The sorts the loop sets
Tools are the movable type Jikji sets into place — a broad built-in catalog plus anything you install, each one run behind a policy gate and a sandbox, locally or on a remote node.
The execution surface can change without bypassing authorization, redaction, timeout, or audit controls.
Built-in tools, out of the box
A working agent needs more than a chat box. Jikji ships a broad set of tools so an agent can read, search, browse, query, analyze, and act from its first run.
| Workspace | file.read · file.search · file.list · file.replace · file.write · shell |
|---|---|
| Web & browser | web_search · web_reader · fetch · browser.open/read/tabs/save_source · DOM |
| Data | sql (sqlguard-governed) · data_pipeline_import · data_pipeline_export |
| Knowledge | lexicon.query (SPARQL) · ontology.search |
| Orchestration | agent.spawn/steer/cancel · taskgraph.run · trinity.ensemble · trinity.oracle · inquiry.ask · almanac.schedule · service.publish · ui.render |
| Goals & schedule | goal.set/define/evidence/status · almanac.schedule/list/cancel |
| Publish | ui.render · service.publish/list/approve/revoke |
| Research & skills | research.source · research.web_search · skill.load · skill.manage |
| Channels | channel (Telegram) · inbound webhooks |
A function is a tool
You don't recompile to add a capability. Write a Lua or Python function — or a whole Python script — publish it, and it is registered as a first-class tool at runtime, behind the same policy gate and sandbox and exposable over MCP, just like the built-ins. Python runs at the function level for a quick helper or at the script level for heavier work.
-- Lua: the function becomes a tool function reverse(args) return string.reverse(args.text) end
# Python: the function becomes a tool def word_count(args): return {"count": len(args["text"].split())}
Publish to the bookstore and it auto-registers — no rebuild, optionally signature-verified before it runs.
A sandboxed tool runtime
Tools are the movable sorts the loop sets into place — built-in or installed, run locally or on a remote node, always behind a policy gate and a sandbox.
Built-in tools & runners
File read/search/list/replace/write, shell, web search, a headless browser (tabs, DOM extraction, save-source), a clean-content web reader and fetch, ontology and channel tools, and skills. Runners cover sandboxed Python subprocesses, an embedded Lua engine, local commands, and remote nodes.
MCP, both ways
A Model Context Protocol client speaks to stdio servers and registers their tools into the toolbox. A server exposes Jikji's own tools to any MCP host. Tool calls bridge in both directions, with streaming.
Defense-in-depth sandbox
Linux namespaces, Landlock, seccomp, and parent-enforced RLIMITs plus cgroup v2 caps. Network modes none, loopback, or host with an egress allowlist — enforced at the syscall boundary, failing closed if the filter can't install.
Remote tool nodes
Push tool execution onto jikji-tool-node workers across a jikji-relay TLS tunnel, with a durable shared catalog, per-node circuit breakers, and failover — without changing the agent.
Marketplace & signing
Publish Lua or Python tools to the bookstore, install them, and auto-register them at runtime. Installs can require Ed25519 or HMAC signatures, with checksums verified before a tool ever runs.
Prompt-injection guard
Untrusted external content is spotlighted with nonce-wrapped markers and defanged; taint tracking blocks sensitive tools (shell, write, network) when a run has ingested untrusted data. Detected signals include instruction override and jailbreak attempts.