Every tool she has

40 tools across 13 toolsets. Enumerated from the live registry.

All nine Discord tools answer their availability check with a process-local flag that is only set inside the bot process, so in the web app and the terminal they are dropped and the real count is 31 across 12. Everything below is written for the full 40.

Nothing here is guessed. You can print the same list yourself:

python -c "
from kotoba.tools.registry import registry, all_toolsets
print(len(registry()), 'tools in', len(all_toolsets()), 'toolsets')
for n, s in sorted(registry().items()): print(f'{n:26} {s.toolset:10} {s.risk}')
"

The 13 toolsets

A connected MCP server adds a fourteenth kind of toolset, named mcp:<server> — for example mcp:browser. Those are work-mode only too, and they are not counted in the 40: they exist only while a server is connected.

Risk, and what it actually gates

Every tool declares a risk: read, write, exec or network.

Risk is not an approval level. It decides two things:

1. Whether you get a step row. write, exec and network are actions and draw a card in the panel. read draws no row — just a status line naming the tool.
2. Its minimum time budget. An exec tool is always given at least as long as its own approval card can stay open, so the loop cannot cancel it while you are still deciding.

The registry can filter on risk as well, but nothing does: every caller passes all four values, and the registry's own comment says why — "the companion gate and the sandbox/approval layer are the real safeguards."

What actually asks you for permission is narrower than risk suggests. Only these ask:

Everything else — including every file write and every tool an MCP server exposes — is jailed and audited, not carded. write_file never asks. It cannot leave the workspace, and that is the whole of its protection.

The full list

What can remove a tool from a turn

Six independent filters, applied every iteration in registry.schemas_for:

1. The family is switched off. Settings → toolsets, persisted in ~/.kotoba/settings.yaml under disabled_toolsets. This is a whole family — there is no way to disable one command.
2. Its check() says no. shell and execute_code disappear when KOTOBA_SANDBOX=none. All nine Discord tools disappear outside the bot process. An MCP tool disappears when its server drops. Results are cached for 30 seconds, because this runs on every loop iteration and a probe can do real I/O — and a probe that raises keeps the last known answer instead of flapping the tool in and out of the schema.
3. The mode. Companion drops the four non-companion families; work drops start_work and cancel_work.
4. A subagent's toolset filter. A helper sees one family plus the built-ins.
5. The MCP active set. In work mode, a connected server's tools are offered only after activate_tools — except browser, which is always active.
6. The turn's exclusion list. A Discord guest, for instance, is handed an allow-list and everything else is withheld by name.

web_extract has a seventh, in the loop rather than the registry: it is offered only when a real http(s) link appears in one of the last 3 user messages. Otherwise the model invents a URL to fetch instead of searching.

A switched-off family is also checked at dispatch, not only at offer time. Withdrawing a tool from the schema does not remove the name the model already had from earlier in the turn.