Complete Tool Catalog and Capability Taxonomy

Conclusion: DeepSeek Harness has no single fixed “default tool list”; it has a provably complete shipped-package ceiling and a runtime view resolved by composition

1. Three Sets That Must Not Be Conflated

There is also a fourth, temporal dimension: definitions are live Cordis effects. Hot mounting or disposal after queueing but before start can change visibility or parallel classification. Auditing therefore needs the request header and durable call/result records; the process's current catalog cannot reconstruct history by itself.

2. Why the Generated Catalog Is Stronger Than Static Grep—and Still Not Runtime Truth

glob packages/*/tool-* → completeness guard
for each manifest entry:
  fresh Context → SystemPrompt → ToolRuntime → package-specific seams
  → mount plugin → ctx.tools.schemas(scope) → sort → dispose
render package map + name + description + JSON Schema + source link

3. Complete Package/Name Map (24 Packages, 51 Generated Names + 1 Shipped Configured Alias)

4. The Standard Web Root's Actual 25 Tools

exit_plan_mode remains in the schema even when planning is inactive so changing mode does not churn the tool catalog and request-cache prefix; execution rejects invalid state instead. Codex and Claude Code delegation rows are explicitly disabled in this preset, and web_fetch is absent.

5. Minimal Is Not Merely “A Smaller Standard”; It Encodes a Different Complete Product Assumption

This is why “the Harness supports 51 tools” and “this Agent has 2 tools” can both be true. Capability is not a binary product checklist; it is the language a profile/preset composes for an Agent.

6. Same Name Does Not Mean Same Semantics: Two bash Definitions

7. Filesystem Family: Discovery, Reads, Mutation, and Observation Are Separated

Notably, glob/grep are semantically read-only but do not opt into parallelism. Read/write semantics and scheduler classification are independent dimensions.

8. Shell, Terminal, and Job: Execution Capability Is Orthogonal to Lifecycle Control

bash/pwsh --run_in_background--> Job Registry <--terminal_send / one-shot subagent
                                        |
                           job_list / job_output / job_kill

terminal_open/read/send/signal/list/close → persistent PTY registry

Job tools are not a shell-specific API; they form one control plane across producers. The six terminal tools explicitly expose session creation, I/O, signaling, and close in exchange for stronger statefulness. Standard does not mount them. Minimal does not expose terminal controls either; it wraps a persistent PTY as the same bash name.

9. Plan, Goal, Todo, and Ask: Four Human/Collaboration States, Not One Task List

Chapter 15 analyzes their durable semantics. Here the important point is that similar names do not justify merging their tool surfaces.

10. Delegation, Workflow, and Ralph: Three Degrees of Orchestration Freedom

send_message/interrupt_agent/list_agents manage continuable children. report exists in the reverse direction inside child scope, not in the root catalog. Chapters 24–26 trace Sessions, activation, and inboxes.

11. Web, LSP, Session Query, and Skill: Stable Schemas, Potentially Absent Provider Capability

These tools separate their model-facing contracts from backends: web_search/web_fetch use ctx.web, lsp uses ctx.lsp, Session Query uses ctx.sessionQuery whose FTS can be disabled, and Skill uses a scope-layered catalog. Schemas may remain prefix-stable while execution returns unavailable/disabled. A visible tool never proves provider success.

12. The Cordis Toolset Is a Deliberately Opt-in “Modify My Runtime” Capability

The seven cordis_* tools define, inspect, run, stop, and undefine dynamic packages. A running package can register more model-visible tools until stop, undefine, or restart, so the 51-name ceiling is naturally non-closed once this facility is enabled.

13. Parallel Classification: Only 8 Unique Names/Definitions Explicitly Opt In; Everything Else Fails Closed to Exclusive

14. “Dangerous” Is Not One Boolean on a Tool Name

This table is a threat-model classification, not a source-level risk score. Harness distributes controls across provider confinement, pre approval, monotonic guards, tool-specific event gates, and execution ownership. Chapters 19, 20, and 31 verify those boundaries.

15. Inputs, Outputs, and UI Intent: The Catalog Promises Model Schemas; the Execution Contract Still Lives in ToolDefinition

The UI does not hard-code every card by tool name either. Tools return provider-neutral generic/terminal/diff/search/read/web render intents. The Host pairs calls and results through the current scoped definition; missing pairing or presenter failure preserves the raw event and falls back to a generic card. TOOL-PRESENTATION-INTENTSTOOL-HOST-PRESENTER

16. Availability Matrix: Registration, Visibility, Scheduling, Approval, and Backend Readiness Are Five Gates

package mounted?
  → required service satisfied and tool registered?
    → current Agent scope can see it?
      → presentation mode exposes native name or Code SDK?
        → pre-policy + approval + guards allow this call?
          → provider/runtime is ready and body succeeds?

A “no” at any layer can appear as no schema, UNKNOWN_TOOL, approval required, provider unavailable, or an ordinary error result. Calling all of them “permission failures” sends diagnosis to the wrong layer.

17. Confirmed Documentation/Composition Drift and Audit Traps

18. Design Assessment and Verification Status