The built-in tools are ready-made tool.Definition constructors for common agent effects. They all share the same prepare, gate, and result boundary, but their authority is different. Choose the smallest tool that expresses the operation and keep the composition root responsible for its bindings.

Choose a built-in tool

Need	Tool	Authority boundary
Ask a person for a decision	AskUser	Uses the loop input seam and no filesystem or network access.
Run a bounded shell command	Bash	Requires an approved command and workspace, with an optional supervised process.
Change one exact text region	EditFile	Requires a complete prior observation and an exact contained write target.
Make one HTTP request	Fetch	Uses an injected client and one declared host and port.
Find workspace paths	Glob	Walks only an approved, denied-path-filtered tree.
Search file contents	Grep	Uses bounded ripgrep or a standard-library fallback under one read grant.
Read a bounded text view	ReadFile	Records a full-file observation before displaying selected lines.
Load an approved skill	Skill	Uses an agent-scoped loader and a TOCTOU-safe workspace snapshot.
Track loop-local work	Task tools	Keeps one in-memory dependency graph per definition bundle.
Search through a declared provider	WebSearch	Emits network requirements for the provider’s declared endpoints.
Replace a complete file	WriteFile	Uses a same-directory temporary file, sync, and atomic rename.

Prepare before effect

Every built-in follows the common definition and preparation contract. Preparation validates arguments, resolves paths or endpoints, and returns the requirements and artifact that a Harness gate can inspect. The direct run path must use that approved artifact rather than reconstructing untrusted input.

defs := tool.TaskDefinitions()
task := defs[0]
prepared, err := task.PrepareCall(ctx, []byte(`{"subject":"review"}`))
if err != nil {
	return err
}
// A Harness gate evaluates prepared.Requirements before Invoke uses its artifact.
_ = prepared

For the shared permission and grant boundary, read Safety, Permissions, and Gates. For long-running shell work, continue to Process Supervision.

Source

The standard definition constructors are rooted in definitions.go, with concrete implementations in askuser/askuser.go and the other linked tool pages.

Proof

The definition lifecycle is exercised by definitions_test.go and the Bash implementation proof by bash/bash_test.go.