# Tools and safety
Magi-code uses tools to inspect repositories, edit files, run commands, research public pages, inspect images, and delegate work.
## Built-in tools
| `read` | Read files and skills. |
| `find`, `list_files` | Find paths or list a directory. |
| `grep`, `ast_grep` | Search text or source structure. |
| `write`, `hash_edit` | Create, replace, or edit files. |
| `bash` | Run shell commands. |
| `bash_job` | Read, inspect, stop, or list background shell jobs. |
| `view_image` | Inspect a local image with a vision model. |
| `web` | Search public sources or read a public page. |
| `subagents` | Delegate independent work. |
| `code_mode` | Batch tool calls with JavaScript. |
| `magi_control` | Check context usage or compact the conversation. |
Use `/settings` → Tools to enable or disable tools for Global or Project scope (`Ctrl-G`). Successful saves apply to future actions in the current session; Code Mode changes require restart.
## Review shell activity
Shell commands appear in Mission Control with an explanation of why they are being run. You can also run a command directly by starting a prompt with `!`:
```text
!git status
```
Shell guardrails inspect commands and bound execution, but they are not an operating-system sandbox. Magi-code runs with your account's filesystem and process permissions. Use a container or virtual machine for untrusted repositories.
For dev servers, watchers, or long builds, the agent can use `bash` with `background: true` and manage the returned ID through `bash_job`. Up to four jobs run per session, with bounded output buffers. `timeout` cannot accompany a background start. Jobs survive replies and Esc; stop them when finished. `/new`, switching sessions, quitting, or closing a local-agent connection stops them. Subagent jobs end with the subagent. Background file changes are not inferred.
Background command cards show a **background** label. Open `/background-jobs` to see running jobs in the primary conversation, select with Up/Down, and press `k` to stop one. Esc closes. The list refreshes automatically, works while the agent runs, and excludes side conversations and subagents.
Unix cleanup stops the process group; non-Unix cleanup stops only the direct child. SIGKILL can orphan jobs. See [background job limits and arguments](../features/tools-and-safety.md#background-jobs).
## Batch tool calls with Code Mode
Code Mode lets the agent run a short JavaScript script that calls existing tools in one batch, such as reading many files, filtering search results, or applying repeated edits. It is on by default. Disable it under `/settings` → Tools → Code Mode, save, and restart.
Every inner call keeps normal approvals, hooks, cancellation, and session records. Nested calls appear in the Activity Tree. The transcript card shows intent, live progress, call counts, elapsed time, and changed files. Its model-response token count is an estimate, not billed usage.
Code Mode is not a transaction: completed edits and commands remain applied after a later failure or cancellation. See [Code Mode](../features/code-mode.md) for limits and recovery.
## Track files touched by shell commands
With Jev enabled, **Track Bash file activity** under `/settings` → Optional Features adds files that Bash commands likely read, wrote, or edited to Session Files. Restart after enabling. Simple literal reads are recognized locally; other commands are classified by Jev in bounded background work.
These entries are inferences. They never count as confirmed edits and never allow `hash_edit` without a fresh read. See [Jev and internal tooling](../features/jev-and-internal-tooling.md).
## Control path access
Relative paths stay inside the launch directory. Absolute paths are allowed by default for tools with an absolute-path setting; disable them per tool when needed. These checks are not an operating-system sandbox.
## Images
The `view_image` tool sends a local image to the vision model configured in settings. It never falls back to the active chat model.
```json
{
"capabilities": {
"tools": {
"view_image": {
"vision_model": "openai-codex/gpt-5.5"
}
}
}
}
```
Kitty, Ghostty, and Herdr can also show local image previews in the transcript. Displaying a preview does not call a provider. Unsupported terminals keep text-only cards.
## Web research
With an active Codex provider, public search uses Codex OAuth. Other providers require `EXA_API_KEY` for search. Opening a public URL does not require that key.
Never place search credentials in settings or prompts.
## Protect sensitive data
Tool results can enter provider context and saved sessions. Avoid asking magi-code to read secrets. Inspect session exports and review-comment expansions before sharing them.
Magi-code applies path checks, output bounds, environment filtering, and redaction in supported surfaces. These controls reduce exposure; they do not prove that arbitrary repository content is safe.
## Advanced reference
See [Tools and safety model](../features/tools-and-safety.md), [Security notes](../features/security.md), and [Local transcript images](../features/terminal-images.md) for exact policies and limits.