tools?

Many AI agents act by writing and running scripts. Assist doesn't:

* **Reviewed once, trusted every time.** Every tool is reviewed and tested before it ships. A generated script is new, unreviewed code on every run.
* **No path from prompt to shell.** The AI can only choose from the tool list, so even a manipulated model can't run arbitrary code.
* **Checks set in advance.** Risk levels only work when every possible action is known ahead of time.
* **A clear audit trail.** The record names exactly which tool ran and with what inputs.
* **Predictable failures.** Tools return known errors that skills are written to handle.