Hematite Capabilities

This document summarizes the technical strengths of Hematite-CLI as a local GPU-aware coding harness for LM Studio, Ollama, and other local OpenAI-compatible runtimes, with the strongest optimization focus on single-GPU consumer hardware such as the RTX 4070 class.

Hematite is not trying to be a generic cloud-agent platform in a terminal skin. Its product thesis is narrower and stronger:

be the best local coding harness for local OpenAI-compatible runtimes
be honest about consumer GPU limits
make runtime truth, recovery, and repo grounding visible to the operator
turn open local models into a serious project-work tool instead of a chat wrapper

That is the lens for the capabilities below.

What Makes It Distinct

Local runtime truth: live model/context sync, prompt-budget pressure, compaction pressure, typed provider states, and recovery recipes are surfaced directly in the operator UI
Repo-grounded behavior: Hematite prefers architecture tracing, repo mapping, tool discipline, and bounded inspection over freeform model improvisation
Single-GPU engineering: context shaping, compaction, fallback prompting, and recovery are built around what a 4070-class machine can actually sustain
Windows-first local quality: PowerShell behavior, path handling, packaging, and terminal ergonomics are treated as first-class product concerns
Agent-harness boundary: the local runtime is the model server; Hematite owns the workflow, tooling, TUI, safety, retrieval, and orchestration layer
Baked-in workflow core with additive skills: teleportation, sovereign scaffold, .hematite/PLAN.md, .hematite/TASK.md, and resumable execution stay in the harness; root SKILLS.md / SKILL.md guidance plus directory-based Agent Skills under .agents/skills/ or .hematite/skills/ are additive layers, not replacements for core workflow control
Full OS stack coverage: 128+ read-only diagnostic topics covering SysAdmin and Network Admin domains.
Analytical SQL & Data Science: A first-class data engine for local files. Streaming SQL ingestion, transactional batching, and automated statistical discovery (Histograms/Regressions) via a secure Python sandbox.
Lead Computational Researcher: A core identity directive that enforces verifiable computation. Hematite refuses to guess results for math/physics/CS problems, instead using high-precision symbolic solvers (symbolic), unit-aware physics (units), and empirical Big-O auditing (complexity) to provide proven answers. It prioritizes Pure Python resilience, implementing math logic manually when heavy libraries are missing, but automatically scaling to use numpy, scipy, and pandas if they are available in the configured Python environment.
MCP server mode: hematite --mcp-server exposes all 128+ inspect_host topics to any MCP-capable agent — Claude and Codex CLI are the primary targets — over stdio JSON-RPC 2.0. No TUI, no local model needed on the client side.
Privacy gateway: Two-tier identity stripping before any output leaves the machine. --edge-redact (Tier 1) is a fast compiled regex pass — no local model required — that replaces usernames, MACs, serials, hostnames, and credential-shaped values with safe tokens. --semantic-redact (Tier 2) routes raw inspect_host output through a dedicated local summarizer model before forwarding; Tier 1 runs after as a safety net. Fail-safe: if the summarizer is unreachable, the call errors — raw data is never sent. Jailbreak-resistant (hardened prompt, unknown MCP args stripped, refusal detection). Metadata-only audit trail at ~/.hematite/redact_audit.jsonl. Per-topic policy file for hard-blocking sensitive topics or overriding redaction level per topic.
Multi-model local stack: --semantic-model <id> targets a specific model in LM Studio for privacy summarization, independent of the main reasoning model. Verified three-model setup on a single RTX 4070 (12 GB): Qwen3.5 9B Q4_K_M (coding, 6.55 GB) + nomic-embed-text-v2 (search, 0.51 GB) + Bonsai 8B Q1_0 (privacy summarizer, 1.16 GB) = 8.22 GB total. The main model and summarizer never interfere — Hematite sends explicit model IDs in every request. --semantic-url points the summarizer at a separate server endpoint for users running a second inference backend. As local models get smaller and smarter, the summarizer slot gets better without changing anything else.
Diagnostic Command Redirection: Automated redirection of raw diagnostic shell commands to structured inspect_host topics to minimize operator prompts.
Automated Identity Retrieval: Proactive SID and group membership lookup for local and active directory users to prevent diagnostic loops.
Voice Engine error handling: Native ONNX synthesis error suppression in hematite-kokoros to maintain stream stability.
Hardware telemetry integration: Uses live disk queue depth, VRAM usage, and I/O metrics to inform architectural grounding.
Zero-Latency IT Diagnostic Lane: Direct TUI slash commands (/triage, /health, /inspect) that bypass the LLM for instantaneous, deterministic workstation diagnostics. 100% reliable even under extreme VRAM pressure or offline conditions.
Deterministic Workstation Routing: Hardened intent classification that surgically routes workstation requests to precise filesystem tools, pruning risky shell and workflow paths.
Authoritative Path Resolution: Core-level support for sovereign path tokens and bare directory aliases (downloads, desktop, docs, pictures, videos, music, home, temp, ~, @DESKTOP, @DOCUMENTS, @MUSIC, @VIDEOS, @PICTURES, etc.) using OS-authoritative shell folder hooks.
Runtime-state anchoring: Hematite resolves its runtime-state directory centrally so sovereign OS folders such as Desktop and Downloads fall back to ~/.hematite/ instead of accumulating local workspace artifacts.
Heuristic Command Sanitizer: Mandatory execution gate that blocks natural language injection or conversational "overthinking" from being passed to shell commands.
Workspace inspection visibility: Access to hidden directories (.hematite, .git) for locating benchmarking targets and runtime artifacts.

1. Model-Native Reasoning Flow

Hematite is built to preserve a separation between internal reasoning and user-facing output.

Reasoning channel support: the inference layer parses model-native reasoning markers and keeps them out of the main chat transcript
Clean dialogue surface: internal planning stays in the side panel instead of leaking into the main response
Tool-first workflow: reasoning, tool calls, and final output follow a consistent turn structure

2. Precision Editing

Hematite is optimized for controlled code edits on large files.

Search-and-replace editing: multi_search_replace requires exact local anchors instead of fragile absolute offsets
Failure over corruption: malformed or weak matches are rejected rather than applied speculatively
Multi-hunk support: disconnected edits can be applied safely in one turn without index drift

3. Hardware Awareness

Hematite continuously adapts to the machine it is running on.

VRAM monitoring: live GPU usage is tracked so the harness can react before the session destabilizes
Adaptive brief mode: output and worker behavior can tighten automatically under memory pressure
Single-GPU focus: the runtime is shaped around one practical local GPU, not multi-GPU or cloud assumptions
4070-class target: the design center is the common 12 GB consumer setup where open models need careful context shaping, compaction, and tool discipline
Live LM Studio context detection: startup now prefers the loaded model's loaded_context_length from LM Studio so Hematite budgets against the active runtime context instead of an outdated fallback field
Live runtime-profile refresh: before each turn, Hematite can resync the loaded LM Studio model ID and active context budget so model swaps or context changes do not require a full Hematite restart
Quiet background runtime sync: while idle, Hematite can keep the status bar aligned with LM Studio's live model and CTX state and only emits a visible operator message when the runtime profile actually changes
Compact runtime badge: the bottom status bar now exposes a low-noise provider state badge so the operator can see live, stale, warning, or context-ceiling conditions at a glance across LM Studio or Ollama
Provider-state machine: retries and runtime failures emit compact provider states such as recovering, degraded, or context-ceiling so the operator can see what Hematite is doing without parsing long failure prose
Failure-state persistence: a runtime refresh can update model and CTX without immediately clearing a real LM:CEIL or LM:WARN condition; those states persist until successful output proves recovery
Compaction-pressure meter: the bottom bar now shows a compact percentage badge tied to Hematite's real adaptive compaction threshold so the operator can see when conversation history is approaching summary-chaining pressure
Prompt-budget meter: the operator surface now exposes a separate BUD:NN% badge for total turn payload pressure against the live LM Studio context window, which catches small-context prompt blowups that are not visible from history compaction pressure alone
Tighter operator footer: the input/status surface now prioritizes real controls and real signals, including a live session error count, instead of spending width on dead counters or unreliable terminal hints
Runtime-owned provider state: recovery, degraded, live, and context-ceiling transitions are now emitted by the runtime layer itself instead of being guessed by the TUI from rendered tokens or error strings
Typed operator checkpoints: SPECULAR now receives explicit runtime checkpoint states for provider recovery, prompt-budget reduction, history compaction, blocked policy paths, blocked recent-file-evidence edits, blocked exact-line-window edits, and other recovery/blocker transitions
Typed recovery recipes: retries, runtime refreshes, prompt-budget reduction, history compaction, and proof-before-edit recovery are now described by named recovery scenarios and compact step recipes instead of only ad hoc branch logic
Runtime bundle boundary: startup assembly for engine, channels, watcher, voice, swarm, and runtime profile sync now lives behind a typed runtime bundle instead of being hand-wired directly in main.rs
Real-time silicon tracking: overclocker delivers high-fidelity telemetry informed by the Zero-Overhead Silicon Historian—a 10-point RAM-only buffer tracking session trends (Temp/Clocks/Power anomalies) without disk baggage.
NVIDIA Deep-Sense: precision GPU telemetry including real-time power draw and power-cap context (W), graphics/memory clocks (MHz), fan curves, and explicit GPU-voltage availability reporting, plus the Precision Throttle Truth engine to decode NVIDIA bitmasks into root-cause casualties (Power vs Thermal).
Typed permission enforcement: tool authorization now converges through one runtime decision layer for allow, ask, or deny outcomes instead of splitting shell rules, MCP approval defaults, safe-path bypasses, and shell-risk classification across ad hoc branches
Workspace trust state: the current repo root is resolved through a typed trust policy, so destructive or external actions can behave differently in trusted, unknown, or explicitly denied workspaces
Registry-owned tool metadata: repo reads, repo writes, git tools, verification tools, architecture tools, workflow helpers, research tools, vision tools, and MCP tools now carry explicit runtime metadata so mutability, trust sensitivity, plan fit, and parallel-safe execution are less dependent on ad hoc name lists
Dedicated tool registry boundary: built-in tool definitions and builtin-tool dispatch now live behind src/agent/tool_registry.rs so the conversation loop owns less catalog/dispatch glue and more of the actual turn policy
Typed MCP lifecycle state: MCP server availability is now surfaced as unconfigured, healthy, degraded, or failed runtime state so external-server issues do not hide inside tool refresh side effects
Intent-class routing: stable product truth, runtime diagnosis, repository architecture, toolchain guidance, and capability questions now flow through one shared intent classifier instead of a long stack of isolated phrase gates
Typed session ledger: compact carry-over now remembers the latest checkpoint, blocker, recovery step, verification result, and compaction metadata instead of preserving only task text and working-set hints
Tiny-context fallback profile: when LM Studio serves a very small active context window, Hematite can switch to a slimmer system prompt so simple prompts still fit instead of immediately exhausting the budget
Manual runtime refresh: /runtime-refresh lets the operator force an LM Studio profile resync on demand, and context-window failures trigger the same refresh path automatically

4. SysAdmin and Network Admin

Hematite ships a complete workstation inspection layer that covers the full OS stack in plain English. All topics are read-only — the harness answers from real observed state, not model guesses.

SysAdmin topics (84+):

Resource load (resource_load) — live CPU and RAM usage with top consumers
Processes (processes) — per-process CPU time, memory, [I/O R:N/W:N] operation counts, and PID analytics
Services (services) — running Windows services, startup types, and state
Ports (ports) — listening TCP/UDP ports with owning process
Storage (storage) — all-drives capacity with ASCII bar charts, developer cache sizing, and real-time Disk Intensity (Average Disk Queue Length)
Hardware (hardware) — full hardware DNA: CPU model/cores/clock, RAM total/speed/sticks/channel, GPU name/driver/resolution, motherboard/BIOS manufacturer/version, and Virtualization Health (Hypervisor status and SLAT/VT-x capability)
Sessions (sessions) — audits active and disconnected user logon sessions with terminal service info
Health report (health_report) — tiered plain-English verdict (ALL GOOD / WORTH A LOOK / ACTION REQUIRED) across disk, RAM, tools, and recent error events
Windows Update (updates) — last install date, pending update count, Windows Update service state
Security (security) — Defender real-time protection, last scan age, signature freshness, firewall profile states, Windows activation, UAC state
Pending reboot (pending_reboot) — detects queued restarts from Windows Update, CBS, and file rename operations
Disk health (disk_health) — physical drive health via Get-PhysicalDisk and SMART failure prediction
Battery (battery) — charge level, status, estimated runtime, wear level; reports gracefully on desktops
Crash history (recent_crashes) — BSOD/unexpected shutdown events and application crash/hang events from the Windows event log
Application crashes (app_crashes) — detailed application crash/hang triage: faulting app name, version, faulting module, exception code, crash frequency, WER archive count; optional process arg to filter by app name
Scheduled tasks (scheduled_tasks) — all non-disabled scheduled tasks with name, path, last run time, and executable
Dev conflicts (dev_conflicts) — cross-tool environment conflict detection: Node version managers, Python 2/3 ambiguity, conda shadowing, Rust toolchain path conflicts, Git identity/signing, duplicate PATH entries
Path and toolchains (path) — full PATH inspection with version detection for installed developer tools
Log check (log_check) — recent system error events from the Windows event log
Event query (event_query) — targeted Windows Event Log filtering by Event ID, provider/source, log name, severity level, and time window; answers plain-English Event Viewer questions without forcing the user into PowerShell
Startup items (startup_items) — boot-time programs and their startup types
OS config (os_config) — firewall profiles, power plan, and uptime
User accounts (user_accounts) — local user accounts (name, enabled, last logon, password required), Administrators group members, active logon sessions, and elevated process state; redirected from Get-LocalUser and net user
Active Directory User (ad_user) — precise user/group lookup via Get-ADUser or net user/domain; shows SID, enabled status, password expiry, and group memberships; includes Self-Aware discovery for 'Who am I?' queries
Audit policy (audit_policy) — Windows audit policy via auditpol; shows which event categories log Success/Failure; flags if no categories are enabled
Hyper-V (hyperv) — Hyper-V role and VMMS service state, VM inventory with name, state, CPU%, RAM assignment, and uptime, VM network switch inventory (External/Internal/Private) with bound NIC, VM checkpoint listing with creation timestamps (flags excessive checkpoints), and RAM overcommit detection vs host physical memory
Shares (shares) — SMB shares exposed by this machine (flags custom non-admin shares), SMB security settings (SMB1/SMB2 state, signing, encryption), and mapped network drives
BitLocker (bitlocker) — drive encryption state per volume (PROTECTED/UNPROTECTED), protection method, and SMB1 warning; LUKS on Linux
RDP (rdp) — Remote Desktop enabled state (registry fDenyTSConnections), port number, NLA/UserAuthentication, firewall group status, and active sessions
Shadow copies (shadow_copies) — VSS shadow copy count and storage allocation, System Restore points, and LVM snapshots on Linux
Page file (pagefile) — virtual memory allocated/current/peak MB, system-managed vs fixed config, RAM context, and high-usage warning
Windows features (windows_features) — enabled optional features with count, notable feature flags (Hyper-V, IIS, Telnet, TFTP, NFS), and quick-check for six key features
Printers (printers) — installed printers with default flag, active print jobs; CUPS on Linux
WinRM (winrm) — Windows Remote Management service state, listener config, TrustedHosts, and Test-WSMan connectivity check
Device health (device_health) — precision detection of malfunctioning hardware via PnP ConfigManager error codes (the "Yellow Bang" devices in Device Manager)
Drivers (drivers) — comprehensive audit of active system drivers with name, type, path, and operational state
Peripherals (peripherals) — deep-dive into USB controllers, HID devices (keyboard/mouse class), and connected monitors
Audio (audio) — Windows Audio service health, playback/recording endpoint inventory, microphone/speaker path checks, Bluetooth-audio crossover, and plain-English diagnosis for “no sound / bad mic / crackling”
Bluetooth (bluetooth) — Bluetooth radio state, service health, paired-device inventory, headset/audio endpoint crossover, and plain-English diagnosis for “won’t pair / keeps disconnecting / wrong headset role”
Camera (camera) — PnP camera/webcam device inventory, Windows camera privacy registry state, Windows Hello biometric camera detection, and plain-English diagnosis for “camera not working / blocked by privacy settings”
Sign-In / Windows Hello (sign_in) — Windows Hello and biometric service state, WBioSrvc health, recent logon failure events (EventID 4625), enrolled credential providers, and plain-English diagnosis for “PIN/fingerprint not working / can’t sign in”
Installer Health (installer_health) — Windows Installer (msiserver), AppX/Store install services, winget/Desktop App Installer presence, Microsoft Store package health, pending reboot or in-progress installer blockers, and recent MSI/AppX failure evidence
OneDrive (onedrive) — client install/running state, configured accounts, sync-root existence, OneDrive policy blockers, and Known Folder Backup/Desktop/Documents/Pictures redirection state
Browser Health (browser_health) — browser inventory and versions for Edge/Chrome/Firefox, default browser/protocol associations, runtime process and working-set pressure, WebView2 runtime health, browser proxy/policy overrides, profile/cache pressure, and recent browser crash evidence
Identity Auth (identity_auth) — Microsoft 365 identity-broker health across TokenBroker / WAM / AAD Broker Plugin, device registration (dsregcmd), token and identity cache hints, cross-app account mismatch detection for Office/Teams/OneDrive, WebView2 auth dependency state, and recent auth-related warning/error events
Outlook (outlook) — classic Outlook and new Outlook for Windows install inventory, running process state and RAM usage, mail profile count, OST and PST file discovery with sizes, add-in inventory with load behavior and resiliency-disabled items, authentication and token broker cache state, and recent Outlook crash evidence from the Application event log
Teams (teams) — classic Teams and new Teams (MSTeams MSIX) install inventory, running process state and RAM usage, cache directory sizing for both classic and new Teams, WebView2 runtime dependency check, account and sign-in state, audio/video device binding, and recent Teams crash evidence from the Application event log
Windows Backup (windows_backup) — File History service state and last backup date/target drive, Windows Backup (wbadmin) last successful backup versions and scheduled tasks, System Restore enabled state and most recent restore point, OneDrive Known Folder Move per-account protection state, and recent backup failure events from the Application event log
Search Index (search_index) — Windows Search (WSearch) service state, indexer registry configuration, indexed locations (shell namespaces + registry fallback), recent indexer errors, and plain-English diagnosis for “search not finding files / indexer stopped”
Display Config (display_config) — active monitor resolution, refresh rate, bits-per-pixel, video adapter driver version, connected monitor names/PnP IDs, and DPI/scaling percentage via Win32 GDI
NTP / Time Sync (ntp) — Windows Time service (W32Time) health, NTP source and last sync via w32tm, configured NTP peers/registry, and plain-English diagnosis for clock drift or sync failure
CPU Power (cpu_power) — active power plan, processor min/max state and turbo boost mode, current CPU clock and load via WMI Win32_Processor, thermal zone temperatures, and diagnosis for “CPU stuck slow / boost disabled / power plan capping frequency”
Credentials (credentials) — Windows Credential Manager vault summary, credential target inventory via cmdkey, type counts, and plain-English hygiene warnings without ever exposing secret values
TPM / Secure Boot (tpm) — TPM presence/readiness/spec version, Secure Boot state, firmware mode (UEFI vs legacy BIOS), and plain-English diagnosis for Windows 11 or BitLocker security posture
Group Policy (gpo) — applied Group Policy Objects (computer scope), filtering status; requires Administrator elevation on Windows
Certificates (certificates) — local personal certificates with subject, thumbprint, expiry date; flags certs expiring within 30 days
Integrity (integrity) — Windows component store health via SFC/DISM registry and log visibility; flags Corrupt or AutoRepairNeeded state
Domain Context (domain) — Active Directory and domain join status: Join Status (DOMAIN/WORKGROUP), Domain name, and NetBIOS name
Permissions (permissions) — Precision NTFS/ACL security audits; identifies non-admin write access and inheritance state
Login History (login_history) — Triage of recent successful and failed logon events from the security log (Event ID 4624)
Registry Audit (registry_audit) — Proactive security audit for persistence hijacks: IFEO debuggers, Winlogon Shell overrides, BootExecute, and Sticky Keys exploits
Thermal Health (thermal) — Precision telemetry for CPU temperature, thermal margins, and active throttling indicators
Windows Activation (activation) — Audits Windows license status, genuine status, and Product ID/Key metadata
Patch History (patch_history) — Windows HotFix and KB update audit (last 48h focus)
Repo Doctor (repo_doctor) — Workspaces health audit: git status, uncommitted changes, and build-file presence
Disk Benchmark (disk_benchmark) — Sequential read/write throughput and latency measurements on the workspace drive
Overclocker Telemetry (overclocker) — Precision real-time silicon performance: NVIDIA graphics/memory clocks, fan speeds, board power draw and power-cap context (W), explicit GPU-voltage availability reporting, firmware-reported CPU voltage when WMI exposes it, root-cause throttle decoding (Power vs Thermal), and Session History (in-memory trends/anomalies) identifying hardware drift since startup.
Authoritative Directory Audit (directory, desktop, downloads, music, videos, pictures) — High-precision directory listing using OS-level tokens; instantly routes to surgical tools via the deterministic intent engine.
Share Access (share_access) — Connectivity and readability test for network shares and UNC paths.
Storage Spaces / Windows RAID (storage_spaces) — Windows Storage Spaces pool inventory: pool name, health, operational status, resiliency type (Simple/Mirror/Parity), virtual disk health, physical disk member count and media type; Linux fallback reads /proc/mdstat and lvs for software RAID and LVM; reports gracefully when no pools exist
Defender Quarantine / Threat History (defender_quarantine) — Windows Defender threat detection history: threat name, severity, action taken (Quarantine/Remove/Allow), detection timestamp, affected file path, and current remediation status; also covers recent real-time protection and scan activity from Get-MpComputerStatus; Linux fallback checks ClamAV quarantine log
MDM / Intune Enrollment (mdm_enrollment) — Intune/MDM enrollment state: dsregcmd AAD and MDM join flags, registry enrollment accounts with UPN/type/server URL, Intune Management Extension service health, recent MDM event log errors, and plain-English findings for enrolled/unenrolled/stalled states
Domain Health / DC Connectivity (domain_health) — active domain controller reachability: nltest /dsgetdc discovery, live LDAP/LDAPS/Kerberos/GC port tests to the DC, dsregcmd AAD and domain join state, GPO last machine refresh time; answers "can my machine reach its DC?" and "are LDAP ports open?" — distinct from domain (basic join status)
Service Dependencies (service_dependencies) — service dependency graph: which services require which other services to run, and which services will break if a given one is stopped — essential for restart cascade planning; Linux fallback uses systemctl list-dependencies
WMI Health (wmi_health) — WMI repository integrity: live Win32_OperatingSystem query, winmgmt /verifyrepository, winmgmt service state, repository size, and recovery steps; WMI corruption is a classic hidden root cause of cascading failures on Windows
Local Security Policy (local_security_policy) — local account/password/lockout policy via net accounts, LAN Manager / NTLM authentication level (LmCompatibilityLevel — flags if below 3), and UAC enabled state and admin prompt behavior
USB Device History (usb_history) — USB storage device connection history from the USBSTOR registry key: lists all USB storage devices ever connected to this machine by friendly name; useful for security/forensics audits; requires elevation for full history; Linux fallback queries journalctl
Print Spooler / PrintNightmare (print_spooler) — Print Spooler service state, PrintNightmare (CVE-2021-34527) hardening check (RpcAuthnLevelPrivacyEnabled and Point and Print driver installation policy), and pending print queue; flags unmitigated configurations; Linux fallback checks CUPS via lpstat

Network Admin topics (29+):

Latency (latency) — ping RTT (min/avg/max) and packet loss to the default gateway, Cloudflare DNS (1.1.1.1), and Google DNS (8.8.8.8); findings for unreachable targets, high packet loss, and elevated latency
Network Adapter (network_adapter) — NIC inventory (link speed, MAC, driver version), offload settings (LSO/RSS/TCP checksum offload/jumbo frames) per adapter, error and discard counters, and wake-on-LAN / power management state
DHCP Lease (dhcp) — DHCP lease details per adapter: server IP, lease obtained, lease expires, subnet mask, DNS servers; findings for expired or imminently-expiring leases
MTU (mtu) — per-adapter IPv4/IPv6 MTU via Get-NetIPInterface; path MTU discovery test to 8.8.8.8 using DF-bit pings at 1472/1400/1280/576 bytes; findings for restricted MTU, VPN fragmentation, or blocked ICMP
IPv6 (ipv6) — per-adapter IPv6 addresses (global/link-local/ULA) with prefix origin (SLAAC/DHCPv6/static), IPv6 default gateway, DHCPv6 lease assignments, privacy extension state (RFC 4941), and tunnel adapter inventory (Teredo/6to4/ISATAP); findings for no global address or missing gateway
TCP Parameters (tcp_params) — TCP autotuning level, congestion provider (CUBIC/NewReno), initial congestion window, scaling heuristics, dynamic port range, chimney offload state, and ECN capability; findings for disabled autotuning or non-standard congestion provider
WLAN Profiles (wlan_profiles) — saved wireless profiles with authentication type (WPA2/WPA3/WEP/Open), cipher, connection mode, and auto-connect state; currently connected SSID, BSSID, signal, and radio type; findings for profiles using weak/open authentication
IPSec (ipsec) — enabled IPSec connection security rules with mode and action; active main-mode and quick-mode SAs with local/remote address pairs; IKE Policy Agent service state; findings for active tunnels
Connectivity (connectivity) — internet reachability test (DNS + ICMP + HTTPS) with latency and failure diagnosis
Wi-Fi (wifi) — connected SSID, signal strength, channel, frequency band, and adapter details
Active connections (connections) — all established and listening TCP/UDP connections with owning process
VPN (vpn) — VPN adapter detection, state, and assigned IP address
Proxy (proxy) — system-level proxy settings (WinHTTP / per-user / environment variables)
Firewall rules (firewall_rules) — active Windows Firewall rules allowing inbound traffic
Traceroute (traceroute) — hop-by-hop path to a target with round-trip times and latency spikes
DNS cache (dns_cache) — current local DNS resolver cache entries
ARP table (arp) — local ARP cache mapping IP addresses to MAC addresses
Routing table (route_table) — full IP routing table with interface, next-hop, and metric
LAN discovery (lan_discovery) — neighborhood, NetBIOS/SMB visibility, mDNS/SSDP/UPnP listener surface, gateway hints, and plain-English diagnosis for “can’t see that NAS/printer/PC”
Network stats (network_stats) — per-adapter RX/TX throughput (MB), error counts, drop counts, link speed, and duplex; flags adapters with errors or drops
UDP ports (udp_ports) — active UDP listeners with owning process name and annotations for well-known ports (DNS, NTP, NetBIOS, mDNS, SSDP, IKE, SNMP)
DNS Lookup (dns_lookup) — specific high-precision DNS query for A/AAAA, MX, TXT, SRV, and other record types; now handles plain-English domain-to-IP questions and defaults to A when the user asks for a hostname/IP answer without naming a record type
IP Configuration (ip_config) — full adapter detail (ipconfig /all equivalent); surfaces DHCP server, lease times, and multi-IP interfaces
NetBIOS (netbios) — NetBIOS over TCP/IP state per adapter (enabled/disabled/DHCP), WINS server configuration, nbtstat registered names, and active NetBIOS sessions; flags enabled NetBIOS as a potential attack surface
NIC Teaming (nic_teaming) — LBFO team inventory (mode, load-balancing algorithm, status, link speed), team member detail and operational state; flags degraded teams or inactive members
SNMP (snmp) — Windows SNMP agent service state, community string presence audit (values redacted), permitted manager list, SNMP Trap service; flags running agents and the well-known 'public' community string as a risk
Port Test (port_test) — TCP port reachability test to any remote host and port via Test-NetConnection; returns OPEN/CLOSED/FILTERED with ICMP ping result, source address, and interface used. Use args host and port.
Network Profile (network_profile) — Windows network location profile per interface (Public/Private/DomainAuthenticated), IPv4/IPv6 connectivity state; flags Public-category interfaces and domain-authenticated connections
DNS Servers (dns_servers) — DNS resolver addresses configured per network adapter (not cache — the actual nameservers), annotated with well-known providers (Google, Cloudflare, Quad9, OpenDNS), DoH configuration, and DNS search suffix list

Intent-based diagnostic orchestration:

When a user asks about multiple inspection topics or uses common trouble keywords like "slow", "lag", or "I/O pressure", Hematite automatically detects all matching topics before the model turn and runs all inspect_host calls automatically. The combined results are injected as a loop_intervention so the model synthesizes from real data instead of orchestrating tool calls one by one. This eliminates redundant round-trips and prevents the model from collapsing multi-topic requests into a single generic topic.

Shell auto-redirect:

When the model calls shell with a command that matches a structured host inspection topic (e.g. arp -a, tracert, Get-DnsClientCache, Get-NetRoute, Get-Process), the harness silently redirects it to the correct inspect_host topic.

Redirection discipline:

Hematite implements a definitive loop-breaker for auto-redirected shell calls. If the model attempts to call shell repeatedly for the same diagnostic intent, the harness provides a short "Action Handled" message instead of flooding the context with redundant telemetry. The Synchronized Enforcer ensures that shell diagnostics are only blocked if a native topic is actually available to take over.

Developer tooling topics (13+):

Environment variables (env) — total count, developer/tool vars (CARGO_HOME, JAVA_HOME, GOPATH, VIRTUAL_ENV, DOCKER_HOST, etc.), secret-shaped vars shown as [SET, N chars] only — values never exposed; PATH entry count with pointer to the path topic
Environment Doctor (env_doctor) — full developer environment health check: PATH sanity, package manager conflicts, toolchain version mismatches, conda/pyenv/nvm shadowing, and missing expected tools
Toolchains (toolchains) — installed developer tool inventory with versions: Rust, Node, Python, Go, Java, Docker, Git, and other common toolchain binaries detected on PATH
Hosts file (hosts_file) — reads /etc/hosts (Windows: drivers\etc\hosts); shows active entries, flags custom non-loopback entries, includes full file content
Docker (docker) — Docker Engine version, daemon health, running containers with status and ports, local images, Docker Compose projects, active context; reports gracefully if not installed or daemon is down
WSL (wsl) — Windows Subsystem for Linux distros with state (Running/Stopped), WSL version metadata; Windows-only feature, reports platform note on Linux/macOS
SSH (ssh) — SSH client version, sshd service state, ~/.ssh inventory (known_hosts entry count, authorized_keys count, private key files present), ~/.ssh/config host entries with hostname/user/port/identity details
Installed software (installed_software) — winget list on Windows (registry scan fallback); dpkg/rpm/pacman on Linux; brew + mas on macOS; paginated with max_entries
Git config (git_config) — global git config grouped by Identity, Core, Commit/Signing, Push/Pull, Credential, Branch sections; local repo config; git aliases; points at missing config if not set up
Databases (databases) — detects running local database engines: PostgreSQL, MySQL/MariaDB, MongoDB, Redis, SQLite, SQL Server, CouchDB, Cassandra, Elasticsearch — via CLI version check, TCP port probe, and OS service state; no credentials required
Data Audit (data_audit) — structured CSV/TSV/JSON file analysis: column inventory, data types, row counts, null rates, statistical distribution, and anomaly hints; accepts optional path arg

Additional deep-audit developer topics:

docker_filesystems audits bind mounts, named volumes, per-container mount summaries, and Docker Desktop disk-image growth with finding -> impact -> fix output
wsl_filesystems audits WSL distro rootfs usage, host-side ext4.vhdx growth, and /mnt/c bridge health without starting stopped distros

Safe remediation:

resolve_host_issue provides a bounded, user-gated path for three fix actions: install_package (winget), restart_service, and clear_temp. Read-only inspection is always available without approval; write actions go through the safe remediation path.

5. Workspace-Native Tooling

Hematite is more than a chat shell around a local model.

File and shell tools: direct project reading, editing, search, and shell execution
PageRank-powered Repo Maps: Native context injection leverages tree-sitter for AST indexing and petgraph PageRank to surface the most structurally important files first — the model wakes up already knowing the architecture without burning tool calls
Git-aware workflows: worktrees, commit helpers, and rollback via hidden ghost snapshots
Configurable verification: verify_build can now use per-project build, test, lint, and fix profiles from .hematite/settings.json instead of relying only on stack autodetection
Project retrieval: SQLite FTS-backed memory helps recover relevant local context each turn
Built-in web research: research_web and fetch_docs let the harness search for technical information and pull external docs into a readable form when local context is insufficient
Grounded architecture tracing: trace_runtime_flow gives the model a verified read-only path for exact runtime/control-flow questions instead of encouraging confident guessing
Grounded architecture overviews: broad read-only architecture questions now combine the AST injection with one authoritative trace_runtime_flow topic instead of drifting into long repo rewrites
Grounded toolchain guidance: describe_toolchain gives the model a verified read-only map of Hematite's actual built-in tools, when to use them, and what investigation order makes sense
Vision support: screenshot and diagram analysis can flow through vision_analyze when a task benefits from visual inspection
LSP code intelligence (lsp_definitions, lsp_references, lsp_hover, lsp_search_symbol, lsp_rename_symbol, lsp_get_diagnostics): go-to-definition, find-all-references, hover documentation, workspace symbol search, safe rename, and live diagnostics — wired through the active language server so code navigation and understanding are grounded in the actual AST rather than pattern matching
Active context pinning (auto_pin_context, list_pinned): during complex refactors the model can lock 1–3 core files into prioritized memory so architecture files stay visible across turns without burning context on re-retrieval each turn

6. Developer Utility Tools

Hematite ships a suite of zero-dependency in-agent developer tools that run entirely in Rust — no external binaries, no internet, no Python sandbox required.

secret_scanner — scans the workspace for accidentally committed secrets using 14 compiled regex patterns (AWS keys, GitHub tokens, Stripe keys, Slack webhooks, private key blocks, database URLs, bearer tokens, password literals, Twilio, SendGrid, Heroku, and more). Skips binaries, lock files, and obvious placeholders. Groups findings by file with line numbers, secret type, and a redacted snippet. Includes actionable remediation steps (rotate, .gitignore, git filter-repo).
changelog_gen — generates Markdown changelogs from git commit history grouped by conventional commit type (feat/fix/perf/refactor/docs/test/chore/ci/build/style). Supports version range scoping via from/to tags, custom title, up to 500 commits. Scopes in bold, short hash appended.
code_metrics — reports lines of code, comment density, blank lines, TODO/FIXME counts, language breakdown by file extension, test file ratio, and top 10 largest files. Skips binaries, build artifacts, and vendor directories.
dependency_audit — audits Cargo.toml, package.json, requirements.txt/pyproject.toml, and go.mod for pinning issues, wildcard versions, deprecated packages, missing lock files, and outdated major versions. No network required.
port_check — tests TCP port reachability with configurable timeout. Annotates 40+ well-known ports. Returns OPEN or CLOSED/FILTERED with actionable startup hints.
env_diff — compares two .env files or a .env file against the live process environment. Reports additions, removals, and changed values with secrets automatically redacted. Auto-detects .env/.env.local pairs.
template_gen — generates 23 built-in project templates: Dockerfiles (Node/Python/Rust/Go multi-stage), GitHub Actions CI workflows, .gitignore for 4 ecosystems, .env.example, Makefiles, docker-compose.yml, .pre-commit-config.yaml, .editorconfig, Dependabot config, CODEOWNERS, PR template, and issue templates.
json_tools — queries, transforms, and analyzes JSON without needing jq. 16 actions: pretty, compact, keys, get (dot-path + array index navigation), filter (field comparison with 8 operators), pluck, flatten, count, sort, unique, merge, diff, validate, schema (recursive type inference), stats (numeric min/max/mean/median/stddev), to-csv. Accepts inline JSON or file path.
regex_tools — tests, extracts, replaces, splits, and explains regular expressions without external tools. 6 actions: test (match/no-match with excerpts, single or array input), extract (all matches or named/numbered capture groups), replace (with optional limit), split, explain (plain-English breakdown of each syntax component), named-groups. Flags: case_insensitive, multiline, dot_all.
diff_tools — compares, patches, and analyzes text or file differences. 5 actions: compare (unified diff with configurable context lines), patch (generate a unified .patch), apply (apply a unified patch to a base), word-diff (inline [+added]/[-removed] word-level diff), stat (added/deleted/unchanged lines, similarity %, ASCII bar). Accepts inline text or file paths.
diff3_tools — parses, inspects, and resolves git-style three-way merge conflicts (<<<<<<< / ======= / >>>>>>> markers) without external utilities. 4 actions: conflicts/parse (list all conflict blocks with ours/base/theirs sections and line counts), merge3 (three-way merge two sides against a base text via LCS), sides/extract (extract ours or theirs side from all conflicts), resolve/auto (auto-resolve with strategy: smart/ours/theirs/both/union). Accepts inline text or file path. Also decodes diff3-style ||||||| base sections.
yaml_tools — validates, formats, queries, and transforms YAML documents. 8 actions: validate (type/depth/key summary), format, get (dot-path + array index navigation like spec.containers[0].image), keys (list keys or elements at any path), to-json, from-json, merge (deep-merge), diff (additions/removals/changes). Accepts inline YAML or file path.
csv_tools — reads, inspects, filters, sorts, and converts CSV data. 9 actions: read (formatted table), head, columns, stats (min/max/mean/median/stddev for numeric; unique/top values for text), filter (8 operators), sort (asc/desc), to-json (auto-coerces types), to-markdown, count. RFC 4180-compliant; handles quoted fields and escaped quotes.
encode_tools — encodes and decodes data between formats. 9 actions: base64-encode (standard or URL-safe), base64-decode, url-encode, url-decode, hex-encode, hex-decode, jwt-decode (header + payload + exp/iat display; no signature verification), html-encode, html-decode.
hash_tools — cryptographic hashing of strings or files. 5 actions: sha256 (default), sha512, md5, hmac-sha256 (requires key), all (MD5 + SHA-256 + SHA-512 in one call). Accepts input (inline) or file (path). Zero new deps — RustCrypto ecosystem.
toml_tools — validates, formats, queries, and transforms TOML documents. 6 actions: validate, format, get (dot-path + array index like bin[0].name), keys, to-json, from-json. Works with Cargo.toml, pyproject.toml, config.toml, and any TOML config.
text_tools — text transformation and analysis. 16 actions: case conversion (to-snake/camel/pascal/kebab/screaming/title/lower/upper), slugify, count (word/line/char/byte/sentence stats), truncate, pad (left/right/center), wrap (word-wrap), repeat, reverse, lines (sort/dedupe/filter_empty).
date_tools — date/time parsing, formatting, arithmetic, and conversion. 9 actions: now (UTC/local/ISO/epoch/week), parse (ISO 8601, RFC 2822, natural formats), format (strftime), add (days/weeks/months/years/hours/minutes with month rollover), diff (duration breakdown), timestamp (date→epoch), from-timestamp (epoch→date, auto-detects ms), relative ("3 days ago"), weekday (day name + ISO week). Zero new deps.
number_tools — base conversion, formatting, and math utilities. 8 actions: convert (base 2–36, 0x/0b/0o prefixes, shows all at once if no 'to'), format (thousands/scientific/engineering/SI), roman, from-roman, si (SI prefix), factors (prime factorization + primality), gcd (Euclidean GCD + LCM), clamp. Pure Rust stdlib, zero new deps.
uuid_gen — UUID generation and validation. 4 actions: generate (UUID v4 with metadata), validate (decode version/variant), nil (all-zeros UUID), bulk (up to 100 UUIDs via 'n'). Accepts 'upper' for uppercase. Zero new deps — rand already in Cargo.toml.
cron_tools — Cron expression parser and scheduler. 4 actions: explain (field breakdown + natural-language summary), validate (YES/NO with error), next (next N run times), describe (one-line schedule description). Named days/months, step, range, list syntax. Zero new deps — chrono already in Cargo.toml.
ip_tools — IP address calculator and analyzer. 5 actions: info (class/type/binary/hex for IPv4 and IPv6), cidr (full subnet breakdown), contains (IP in CIDR range check), convert (decimal/hex/dotted-decimal conversions), subnet (mask-style calculation). Pure std::net — zero new deps.
subnet_tools — Extended IPv4 subnet and CIDR operations. 7 actions: split (divide a CIDR into N equal sub-networks; N must be power of 2), hosts (enumerate usable host IPs in a CIDR with offset/limit pagination), supernet (smallest CIDR containing all given IPs/CIDRs), aggregate (compress a list of IPs/CIDRs into the minimal covering set), overlap (find all overlapping pairs in a CIDR list), contains (check if all IPs in a list fall within a CIDR), range (convert start/end IP range to CIDR notation). Pure Rust stdlib, zero new deps.
color_tools — Color conversion and manipulation. 7 actions: info (full RGB/HSL/hex breakdown), convert (any format → all), mix (blend with ratio), lighten (HSL lightness +%), darken (HSL lightness -%), contrast (WCAG 2.1 ratio + AA/AAA grade), palette (complementary/triadic/analogous variants). Accepts #RRGGBB, #RGB, rgb(), hsl(), 31 CSS names. Pure math — zero new deps.
semver_tools — SemVer 2.0 implementation. 6 actions: parse (full breakdown), compare (A vs B ordering), bump (major/minor/patch/premajor/preminor/prepatch), validate (YES/NO), satisfies (range checking with ^, ~, >=, <=, >, <, =, *, ||, space-AND), sort (asc/desc with correct pre-release ordering). Zero new deps — pure Rust.
password_gen — Password and passphrase generator. 4 actions: generate (configurable chars, Fisher-Yates shuffle, 8–128 length), passphrase (~500 words, configurable separator/capitalize/number), strength (entropy bits, score bar, checklist), pin (numeric 4–12 digits). Zero new deps — rand already in Cargo.toml.
jwt_tools — JWT decode, verify, sign, inspect. 4 actions: decode (header + claims + human-readable timestamps), verify (HS256/HS384/HS512 HMAC check + expiry → VALID/INVALID verdict), sign (create JWT with any claims + HMAC), inspect (validity/expiry summary without secret). Zero new deps — base64, hmac, sha2 already in Cargo.toml.
xml_tools — XML parse, format, navigate, convert. 6 actions: validate (element count, depth, children summary), format (pretty-print with 2-space indent), get (dot-path navigation like project.build or deps.dep[2]), keys (list children/attributes), to-json (@ attrs, #text, arrays for repeated elements), query (find all elements by tag name anywhere in document). Inline 'xml' or 'file' path. Works with Maven POMs, Android manifests, SOAP, RSS, SVG. Uses quick-xml = "0.36".
archive_tools — Zip archive inspection and text extraction. 4 actions: list (tabular entry listing with size, method, type; supports max/filter), info (file count, total size, compression ratio), inspect (entry metadata — size, CRC-32, last-modified), extract (read text entry as UTF-8 string, 1 MB limit). Works with .zip, .jar, .whl, .vsix, .apk. Uses zip = "6".
ascii_tools — ASCII/Unicode art, box drawing, progress bars, tables, and trees. 5 actions: banner (default — block-letter art from 'text'; 5-row Unicode glyph font; max 30 chars), box ('text' wrapped in Unicode border; 'style': single/double/rounded/heavy/ascii; 'padding'), bar ('value'/'max'/'width'/'label'; styles: block/hash/equals/shade/circle/dot), table ('headers' + 'rows' 2D array; styles: single/double/heavy/rounded), tree ('root' + 'nodes' [{label, children?}] or 'text' outline). Pure Rust stdlib, zero new deps.
base_tools — Base16/32/58/85 encoding, decoding, and identification. 3 actions: encode (default — all four encodings at once, or specific via 'encoding'), decode (back to UTF-8 or hex; requires 'encoding'), identify (charset fingerprinting by alphabet analysis). RFC 4648 base32 (A–Z + 2–7), Bitcoin/IPFS base58 (no 0OIl), Z85/ZeroMQ base85 (85-char printable ASCII), base16 hex. Pure Rust stdlib, zero new deps.
binary_tools — Bit manipulation, bitfield packing/unpacking, and binary analysis. 5 actions: info (default — decimal/hex/octal/binary, popcount, parity, leading/trailing zeros, Gray code, NOT, IEEE 754 float view; 'value' as integer or 0x/0b/0o; optional 'width'), flags (bit-by-bit SET/clear with hex mask; optional 'names' array), pack ('fields' array of {value, bits, name?} → packed integer), unpack ('value' + 'layout' array of {bits, name?} → extracted fields), ops (NOT/AND/OR/XOR/NAND/NOR/XNOR, shifts, rotates, popcount, Gray code, mask/set/clear/toggle; 'value' + optional 'b' + 'shift'). Pure Rust stdlib, zero new deps.
sqlite_tools — SQLite database inspection and querying in read-only mode. 5 actions: tables (table list with row counts, views, index count), schema (CREATE SQL + PRAGMA column info; scoped to one table via 'table' arg), query (SELECT/EXPLAIN/WITH/PRAGMA only — DML blocked), info (file size, page size, encoding, journal mode, SQLite version), export (CSV or JSON dump of a table). Zero new deps — rusqlite already in Cargo.toml.
markdown_tools — Markdown document parsing and analysis. 6 actions: toc (table of contents with anchor links; 'depth' arg), stats (word count, reading time, heading/code/link/image/table/blockquote counts), extract (headings | code blocks with optional lang filter | links | images), links (all hyperlinks + images with text and URL), to-html (render via pulldown-cmark; 'wrap: true' for full HTML doc), strip (remove formatting, return plain text). Inline 'text' or 'file' path. Uses pulldown-cmark = "0.12".
url_tools — URL parsing, building, encoding, and manipulation. 7 actions: parse (break URL into scheme/host/port/path/params/fragment), build ('scheme'+'host' required; 'params' object or 'query' string), params (list/set/remove query params via 'op'; 'key'/'value' for mutations), encode (percent-encode; 'component: true' for strict), decode (percent-decode), normalize (lowercase scheme/host, resolve dots), validate (VALID/INVALID verdict with issue flags). Zero new deps — url and percent-encoding already in Cargo.toml.
line_tools — Line-based text processing: grep/head/tail/sort/cut without external utilities. 11 actions: grep (filter with regex, invert, ignore_case, line numbers), head (first N), tail (last N), sort (alpha/numeric/reverse/dedup), unique (preserve order; frequency count; sort by freq), count (line/word/char/byte), slice (lines from–to, 1-based), number (add line numbers with start/step), join (join with separator), replace (find-replace with regex + limit), cut (extract field by delimiter, 1-based). Zero new deps — regex already in Cargo.toml.
hex_tools — Hex dump, binary analysis, and hex encoding/decoding without external utilities. 6 actions: dump (xxd-style hex dump with offset column, hex bytes, and ASCII sidebar; configurable width and byte limit), strings (extract printable ASCII strings with offsets; configurable min length), bytes (byte frequency histogram, null/high-byte counts, Shannon entropy, top-8 bytes), analyze (magic byte file type detection for 30+ formats — PNG, JPEG, ZIP, PDF, ELF, PE, SQLite, MP3, MP4, Matroska, HTML, JSON, etc. — plus entropy estimate), to-hex (encode bytes/text to hex string; configurable separator and case), from-hex (decode hex string to bytes with UTF-8 interpretation). Zero new deps — pure Rust stdlib.
ini_tools — Parse, query, validate, and convert INI/config files without external utilities. 7 actions: parse (display all sections and key-value pairs), get ('section.key' dot notation or separate 'section'/'key'; case-insensitive), sections (list section names with key counts), keys (list keys in a section), validate (duplicate key/section and empty-section checks), to-json (nested JSON object), to-toml (TOML output). Handles [section] headers, key=value and key: value, ; and # comments (full-line and inline), and global keys. Zero new deps — pure Rust stdlib + serde_json.
duration_tools — Parse, humanize, convert, and add time durations without external utilities. 4 actions: parse (default — full breakdown by years/days/hours/minutes/seconds + compact + human label), humanize (readable text; 'style: compact' for '1h 30m'), convert (to seconds/minutes/hours/days/weeks; 'to' param or all), add ('a'/'b' or 'durations' array). Input formats: '1h 30m 45s', '90 minutes', '5400' (seconds), '1:30:45' (HH:MM:SS), 'PT1H30M45S' (ISO 8601). Zero new deps — pure Rust stdlib.
dotenv_tools — Parse, validate, convert, and merge .env files without external utilities. 7 actions: parse (display key-value pairs; 'show_values: false' to redact), validate (key names, quote balance, duplicate keys), get (retrieve a key; last definition wins), list (key names only), to-json (JSON object), to-shell (export/SET commands; 'shell: bash/powershell/cmd'), merge ('base' + 'overlay'; overlay wins, base order preserved). Handles KEY=value, KEY="double quoted" (escape sequences), KEY='single quoted', # comments, empty values. Zero new deps — pure Rust stdlib + serde_json.
path_tools — Path parsing, joining, normalization, and manipulation without filesystem access. 8 actions: parse (default — parent/filename/stem/extension/absolute flag and component list), join ('base'+'parts' array or 'paths' array), normalize (resolve . and .. logically, no filesystem required), relative (compute relative path from 'from' to 'to'; errors on cross-root), basename (filename portion), stem (filename without extension), extension (current extension; optional 'replace' to swap it), is-absolute (YES/NO verdict). Zero new deps — std::path.
table_tools — Format, render, and convert tabular data without external utilities. 5 actions: format (default — render 'headers' + 'rows' 2D array), from-csv (parse CSV text into a table; 'header: false' for no header row), from-json (array-of-objects uses keys as headers; array-of-arrays renders directly), to-markdown (delegate to format/from-csv/from-json with markdown style), transpose (flip rows and columns). Three styles: 'simple' (space-aligned with dash separator), 'bordered' (ASCII box with | and +), 'markdown' (GitHub-flavored). Zero new deps — pure Rust stdlib + serde_json.
ansi_tools — Strip, generate, measure, and parse ANSI escape sequences without external utilities. 4 actions: strip (default — remove all escape sequences; reports count removed), colorize (wrap text in SGR codes; 'fg'/'bg' for 16-color names; 'style' for bold/dim/italic/underline/blink/reverse/strikethrough; at least one required), length (visible character count excluding escape sequences; shows raw vs visible), parse (enumerate all sequences — type, SGR code names, byte offsets). State-machine handles CSI, OSC, and 2-char ESC sequences. Zero new deps — pure Rust stdlib.
template_tools — Render, list, validate, and preview {{PLACEHOLDER}} templates without external utilities. 4 actions: render (default — substitute {{VAR}} and {{VAR|default}}; 'strict: true' errors on undefined vars), list (enumerate unique variables with defaults and count), validate (check all required vars provided; VALID/INVALID verdict), preview (render with [MISSING:VAR] markers and DEFINED/MISSING status per variable). Zero new deps — pure Rust stdlib + serde_json.
char_tools — Unicode character inspection, codepoint lookup, escape/unescape, and property checks without external utilities. 5 actions: info (default — codepoint U+XXXX, block name, category, decimal/hex/octal/binary, case variants), codepoint (char → U+XXXX or 'codepoint' number/U+XXXX → char), escape (\u{XXXXX}/\uXXXX/\xXX; 'style' param), unescape (decode escape sequences back to chars), check (is_ascii/is_alphabetic/is_numeric/is_alphanumeric/is_uppercase/is_lowercase/is_whitespace/is_control/is_ascii_punctuation; ✓/~/✗ marks). Zero new deps — pure Rust stdlib.
stat_tools — Statistical analysis on number arrays without external utilities. 7 actions: describe (default — count/sum/min/max/range/mean/median/stddev/variance/Q1/Q3/IQR), histogram (ASCII bar chart; 'bins'/'width'), percentile ('p' single or array), mode (most frequent values with counts), outliers ('threshold' sigma cutoff; 'method: zscore' or 'iqr'), zscore (normalize to z-scores), correlate (Pearson r between 'a'/'b' arrays). Input: 'numbers' array or 'data' delimited string. Zero new deps — pure Rust stdlib.
rss_tools — Parse RSS 2.0 and Atom 1.0 feeds without network calls or external utilities. 4 actions: list (default — entries with title/date/author/link/desc; 'limit'), info (feed metadata: type/title/description/language/generator/authors), links (all entry hyperlinks with titles), search ('query'/'q' matches title, description, author). HTML-stripped, CDATA-aware, namespace-tolerant. Pass 'text'/'xml'/'rss' or 'file'. Uses quick-xml (already present).
keyval_tools — Persistent key-value store backed by .hematite/kv.json for cross-call state within a session. 6 actions: set ('key'+'value' — any JSON type), get, list (optional 'prefix' filter), delete, clear (all or prefix-matched), keys (names only). 'namespace'/'ns' auto-prefixes keys. Falls back to ~/.hematite/kv.json outside project directories. Zero new deps — pure Rust stdlib + serde_json.
net_lookup_tools — Well-known TCP/UDP port and IANA IP protocol number lookup without shell commands. 4 actions: port (number → service name/description; optional tcp/udp filter), service (name → matching ports), search (fuzzy across names/descriptions), protocol (by number or name; omit args for full list). Covers ~100 ports including LM Studio (1234), Ollama (11434), Redis (6379), Vite (5173), Jupyter (8888). Pure Rust static tables, zero new deps.
money_tools — Financial calculations without external libs. 8 actions: compound_interest (final amount + interest earned; principal/rate/periods/n), loan (monthly payment + amortization; principal/annual_rate/term_months), apr_to_apy (APR→APY; apr/n), discount (sale price + savings; price/percent), percent_of (A as % of B, or X% of N), format_currency (thousands-separated string; amount/symbol/decimals), tip (bill/tip_percent/people → per-person total), split_bill (total/people/tip_percent → per-person share). Pure Rust stdlib, zero new deps.
financial_tools — Extended financial analysis without external libs. 7 actions: amortize (full amortization schedule with month-by-month table; principal/annual_rate/term_months; optional show_schedule bool), depreciation (asset depreciation schedule; cost/salvage/life_years; method: straight_line/declining_balance/sum_of_years/macrs5/macrs7), roi (return on investment with optional annualized ROI; initial/final/years), breakeven (break-even analysis with margin of safety; fixed_costs/price_per_unit/variable_cost; optional expected_units), cashflow (NPV + IRR via bisection + payback period; cashflows array/discount_rate), cagr (compound annual growth rate with projection table; start_value/end_value/years), savings (goal planner with time-to-target; target/monthly_contribution; optional current_savings/annual_rate/years). Pure Rust stdlib, zero new deps.
size_tools — Data size conversion and bandwidth estimation. 5 actions: convert (bytes ↔ all SI/IEC units; optional 'to' for single-unit result), parse (size string → bytes), format (human-readable with auto/decimal/binary style), compare (ratio + difference between two sizes), bandwidth (transfer time at given speed, or speed from size+time, or table of common speeds). Accepts all SI (KB/MB/GB/TB/PB) and IEC (KiB/MiB/GiB/TiB/PiB) units. Pure Rust stdlib, zero new deps.
validate_tools — Validate 12 common data formats. Actions: email (RFC 5321), ipv4, ipv6, cidr (network/broadcast/mask/host count), mac (colon/dash/flat; multicast/LA flags), url (HTTPS check), credit_card (Luhn + Visa/MC/Amex/Discover), isbn (ISBN-10/13), uuid (version/variant), phone (NANP + E.164), semver (SemVer 2.0), hex_color (#3/#6/#8 → RGB + luminance). auto action detects format type automatically. Pure Rust stdlib + std::net, zero new deps.
word_tools — Word frequency analysis, anagram detection, Soundex phonetic matching, palindrome checking, and syllable counting. 5 actions: frequency (default — ranked frequency table with % per word; 'text', 'top' N, 'stop_words' bool), anagram ('a'/'b' strings — checks equality of sorted letter sets with breakdown), soundex (Soundex code per word; 'word'/'words'/'text'; groups phonetically similar words), palindrome ('text' — full-text and word-level check, longest palindromic substring), syllables ('text' — per-word count + totals + Flesch-Kincaid grade estimate). Pure Rust stdlib, zero new deps.
time_zone_tools — Timezone conversion, offset lookup, and world clock. 4 actions: convert (default — 'datetime' + 'from' + 'to'; ISO 8601 or 'YYYY-MM-DD HH:MM:SS'; accepts named zones and numeric offsets like +05:30), list ('filter' substring to search), offset ('tz' → UTC offset in minutes and hours), world_clock ('zones' string array or object array; defaults to current system time). 80+ named timezone abbreviations (EST, PST, IST, JST, CET, etc.) plus arbitrary numeric offsets. Pure Rust stdlib, zero new deps.
string_metric_tools — String similarity and edit distance metrics. 8 actions: levenshtein (default — edit distance + similarity %), damerau (with adjacent-transposition), jaro (0–1 similarity), jaro_winkler (prefix-boosted Jaro), hamming (equal-length mismatch positions), lcs (longest common subsequence length + the subsequence), similarity (all four metrics in one table + average + verdict), fuzzy (rank candidates array by composite JW+LCS score; 'query'+'candidates'). All algorithms pure Rust DP, zero new deps.
calc_tools — Infix expression evaluator, RPN calculator, variable sessions, and sequence generation. 4 actions: eval (default — 30+ functions: sqrt/abs/ceil/floor/round/ln/log/log2/exp/trig/atan2/factorial/gcd/lcm/choose; constants pi/e/tau/phi; variables via 'x=3; x^2+1' syntax), rpn (postfix stack calculator; space-separated tokens), variables (multi-statement session: 'a=1; b=2; a*b'), sequence (arithmetic/geometric/fibonacci/triangular/prime/custom; 'type'+'count'). Pure Rust recursive-descent parser, zero new deps.
fraction_tools — Fraction arithmetic, simplification, decimal↔fraction conversion, comparison, and mathematical series. 8 actions: simplify (default — reduce to lowest terms; shows GCD, mixed-number form, decimal, percent; 'fraction' string or 'numerator'/'denominator'), add/sub/mul/div ('a'+'b' fraction strings), convert ('fraction' → decimal/percent/mixed OR 'decimal' → fraction via continued fractions; 'tolerance'), compare ('a'/'b' or 'fractions' array → sorted ranking), series (harmonic/'terms', egyptian/'fraction', farey/'n'). Pure Rust stdlib, zero new deps.
number_sequence_tools — Analyze and extend numeric sequences. 4 actions: detect (default — identify pattern: arithmetic/geometric/Fibonacci-like/polynomial via finite differences/squares/cubes/triangular/power-of-2/primes/constant), continue (extend N more terms; 'n' default 5), diff (Newton's forward difference table — flags constant rows with degree annotation; depth ≤ 8), stats (count/min/max/sum/mean/stddev/net change/growth%/avg step + pattern hint). Input: 'numbers' array or 'data' comma/space string. Pure Rust stdlib, zero new deps.
number_words_tools — Convert numbers to/from English words. 6 actions: to_words (default — integer → English like 'one thousand two hundred thirty-four'), to_ordinal (integer → ordinal 'forty-second'), from_words (English → integer; handles hyphens/'and'/negative/minus), currency ('amount' → 'X dollars and Y cents'; 'currency_name': dollar/euro/pound), digits (spell each digit: 123 → 'one two three'; handles '-' and '.'), roman ('number' → Roman numeral OR 'text' → integer + words; range 1–3999). 'uppercase: true' for ALL CAPS output. Handles up to 999 quadrillion. Pure Rust stdlib, zero new deps.
periodic_tools — Periodic table lookup and molar mass calculator. 5 actions: element (default — full detail by symbol/name/atomic number: mass/density/melting+boiling point/electronegativity/electron config/period/group/category), search ('query' substring + optional 'category' filter on name/symbol/category), list (all 118 elements tabulated; optional 'category'), compare ('symbol'/'name' + 'element2' → side-by-side property table), mass ('formula' like 'H2O' or 'C6H12O6' → molar mass with per-element contribution and % breakdown). Full 118-element static table H–Og. Pure Rust stdlib, zero new deps.
vector_tools — 2D/3D (and nD) vector math. 11 actions: info (default — magnitude/unit/angle from +x; 'v' or 'vector' as JSON array), add ('a'+'b'), subtract ('a'+'b'), scale ('v'+'scalar'), dot (dot product + angle + perpendicularity; 'a'+'b'), cross (3D cross product + magnitude; 'a'+'b' must be 3D), magnitude (|v| and |v|²), normalize (unit vector with |unit|=1 verification), angle (degrees + radians; detects perpendicular/parallel/antiparallel), project (scalar proj, vector proj, perpendicular part of 'a' onto 'b'), reflect ('v' reflected over 'n'; n auto-normalized). Zero new deps — pure Rust stdlib math.
sort_tools — Sorting algorithm visualizer and analysis. 4 actions: sort (default — 'numbers' array + 'algorithm': bubble/selection/insertion/merge/quick/heap/shell/counting/radix; shows sorted output, comparisons, swaps, step trace, and Big-O complexity), compare (run all 9 algorithms on the same input side-by-side with comparison table), analyze (array pre-analysis: sorted%, near-sorted%, unique count, range/mean, recommended algorithm with reasoning), search (binary search — 'target' in 'numbers'; shows per-iteration probe sequence). 'max_steps' caps trace (default 20). Pure Rust stdlib, zero new deps.
compression_tools — Lossless compression algorithm demonstration and text analysis. 4 actions: rle (default — Run-Length Encoding encode/decode; 'text'+'mode' encode/decode; shows size + ratio), lz (LZ77 sliding-window compression; 'text' + optional 'window'/'lookahead'; shows token stream: Literal(c) or BackRef{offset,len}; size estimate), analyze (Shannon entropy; character frequency table; bits/char; compressibility classification: Highly/Moderately/Slightly/Not), huffman (optimal prefix-free codes via weight-merging; code lengths per symbol; avg bits/char; compressed size estimate). Pure Rust stdlib, zero new deps.
trie_tools — Trie (prefix tree) data structure operations. Pass 'words' as JSON array or space/comma-separated string. 6 actions: build (default — insert words, render ASCII tree with * end-of-word markers; 'limit' caps tree nodes, default 50), search ('query' → FOUND / NOT FOUND / prefix exists), prefix (all words with given prefix; 'query', 'limit' default 10), autocomplete (ranked completions; 'query', 'limit' default 5), count (word count, node count, max depth), suggest (edit-distance-1 typo tolerance, fallback to distance-2; 'query', 'limit'). Optional: case_insensitive. Pure Rust stdlib + HashMap, zero new deps.
stack_tools — Stack, queue, deque simulation and expression evaluation. 5 actions: stack (default — LIFO with step trace; 'operations' string array; ops: "push ", "pop", "peek"/"top", "size"/"len", "clear"/"empty"), queue (FIFO; ops: "enqueue "/"push ", "dequeue"/"pop", "peek"/"front", "size", "clear"), deque (double-ended; ops: push_front/push_back/pop_front/pop_back/peek_front/peek_back/size/clear), evaluate ('expression' — auto-detects RPN vs infix; infix uses shunting-yard with precedence/associativity; RPN uses stack; both show step trace; operators +/-/*//%/^), balance ('expression' bracket check for (),[],{}; reports position of mismatch, extra close, or unclosed open). Pass 'initial' as JSON array to pre-populate. Pure Rust stdlib, zero new deps.
music_tools — Music theory calculations. 6 actions: note (default — 'note' name like 'A4' → Hz + MIDI; 'frequency' → nearest note + cents offset; A4=440 Hz/MIDI 69), chord ('root'+'quality' → note list with intervals; or 'notes' array → detect chord name; 20+ chord qualities), scale ('root'+'quality' → scale degrees; major/minor/modes/pentatonic/blues/whole-tone/diminished/chromatic/Japanese), interval ('note'+'note2' → Unison–Octave name + semitone count + frequency ratio), midi ('note' ↔ 'midi' number), tempo ('bpm' → whole/half/quarter/eighth/sixteenth/dotted/triplet durations in ms). Pure Rust stdlib math, zero new deps.
logic_tools — Propositional logic operations. 8 actions: truth_table (default — full table for 'expression'; TAUTOLOGY/CONTRADICTION/CONTINGENCY classification; max 8 vars), evaluate ('expression'+'variables' object → T/F), sat (satisfying assignments or UNSATISFIABLE; max 20 vars), tautology (always-true check + counterexample), contradiction (always-false check + witness), simplify (minterm DNF expansion), cnf (Conjunctive Normal Form via NNF+distribution), dnf (Disjunctive Normal Form). Operators: and/&&, or/||, not/!, xor/^, ->, <->. Unicode output ∧/∨/¬/→/↔. Pure Rust recursive-descent parser, zero new deps.
inflect_tools — English word inflection — plurals, verb forms, and possessives. 7 actions: pluralize (default — singular → plural; ~60 irregular entries first, then rule chain: -es/-ies/-ves/+s; uncountables unchanged), singularize (plural → singular; reverse irregulars + suffix rules), pluralize_with (count + correct form: '3 items'), verb_third (third-person singular: 'run' → 'runs'), verb_ing (present participle with CVC doubling: 'run' → 'running'), verb_past (simple past with CVC doubling for regulars: 'run' → 'ran'), noun_possessive ("dog's", "class'"). ~80 irregular verb entries, 25+ uncountables. Preserves input case (ALL CAPS/Titlecase). Pure Rust stdlib, zero new deps.
text_align_tools — Text alignment and column formatting. 6 actions: align (default — left/right/center/justify lines to target 'width'; 'fill' char for padding), columns ('columns' array of {text, align?, width?} rendered side-by-side with configurable 'separator'), indent (positive 'indent_width' adds prefix; negative removes leading chars; 'indent_char'), normalize (collapse internal space runs, strip trailing whitespace — preserves leading indent), center_block (pad all lines from left so widest line is centered within 'width'), ruler ('width' default 80; ·/+/| tick marks + column numbers at every tenth). Justify distributes spaces between words with leftward-biased extras. Pure Rust stdlib, zero new deps.
number_theory_tools — Prime factorization, primality testing, GCD/LCM with Bézout, Euler totient, modular arithmetic, Collatz, Fibonacci, and perfect number classification. 10 actions: factor (default — factorization, all divisors, σ(n), classification; 'n'), primes (sieve/'limit', Nth prime/'nth', primality test/'test'), gcd/lcm ('a'/'b' or 'numbers' array; gcd shows Bézout), totient ('n'), modpow ('base'+'exp'+'modulus'), modinv ('a'+'modulus'), collatz ('n' — sequence to 1), fibonacci ('n' list, 'nth' index, 'test' membership), perfect ('n' classification or 'limit' range scan). Pure Rust stdlib, zero new deps.
geo_tools — Geographic coordinate calculations. 6 actions: distance (default — Haversine great-circle in km/miles/nm with bearing; 'lat1'+'lng1'+'lat2'+'lng2'), bearing (initial+back bearing in degrees + compass point), midpoint (3D Cartesian centroid; 'lat1'/'lng1'/'lat2'/'lng2' or 'points' array), dms (decimal↔DMS; decimal: 'lat'+'lng'; DMS: 'lat_d'/'lat_m'/'lat_s'/'lat_dir' + lng equivalents), bbox ('points' array → N/S/E/W bounds + center + km dimensions), destination ('lat'+'lng'+'distance' km+'bearing' degrees → destination point). Pure Rust stdlib, zero new deps.
data_gen_tools — Test/mock data generation. 6 actions: lorem (default — Lorem ipsum words/sentences/paragraphs; 'count'+'unit'), name (random person names; 'count'), email (first.last@domain; 'count', optional 'domain'), numbers (random int/float in range; 'count'+'min'+'max'; 'float: true' for decimals), dates (random YYYY-MM-DD in range; 'count'+'from'+'to'; 'format': iso/us/eu/long), id ('kind': seq/hex/uuid; 'prefix'+'start'+'pad' for seq). All accept 'seed' for reproducible output. Pure Rust stdlib LCG, zero new deps.
unit_tools — Unit conversion across 13 categories without external utilities. 3 actions: convert (default — 'value'+'from'+optional 'to'; omit 'to' to see all conversions in the category), list (all units; optional 'category' filter), categories (13 categories with unit counts). Categories: length (18), mass (13), temperature (4; Celsius base; Fahrenheit/Kelvin/Rankine affine), area (10), volume (17), speed (6), energy (11), power (8), pressure (9), time (12), angle (6), fuel (4), frequency (5). Kelvin/Rankine use affine conversion: to_base=(v+offset)×factor. Pure Rust stdlib, zero new deps.
geometry_tools — Geometric shape calculations without external utilities. 5 actions: area (default — 'shape' + dimensions; rectangle/square/circle/ellipse/triangle/trapezoid/parallelogram/rhombus/regular_polygon/sector), volume ('shape' + dimensions → volume + surface area; cube/rectangular_prism/sphere/hemisphere/cylinder/cone/pyramid/torus), perimeter (same shapes as area; ellipse uses Ramanujan approximation), triangle (SSS: 'a'+'b'+'c' or SAS: 'a'+'b'+'angle_c' → all angles via law of cosines, Heron area, perimeter, inradius, circumradius, Acute/Right/Obtuse × Equilateral/Isosceles/Scalene type), circle (any one of radius/diameter/circumference/area given → all derived; optional 'angle' for arc length, sector area, chord length). Pure Rust stdlib, zero new deps.
checksum_tools — Non-cryptographic checksums for error detection. 6 actions: all (default — all algorithms in one pass), crc8, crc16, crc32, adler32, fletcher16. Input: 'text' (UTF-8) or 'hex' (hex-encoded bytes). CRC-8 poly 0x07; CRC-16/MODBUS 0xA001 reflected init 0xFFFF; CRC-32 IEEE 0xEDB88320 reflected pre/post XOR 0xFFFFFFFF; Adler-32 rolling sum mod 65521; Fletcher-16 dual mod 255. Pure Rust stdlib, zero new deps.
id_tools — Structured unique identifier generation and decoding. 4 actions: ulid (default — 26-char Crockford base32, 48-bit ms timestamp + 80-bit random; 'count' up to 100, optional 'seed'), nanoid (URL-safe with configurable 'size' 1–256 and custom 'alphabet'; default 21 chars), snowflake (64-bit int: 41-bit elapsed ms + 10-bit 'machine_id' + 12-bit sequence; epoch 2024-01-01), decode (detect and decode ULID or Snowflake — timestamp/random/machine/sequence breakdown). LCG PRNG via SystemTime entropy or deterministic 'seed'. Pure Rust stdlib, zero new deps.
cipher_tools — Classical cipher encode/decode and frequency analysis. 6 actions: rot13 (default; self-inverse), caesar (configurable shift 0–25 with brute-force table for short messages), vigenere (repeating keyword stream; 'key' arg required; encode/decode flag), atbash (A<->Z mirror; self-inverse), rail_fence ('rails' arg; shows rail diagram), analyze (letter frequency, Index of Coincidence, Caesar guess). Pure Rust stdlib, zero new deps.
har_tools — HTTP Archive (.har) file parser for web performance analysis. 6 actions: summary (default — entry count, domains, errors, time/size, status/MIME distribution), entries (tabular request list; 'limit' cap), slowest (top N with DNS/connect/SSL/send/wait/receive breakdown; 'n' default 10), errors (4xx/5xx/network-error filter), domains (per-domain count/time/size sorted slowest first), search (URL substring filter; 'query'). Input: 'har' object, 'json'/'text' string, or 'file' path. serde_json only, zero new deps.
ical_tools — iCalendar (.ics) file parser. 5 actions: parse (default — VEVENT + VTODO list with title/dates/location/status), events (VEVENT only), todos (VTODO with due/status/priority), info (calendar metadata: version/producer/name/timezone/component counts), search (keyword filter across all fields; 'query'). Handles RFC 5545 line unfolding, parameter stripping, DTSTART/DTEND formatting. Input: 'text'/'ical'/'ics' string or 'file' path. Pure Rust stdlib, zero new deps.
graph_tools — Graph algorithm operations without external utilities. 7 actions: info (default — node/edge counts, density, degree distribution), bfs (BFS from 'start' — level order, parent map), dfs (DFS from 'start' — discovery/finish times, edge classification), shortest (Dijkstra shortest path; pass 'start' and 'end'), topo (topological sort via Kahn's; detects cycles), cycles (DFS back-edge for directed; union-find for undirected), components (BFS components for undirected; Kosaraju SCC for directed). Pass 'directed: true' for directed graphs. Edges: {from, to, weight?} objects or [from, to, weight?] arrays. Pure Rust stdlib, zero new deps.
matrix_tools — Linear algebra matrix operations without external utilities. 7 actions: info (default — shape, rank, trace, det, min/max/mean, invertibility), multiply ('a' × 'b' matrices), transpose (flip rows/columns), determinant (LU decomposition), inverse (LU inverse + A×A⁻¹≈I verification), solve (Ax=b via Gaussian elimination; pass 'matrix' and 'vector'), rank (row reduction + nullity). Matrix format: 2D JSON array e.g. [[1,2],[3,4]]. Pure Rust stdlib, zero new deps.
graphviz_tools — Graphviz DOT language generator and parser. 4 actions: generate (DOT from 'nodes'/'edges' arrays; 'directed', 'rankdir'; edge/node label support), parse (extract nodes/edges from DOT source text; reports directed/undirected, node list, edge list), flowchart (linear chain from 'steps' array with oval start/end), tree ('root' + 'children' tree structure with nested child support). Output includes dot -Tpng/-Tsvg/-Tpdf render commands. Pure Rust stdlib, zero new deps.
mermaid_tools — Mermaid.js diagram syntax generator. 6 actions: flowchart (from 'nodes'/'edges' or 'steps' shorthand; 'direction' TD/LR/RL/BT; node shapes box/diamond/circle/stadium/cylinder), sequence (from 'messages' array with sync/async/lost types), class (UML class diagram with fields/methods/relationships), gantt (project timeline from sections with tasks), pie (pie chart from data object), er (entity-relationship from entities + relationships). Output is a fenced ```mermaid block. Pure Rust stdlib, zero new deps.
dns_tools — DNS zone file parser and analyzer. 4 actions: parse (default — NAME/TTL/TYPE/DATA table grouped by type; $ORIGIN/$TTL directives; per-type summary), records (filter by 'type' e.g. "MX"/"TXT"/"A"), validate (missing SOA, <2 NS records, CNAME at apex, MX→CNAME, duplicate A/AAAA, TXT >255 chars, multiple SPF per name), explain (plain-English per record type; SPF token-by-token; DMARC p=/rua=/pct= decoded; DKIM noted; CAA explained; SOA fields labelled). Handles parenthesised multi-line continuation, semicolon comments. Input: 'text'/'zone' or 'file'. Pure Rust stdlib, zero new deps.
css_tools — CSS stylesheet parser, validator, and analyzer. 5 actions: parse (default — selectors with line/property count/key declarations; at-rule summary), validate (duplicate selectors, empty rules, duplicate properties, !important >5, missing vendor standard pair, selector depth >4, invalid hex, z-index >9999, unknown pseudo-elements), vars (--custom-property definitions with values/selectors; var() usage counts; undefined vars), stats (totals, at-rule breakdown, top-10 properties, complexity distribution, colors, gzip estimate), minify (strip comments/whitespace/trailing semicolons; compression ratio). Input: 'text'/'css' or 'file'. Uses regex crate (existing dep).
http_parse_tools — Raw HTTP/1.1 message parser. 6 actions: parse (auto-detect request vs response), request (method/URL/version/query params/headers/body preview/content-type analysis), response (status code/reason/headers/redirect+error flags/body preview), headers (known annotations; response security header gap check), cookies (Cookie: + Set-Cookie: with security flags: HttpOnly/Secure/SameSite; XSS/CSRF risk), auth (Basic username decode, Bearer/JWT detection, Digest parsing, API key headers). Input: 'text'/'http'/'message' or 'file'. Pure Rust stdlib, zero new deps.
jq_tools — jq-inspired JSON path query and filter. 8 actions: query (dot-path navigation .field, .a.b[0], .items[-1], .items[]; pipes .arr|sort|unique|reverse; builtins length/keys/values/first/last/min/max/add), keys (object keys or array indices at path), values (object values at path), flatten (nested array → flat; optional 'depth'), map (extract 'field' from array elements), filter (keep elements matching 'field'+'value'/'contains'/'gt'/'lt'/'exists'), count (element/key/char count), type (JSON type + element distribution). Input: 'json' string or 'file'. serde_json (existing dep).
plist_tools — Apple Property List (plist) XML parser. 5 actions: parse (default — indented tree with type annotations; Notable Keys section for Info.plist files), get (dot-path key navigation + array index), keys (tabular dict listing with type + value preview), validate (missing CFBundleIdentifier/Version, NSAllowsArbitraryLoads, permission bool without UsageDescription), to-json (full plist→JSON conversion). Supports string/integer/real/bool/date/data/array/dict. Input: 'text'/'plist'/'xml' or 'file'. quick-xml (existing dep).
bencode_tools — BitTorrent bencode decoder and .torrent analyzer. 4 actions: decode (default — indented tree; pieces→count not binary), info (name/size/piece count/tracker/creator/creation date for .torrent), files (tabular file list with size + cumulative offset; single-file handled), trackers (all tracker URLs by tier, UDP/HTTP/HTTPS annotation, domain count). Input: 'hex' string or 'file' path. Pure Rust stdlib, zero new deps.
printf_tools — Analyze, simulate, validate, and convert C-style printf format strings. 4 actions: explain (default — parse all specifiers with type/flags/width/precision and plain-English meaning; warns on %n), simulate (render format string with args JSON array), validate (check %n risk, unknown specifiers, arg count mismatch, null bytes), convert (to Python %, Python f-string, Rust format!, Go fmt.Sprintf, JavaScript template literal). Pass 'format' + 'args' array. Pure Rust stdlib, zero new deps.
ascii_chart_tools — Render ASCII/Unicode charts from numeric data in the terminal. 5 actions: bar (default — vertical bar chart with labels, title, width, fill style block/hash/equals/dot/shade; negative values supported), line (line/time-series with Y-axis labels and connected dots), scatter (XY scatter from x+y arrays or [[x,y]] pairs), sparkline (one-row Unicode ▁▂▃▄▅▆▇█ trend), hbar (alias for bar). Pass 'data' array or comma string; 'x'+'y' for scatter. Pure Rust stdlib, zero new deps.
sql_format_tools — Format, minify, split, and extract from SQL. 4 actions: format (default — pretty-print with indent/uppercase options; handles SELECT/FROM/WHERE/JOIN/GROUP BY/ORDER BY/CASE-WHEN/subqueries), minify (strip whitespace + comments; size report), split (semicolon-delimited statement blocks), extract (tables/columns/aliases/comments via 'what' arg). Custom tokenizer — comments, string literals, backtick/bracket identifiers. Pass 'sql' or 'file'. Pure Rust stdlib, zero new deps.
wasm_tools — Inspect WebAssembly binary (.wasm) modules. Parses magic bytes, LEB128 section headers, type signatures, import/export records, and debug name section. 4 actions: info (default — magic, version, section count, total size, import/export summary), sections (all sections with id/name/size/offset), imports (module+name, kind: func/table/mem/global, function type signature), exports (name, kind, index). Pass 'file' (.wasm path) or 'hex' (hex-encoded bytes). Pure Rust stdlib, zero new deps.
jsonschema_tools — Inspect and validate JSON Schema documents (draft-07 compatible). 4 actions: info (default — $schema dialect, $id, title, root type, required count, property count, additionalProperties, enum values, $defs count, numeric/string/array constraints, combiner counts), properties (table of all properties with type/required/description), refs (all $ref usages, $defs/definitions entries, $id anchors), validate (check a JSON instance — type, required, enum, const, properties, additionalProperties, items, minItems/maxItems, minLength/maxLength, pattern, minimum/maximum, multipleOf, allOf/anyOf/oneOf/not, $ref pointer resolution; reports per-field errors at JSON Pointer paths). Pass 'schema' or 'schema_file'; validate also needs 'instance' or 'instance_file'. serde_json + regex already in Cargo.toml, zero new deps.
cbor_tools — Decode and analyze CBOR (RFC 7049/8949) binary data. 3 actions: decode (default — recursive value tree with type labels and tag annotations: datetime/epoch/UUID/COSE/WebAuthn; detects WebAuthn AttestationObject and COSE structures by map key pattern), info (major type distribution, tag count, nesting depth, byte size), annotate (per-byte hex dump with format labels). Handles indefinite-length, half/single/double floats, all tagged values. Pass 'hex' or 'base64'. Pure Rust stdlib, zero new deps.
msgpack_tools — Decode and analyze MessagePack binary data. 3 actions: decode (default — recursive value tree with format name and ext type annotations), info (nil/bool/int/uint/float/str/bin/array/map/ext type distribution counts, total bytes), annotate (per-byte hex dump with format byte labels). Handles all format bytes: fixint/fixmap/fixarray/fixstr, all integer widths, float32/64, str/bin/array/map variants, fixext/ext types. Ext −1 decoded as Timestamp. Pass 'hex' or 'base64'. Pure Rust stdlib, zero new deps.
network_header_tools — Decode raw network protocol headers from hex bytes. 7 actions: parse (auto-detect: EtherType for Ethernet, version nibble for IPv4/IPv6), ipv4 (version/IHL/DSCP/length/ID/flags/TTL/protocol/checksum verification/src+dst IP), ipv6 (version/traffic class/flow label/payload length/next header/hop limit/src+dst with :: compression), tcp (src+dst port with well-known names/seq/ack/data offset/FIN+SYN+RST+PSH+ACK+URG+ECE+CWR flags/window/checksum/urgent), udp (src+dst port with names/length/checksum), icmp (type/code/checksum/echo ID+seq; ICMPv6 type names), ethernet (dst+src MAC with broadcast/multicast detection/EtherType name). Pass 'hex' (spaces/colons stripped); optional 'protocol' hint. RFC 1071 IPv4 checksum. Pure Rust stdlib, zero new deps.
tlv_tools — Parse, decode, and build TLV (Type-Length-Value) binary data. 5 actions: parse (generic — configurable 'type_size' 1/2/4, 'length_size' 1/2/4, 'endian' big/little; shows hex+ASCII+integer per triplet), ber (ASN.1 BER/DER — variable tag/length per X.690, recursive SEQUENCE/SET, universal type names, INTEGER/BOOLEAN/NULL/OID value decode), dhcp (DHCP options RFC 2132 — 30+ named options, IP/lease/msgtype formatting), wifi (802.11 IEs — SSID/rates as Mbps/channel/ERP flags/RSN version/Vendor OUI annotations), build ('items' JSON array of {type, value_hex|value_string|value_u8} → assembled TLV bytes with hex dump). Pass 'hex'; spaces/colons stripped. Pure Rust stdlib + serde_json, zero new deps.
bin_pack_tools — Pack and unpack binary data using struct-style format strings (Python struct-compatible). Format: optional endian prefix </>, then b/B (int8/uint8), h/H (int16/uint16), i/I (int32/uint32), q/Q (int64/uint64), f (float32), d (float64), s (length-prefixed UTF-8 string), x (pad byte); repeat counts allowed (4B). Optional names array. 4 actions: pack (values → hex bytes with per-field offset summary + hex dump), unpack (hex bytes → typed values with per-field breakdown), describe (explain each field with type/size/endian), size (fixed byte size or minimum for variable string fields). Pure Rust stdlib, zero new deps.
class_tools — Inspect Java .class bytecode files without javap or external tools. Pure Rust parser. 5 actions: info (default — CAFEBABE magic verification, Java version from major class file version (45=Java 1.1 through 65=Java 21), minor version, constant pool entry count, access flags decoded (PUBLIC/FINAL/SUPER/INTERFACE/ABSTRACT/ENUM/SYNTHETIC), this class name, superclass name, implemented interface count), methods (all methods with access flags, name, descriptor decoded from JVM type notation (Ljava/lang/String; → java.lang.String, [I → int[], (II)V → (int, int) -> void)), fields (all fields with access flags, name, decoded type, optionally constant value from ConstantValue attribute), constants (raw constant pool listing with tag types — Utf8, Integer, Long, Float, Double, String, Class, FieldRef, MethodRef, InterfaceMethodRef, NameAndType, InvokeDynamic, etc.), imports (unique class names referenced in the constant pool — the effective import set without decompilation). Pass 'file' (.class path) or 'hex' (hex-encoded bytes). Pure Rust stdlib + serde_json, zero new deps.
dex_tools — Inspect Android DEX (Dalvik Executable) binary files — classes.dex from APKs and multi-dex files — without dexdump or external tools. 5 actions: info (default — DEX magic and version string (035–041), endianness from endian tag, file size, checksum, string/type/proto/field/method/class counts, DEX version to Android API level mapping (035=Lollipop/API 21, 039=Pie/API 28, 041=Android 14/API 34+)), classes (all class definitions with access flags decoded, class name in Java notation, superclass name, interface count, field/method counts from class data section), methods (all method references with class, name, and parameter+return type signature decoded from DEX type descriptors), strings (raw DEX string pool listing — useful for discovering hardcoded URLs, keys, and package names without decompilation; supports 'limit' to cap output), imports (unique class references from the type ID table — equivalent to import list). Pass 'file' (.dex path) or 'hex' (hex-encoded bytes). Pure Rust stdlib + serde_json, zero new deps.
macho_tools — Inspect macOS Mach-O binaries (executables, dylibs, frameworks, bundles, fat/universal binaries) without otool or nm. Pure Rust parser. 5 actions: info (default — magic, file type MH_EXECUTE/MH_DYLIB/MH_BUNDLE/MH_OBJECT/MH_CORE, architecture x86-64/ARM64/ARM/x86/PPC, CPU subtype, flags PIE/DYLDLINK/TWOLEVEL, UUID, entry point, install name for dylibs, source version, build platform, min OS/SDK, code signature and encryption flags, load command count), segments (all LC_SEGMENT_64/LC_SEGMENT with virtual address, file offset, size, flags, embedded section names), sections (all sections across all segments with section name, segment, type, flags, address, size), imports (all LC_LOAD_DYLIB/LC_LOAD_WEAK_DYLIB/LC_REEXPORT_DYLIB with install name, compatibility version, current version), fat (architecture table for fat/universal binaries with cputype, cpusubtype, offset, size). Pass 'file' (path to .dylib/.macho/.o/framework binary) or 'hex' (raw Mach-O bytes as hex string). Pure Rust stdlib, zero new deps.
pcap_tools — Parse and analyze PCAP/PCAPNG packet capture files without Wireshark or tcpdump. Handles classic PCAP (little/big-endian, nanosecond variant) and PCAPNG (SHB/IDB/EPB/OPB block types). 6 actions: info (default — file format, byte order, link type with name, packet count, capture duration, packets-per-second, total/captured bytes, average packet length), packets (tabular listing with packet number/relative timestamp/wire length/protocol/source+destination, port-annotated protocol names like TCP/DNS, DNS query info and HTTP method inline; 'limit' to cap rows), protocols (distribution table — Ethernet/IPv4/IPv6/TCP/UDP/ICMP/DNS/HTTP/HTTPS/SMB/ARP/NTP etc. with counts and percentage bar chart), conversations (top 20 host pairs by packet count with total byte volume), dns (all DNS queries and responses from UDP port 53 with name, record type, and resolved answer addresses), http (HTTP request/response pairs from TCP port 80/8080/8000 with method/path/host header and response status). Supports IPv4/IPv6, Ethernet/802.1Q VLAN, loopback, and Linux Cooked link types. Pass 'file' with path to .pcap or .pcapng file. Pure Rust stdlib + serde_json, zero new deps.
pe_tools — Inspect Windows PE binaries (EXE/DLL/SYS/OCX) without dumpbin or readpe. Pure Rust parser. 5 actions: info (default — machine type, file type EXE/DLL/Object/Driver, architecture PE32/PE32+, subsystem, COFF timestamp, image base, entry point RVA, image size, ASLR/DEP/CFG/HighEntropyVA/ForceIntegrity security flags, import DLL count, export count), sections (section table: name, virtual address, virtual size, raw size, raw offset, flags EXEC/READ/WRITE/CODE/INIT_DATA/UNINIT_DATA/DISCARDABLE), imports (all imported DLLs with function names or ordinals; up to 50 shown per DLL with overflow count), exports (exported function names with ordinals; up to 300 shown), headers (full DOS e_lfanew, COFF machine/sections/timestamp/characteristics, Optional Header magic/entry/base/subsystem/DllCharacteristics, Data Directory RVAs for Export/Import/Resource/TLS/Load Config). Pass 'file' (.exe/.dll/.sys/.ocx path) or 'hex' (raw PE bytes as hex string). Pure Rust stdlib, zero new deps.
elf_tools — Inspect ELF binaries (Linux executables, .so, .o, .ko) without readelf or objdump. Parses ELF magic, class (32/64-bit), endian, OS/ABI, type (ET_EXEC/ET_DYN/ET_REL/ET_CORE), machine (x86-64/AArch64/ARM/MIPS/RISC-V/eBPF and others), entry point. 5 actions: info (default — full ELF overview, interpreter path, segment type summary), segments (program headers — PT_LOAD/PT_DYNAMIC/PT_INTERP/PT_GNU_STACK/etc., flags R/W/X, virtual addr, file offset, sizes; PT_INTERP path shown inline), sections (section headers — name via .shstrtab, type SHT_PROGBITS/SHT_SYMTAB/SHT_DYNAMIC/etc., flags AXW, address, offset, size), symbols (.symtab fallback to .dynsym — value, size, bind LOCAL/GLOBAL/WEAK, type FUNC/OBJECT/NOTYPE, section, name; up to 200), dynamic (DT_NEEDED libraries, SONAME, RPATH, RUNPATH, all dynamic section entries). Pass 'file' or 'hex'. Pure Rust stdlib, zero new deps.
asn1_tools — Parse and inspect ASN.1 DER/BER encoded binary data without external utilities. X.509 certs, PKCS keys, SNMP, LDAP. 4 actions: parse (default — indented tag/length/value tree with Universal tag names, class, offset, length; 'max_depth' to limit), oid (200+ OID lookups: X.509 attribute types, cert extensions, signature algorithms, EC curves, AES, SHA-2/3, PKCS#7/9/12; pass 'oid' string), decode_cert (X.509 cert summary — scan DN fields, OIDs, serial, validity dates), info (root-level tag class/number/constructed flag). Pass 'hex' or 'file' (.der/.cer/.crt/.p8). Pure Rust stdlib, zero new deps.
jsonl_tools — Process JSONL / NDJSON without external utilities. 9 actions: parse (default — index + pretty-print; 'limit'), filter ('field' dot-path + 'value' + 'op': eq/ne/gt/lt/gte/lte/contains/exists/missing), map (extract one field per record), aggregate (count/sum/avg/min/max/distinct; 'field'+'agg'), keys (all-keys union with type distribution + coverage %), stats (coverage%/null%/type distribution per field), to_csv (headers from all observed keys), group (count bar chart per field value), sort ('field' + 'order'). Dot-path + array indexing (items[0]). Pass 'text'/'jsonl' or 'file'. Pure Rust stdlib + serde_json, zero new deps.
jsonrpc_tools — Parse, build, validate, and inspect JSON-RPC 2.0 messages without external utilities. 4 actions: parse/inspect (default — decode any message type: request/notification/success response/error response/batch; field-by-field annotations with spec compliance notes and standard error code descriptions), build/create (construct a valid message; 'kind': request/notification/response/error; supply 'method'/'id'/'params'/'result'/'error_code'/'error_message'/'error_data' as needed; auto-validates the built message), validate/check (strict JSON-RPC 2.0 spec check; reports every violation including missing jsonrpc field, invalid id types, missing error.code/message, result+error both present), batch (parse a JSON array as a batch with per-item summary, or build one from 'messages' array). Standard error codes decoded: -32700 Parse error, -32600 Invalid Request, -32601 Method not found, -32602 Invalid params, -32603 Internal error, -32099 to -32000 Server error. Pass 'message' with the raw JSON-RPC string. Pure Rust stdlib + serde_json, zero new deps.
leb128_tools — Encode, decode, and analyze LEB128 variable-length integers (ULEB128 unsigned + SLEB128 signed) without external utilities. Used in WASM, DWARF, Android DEX, protobuf. 5 actions: encode (integer → LEB128 hex bytes), decode (hex bytes → integer + bytes consumed + remaining stream), analyze (byte-by-byte bit-field breakdown showing continuation bit and data bits), multi (batch encode JSON array or decode concatenated stream), explain (verbose bit-level walkthrough with value accumulation trace). Pass 'value' for encode, 'hex'/'bytes' for others; 'signed: true' for SLEB128. Example: 624485 → e5 8e 26 (ULEB128). Pure Rust stdlib, zero new deps.
unicode_tools — Analyze Unicode text for script distribution, bidi safety, homoglyph risk, encoding sizes, and normalization without external utilities. 7 actions: analyze (default — per-character codepoint U+XXXX, category, script, UTF-8 hex; up to 200 chars), scripts (script distribution table — Latin/CJK/Cyrillic/Greek/Arabic/etc.), blocks (Unicode block distribution), bidi (RTL count + Trojan Source CVE-2021-42574 invisible bidi control char detection — RLO/LRO/RLE/LRE/PDF/FSI/PDI), confusables (Cyrillic/Greek ASCII homoglyphs flagged with ASCII equivalent), encoding (UTF-8/UTF-16 LE|BE/UTF-32 LE|BE byte sequences per char), normalize (NFC vs NFD status — combining marks vs precomposed). Pass 'text'. Pure Rust stdlib, zero new deps.
html_tools — Parse and analyze HTML documents. 9 actions: parse (default — DOCTYPE, title, meta description, element counts, heading hierarchy), links (all anchors with href/text/type EXT|INT|ANCH|MAIL/nofollow), images (src/alt/dimensions; flags missing alt), forms (method/action/enctype/input fields), tables (row×col counts + cell preview), scripts (external and inline with byte counts), validate (accessibility+SEO: DOCTYPE/lang/charset/title/viewport/alt/h1), text (strip tags → plain text with entity decode), stats (element/tag/depth/comment counts). Pass 'html' or 'file'. Custom char-level tokenizer. Pure Rust stdlib, zero new deps.
vcf_tools — Parse and analyze vCard contact files (.vcf). Supports vCard 2.1/3.0/4.0. RFC 6350 line unfolding, property parameters (TYPE=WORK,CELL), structured names, encoded values, typed multi-value fields. 5 actions: parse (default — full contact detail per card), list (name/email/phone summary table), search (keyword filter across all fields; 'query'/'q'), to_json (structured JSON array), to_csv (CSV with Full Name/Given/Family/Org/Title/Email/Phone/Address/Birthday/Categories/URL columns). Pass 'vcf'/'text' or 'file'. Pure Rust stdlib + serde_json, zero new deps.
totp_tools — Generate, verify, and inspect TOTP/HOTP one-time passwords (RFC 6238/4226). Pure Rust HMAC-SHA1. 5 actions: generate (default — current code from base32 secret; prev/current/next window), verify (VALID/INVALID with ±1 window tolerance), hotp (counter-based; 'count' for N consecutive codes), info (parse otpauth:// URI or explain algorithm), qr (build otpauth:// URI for any authenticator app). Pass 'secret' base32, optional 'digits'/'period'/'time'. Zero new deps.
tar_tools — Inspect uncompressed TAR archives (.tar). Detects and reports gzip/bzip2/xz/zstd with the correct shell command. 4 actions: list (default — permissions, size, date, type, symlink targets; 'max' caps output), info (file/dir/symlink counts, content size, owner list, date range), find (name substring filter via 'query'), extract (read text entry as UTF-8; pass 'entry'; 512 KB limit). Handles GNU TAR long-name extension and POSIX ustar prefix paths. Pass 'file' (required). Pure Rust stdlib 512-byte block parser, zero new deps.
email_tools — Parse and analyze RFC 2822 email (.eml) files. Decodes RFC 2047 encoded words (base64-B, QP-Q), parses folded headers, detects MIME structure with multipart boundaries, traces Received: hop chains. 4 actions: parse (default — key headers summary, decoded values, body preview, hop count), headers (full table; 'name' for specific header; 'filter' for substring), structure (MIME part tree — types/encodings/sizes/attachments; recursive depth 4), trace (delivery chain in chronological order — from/by servers, timestamps, routing metadata). Pass 'file' (.eml path) or 'text' (raw email). Pure Rust stdlib, zero new deps.
nato_tools — NATO phonetic alphabet and Morse code encode/decode. 4 actions: nato (default — character-by-character NATO word expansion), from_nato (parse NATO word sequence back to text; handles alfa/alpha variants), morse (auto-detect encode/decode from content; letter sep: space, word sep: /), spell (phonetic label per character for radio dictation). Covers 26 letters, digits 0–9, punctuation. Pure Rust static tables, zero new deps.
file_tree_tools — Generate visual file tree representations and directory statistics without external utilities (no tree command). 5 actions: tree (default — ASCII ├──/└── tree with depth limit and file sizes), flat (sorted flat listing with sizes), stats (file/dir/size breakdown by extension), json (structured JSON tree), sizes (files sorted largest first with % share bars). Options: path, depth (default 4; 0=unlimited), show_hidden, extensions (filter), skip_dirs, limit, top. Skips target/.git/node_modules/vendor/dist/build by default. Pure Rust stdlib, zero new deps.
find_tools — Find files and directories matching criteria without external utilities (no find command). 4 actions: list (default — matching paths with size + human-readable age), count (match count + total size), sizes (size summary largest-first), recent (sorted by modification time newest first). Filters: name (glob *.rs or substring), ext (without dot), type (file/dir/all), min_size/max_size (bytes), newer_than/older_than (days), depth (0=unlimited), show_hidden. Skips target/.git/node_modules/vendor/dist/build by default. Pure Rust stdlib, zero new deps.
todo_tools — Scan source files for TODO/FIXME/HACK/XXX/NOTE/DEPRECATED/BUG/OPTIMIZE/WORKAROUND/TEMP/KLUDGE/NB comments. Word-boundary detection (no false positives on "TODOLIST"). 5 actions: scan (default — grouped by label with file:line context), stats (count per label with bar chart), list (flat list of all findings), filter (specific label; pass 'label'), files (top N files by annotation count; 'top'). Configurable path/extensions/limit. Skips target/.git/node_modules/vendor/dist/build and cache dirs. Pure Rust stdlib, zero new deps.
grep_tools — Search files for regex patterns without external utilities. 4 actions: search (default — matching lines with file:line context; optional before/after context lines with -- separators), count (match count per file sorted by frequency), files (list matching files), matches (flat list with capture group extraction). Options: case_insensitive, fixed (literal via regex::escape), whole_word (\b...\b), before/after, invert, extensions, limit. Uses existing regex crate, zero new deps.
text_extract_tools — Extract structured entities from unstructured text. 9 actions: emails, urls, ips (IPv4+IPv6), phones (US/international), dates (ISO/US/EU), uuids, hashes (MD5/SHA-1/SHA-256 with position-masking to prevent substring false positives), all (default), custom (user regex with optional case_insensitive). Each action returns deduplicated (value, count) pairs sorted by frequency. Options: unique (default true), limit (max per type). Uses existing regex crate, zero new deps.
interval_tools — Date interval operations without external utilities. 6 actions: overlap (do two intervals overlap — shows overlap range/duration or gap), contains (is a date within an interval — shows distance from boundaries), union (merge overlapping intervals from array of {start,end} objects), intersect (find intersection of two intervals), duration (time between two dates — full breakdown total_seconds/minutes/hours/days/weeks), schedule (generate N recurring dates; step formats: 1d/2w/1m/1y/6h/30min). Accepts ISO 8601 YYYY-MM-DD and YYYY-MM-DDTHH:MM:SS. Pure Rust stdlib date arithmetic, zero new deps.
json_patch_tools — Apply and generate JSON Patch (RFC 6902) and JSON Merge Patch (RFC 7396) without external utilities. 5 actions: apply (default — apply a patch op array to 'document'; ops: add/remove/replace/move/copy/test; per-op log), generate ('original'+'modified' → JSON Patch via recursive diff), merge_apply (RFC 7396 merge — null values remove keys), merge_generate ('original'+'modified' → merge patch object), test (validate test ops PASS/FAIL + ALL PASS verdict). Implements RFC 6901 JSON Pointer (~0/~1 escaping, '-' for array append). Pure Rust stdlib + serde_json, zero new deps.
markdown_gen_tools — Generate Markdown constructs programmatically (complements markdown_tools which reads/parses). 6 actions: table (default — GFM table; 'headers' array + 'rows' 2D array; optional 'align' per column: left/right/center; auto-sizes widths), badge (shields.io badge; 'label'+'message'+'color'; optional 'url'), toc ('headings' array → nested TOC with GitHub anchors), admonition (>[!KIND] callout; 'kind': NOTE/TIP/IMPORTANT/WARNING/CAUTION), link ('text'+'url'; 'style': inline/reference/image/image_link; optional 'title'), doc ('title'+'sections' [{heading,body,level?,code?,lang?}]). Pure Rust stdlib, zero new deps.
token_tools — Estimate LLM token counts and context budget. 4 actions: estimate (chars/4 + words*1.3 averaged, fill bars for 4K/8K/32K/128K windows), budget (fill% + remaining for given context_size; OK/WARNING/CRITICAL status), compare (ratio + cheaper-by% between two texts via 'a'/'b'), truncate (cut to ~N tokens at word boundary; 'max_tokens' default 1000). Pure Rust stdlib, zero new deps.
mime_tools — MIME type lookup by extension, reverse lookup, and category listing — 130+ entries. 4 actions: from_ext (extension → MIME type + category; accepts 'js', '.ts', 'file.pdf'), from_mime (MIME type → extensions), search (fuzzy search on ext or MIME string), category (list by text/image/audio/video/application/font; omit for summary). Covers 54 text/code, 15 image, 10 audio, 11 video, 34 application, 5 font entries. Pure Rust stdlib, zero new deps.
http_status_tools — HTTP status code lookup, search, and listing — 65 standard codes across all 5 categories. 4 actions: lookup (code → reason + description; accepts integer or string), search (keyword search in reason/description), category (list by 1xx/2xx/3xx/4xx/5xx; omit for summary with counts), list (all codes or filtered by category). Pure Rust stdlib, zero new deps.
glob_tools — Test, filter, explain, and convert glob patterns. 4 actions: match (single path vs pattern), filter (array/newline path list vs pattern), explain (tokenize pattern into globstar/wildcard/any-char/char-class/literal components with regex equivalent), convert (pattern → anchored regex string). Glob syntax: ** = any depth, * = single segment, ? = one char, [!abc] = negated class. Uses existing regex crate, zero new deps.
log_parse_tools — Parse, detect, filter, and aggregate structured log lines. Supports JSON Lines, key=value, Apache Common/Combined, Syslog (traditional + ISO 8601). 4 actions: parse (auto-detect format, extract fields), detect (format distribution), filter ('field'+'value' match), stats (field value counts). Pass 'format' to override detection. Pure Rust stdlib + serde_json, zero new deps.
journald_tools — Parse and analyze journalctl -o json NDJSON output without external utilities. 5 actions: parse (default — tabular entry listing with timestamp/unit/priority/message; 'unit' and 'priority' filters, 'limit'), units (systemd unit frequency table with entry count and worst priority seen), errors (critical/alert/emergency/error entries only; priority ≤ 3), filter ('unit' substring and 'priority' threshold), summary (total entries, priority distribution, unique units, date range). Handles MESSAGE as string or byte array (binary log entries). Priority names: EMERG/ALERT/CRIT/ERR/WARNING/NOTICE/INFO/DEBUG (0–7). Pass 'log' (inline NDJSON) or 'file'. Pure Rust stdlib + serde_json, zero new deps.
csp_tools — Parse, explain, validate, and build Content Security Policy headers. 4 actions: parse ([UNSAFE] flags per source), explain (plain-English per directive), validate (unsafe-inline/eval/wildcard/missing-directives/deprecated-report-uri), build (from directives object or preset: strict/moderate/api). Auto-strips header name prefix. Pure Rust stdlib, zero new deps.
robots_txt_tools — Parse, check, validate, and summarize robots.txt files. 4 actions: parse (all UA blocks + sitemap directives), check (ALLOWED/BLOCKED for path+agent per RFC 9309 specificity — most-specific wins, Allow beats Disallow on tie), validate (unknown directives, bad paths, Disallow:/ site-block, relative sitemaps), summary (table: allows/disallows/crawl-delay per agent). Auto-detects check vs parse from args. Pure Rust stdlib, zero new deps.
sitemap_tools — Parse, search, and analyze sitemap XML (urlset and sitemapindex). 4 actions: parse (URLs with lastmod/changefreq/priority; 'max' cap default 20), search (URL substring filter; 'query'/'q'), stats (count, field coverage %, changefreq/priority distributions), list (all URLs or prefix-filtered). Uses quick-xml (existing dep), zero new deps.
physics_tools — Look up NIST physical constants and evaluate physics formulas by solving for the missing variable. 4 actions: constant (default — search ~29 constants by name/symbol/keyword: c, h, G, k_B, N_A, R, σ, e, ε₀, μ₀, k_e, F, m_e, m_p, a₀, α, R_∞, g, eV, Planck units), formula (~20 formulas: kinematics, F=ma, KE=½mv², GPE, E=mc², momentum, work, centripetal force, gravitation, Ohm's law, P=VI, Coulomb's law, wave speed, E=hf, PV=nRT, Q=mcΔT, Carnot efficiency, thin lens, Snell's law, de Broglie; pass 'name' + 'vars' with knowns), list (what='constants' or 'formulas'; optional 'domain' filter), domains (all domains with counts). Zero new deps.
chemistry_tools — Balance chemical equations, stoichiometry, molarity, pH, and ideal gas law. 5 actions: balance (default — Gaussian elimination with rational arithmetic; stack-based formula parser handles Ca(OH)₂ / Al₂(SO₄)₃; pass 'equation'), stoichiometry (mole/mass yield; pass 'equation'/'reactant'/'product' + 'moles' or 'grams'), solution (M=n/V and C₁V₁=C₂V₂ dilution; pass moles_solute+volume_L or three of C1/V1/C2/V2), ph (pH/pOH/[H⁺]/[OH⁻] from 'pH_value'; Henderson-Hasselbalch from Ka+acid_conc+base_conc; Kb→pKb/Ka), gas (PV=nRT; three of P/V/n/T; unit='L' for liters). Full 118-element mass table. Zero new deps.
cite_tools -- Format academic citations in APA/MLA/Chicago/IEEE/Harvard styles and generate BibTeX. 5 actions: format (default -- format citation in 'style' from fields: authors/title/journal/book/publisher/year/volume/issue/pages/doi/url/accessed/city/edition/editors/institution/degree; 'type': article/book/chapter/website/conference/thesis/report), bibtex (BibTeX entry; optional 'key'), parse_doi (validate DOI string), parse_isbn (validate ISBN-10/ISBN-13 check digit), validate (completeness check). Authors as "Last, First and Last, First" or array. Zero new deps.
latex_tools -- Generate, escape, and convert LaTeX without external tools. 7 actions: escape (default -- escape 13 special chars: & % $ # _ { } ~ ^ \ < > in 'text'), table (tabular block from 'headers'+'rows'; 'caption'/'label'/'border': full/outer/none), equation ('expression' in 'env': equation/align/gather/multline; 'numbered' flag), template (document scaffold; 'type': article/report/book/beamer/letter; 'title'/'author'/'packages'), strip (remove markup from 'text'), symbols (look up symbol commands; 'query' like 'alpha'/'greek'/'arrow'), convert (Markdown to LaTeX: headings/bold/italic/code/lists). Zero new deps.
notebook_tools — Parse and inspect Jupyter Notebook (.ipynb) files without external tools. 5 actions: info (default — nbformat version, kernel, language, cell counts by type, total source lines, output count, optional title/authors), cells (tabular: Index/Type/Lines/Outputs/Exec# columns; optional 'type' filter and 'limit'), source (extract all cell source with Cell N separators; optional type filter), outputs (per-cell outputs: stream preview, error name/value, display_data text/plain preview), stats (kernel, language, total/code/markdown/raw counts, source lines, error cells, code cells with no output). Handles nbformat 3 (worksheets) and 4 (top-level cells); cell source as array or string. Zero new deps.
conda_tools — Parse, validate, and export Conda environment.yml files without external tools. 5 actions: info (default — environment name, channels, Python version, conda/pip dependency counts, optional variables section), list (tabular Package/Version/Type; optional 'type': conda/pip and 'query' substring filter), compare (diff two environments via file_a/file_b or yaml_a/yaml_b; shows only_a/only_b/common with version deltas), validate (missing name, no channels, no defaults/conda-forge, duplicate packages; VALID/INVALID verdict), export (convert to pip requirements.txt; normalizes =X.Y to ==X.Y; skips python as comment). Strips channel prefixes (conda-forge::numpy). Zero new deps.
bio_tools — Analyze biological sequences (DNA, RNA, protein) without external utilities. 8 actions: info (default — sequence type auto-detection, length, base composition, GC%, MW estimate), complement (DNA reverse complement in 5'→3' and 3'→5'), transcribe (DNA→mRNA or mRNA→DNA template), translate (mRNA/DNA→amino acids; 'frame': 1/2/3/-1/-2/-3; 'all_frames: true' for all 6 reading frames), gc (GC content with sliding window min/max analysis), orfs (find open reading frames in all 6 frames; 'min_length' in aa), codons (codon usage frequency table grouped by amino acid; frame 1), parse_fasta (parse multi-record FASTA files; pass 'text' or 'file'). Auto-detects sequence type from alphabet (DNA/RNA/protein); accepts raw sequence or FASTA inline. Zero new deps.
gpu_tools — Estimate LLM VRAM requirements, look up GPU specifications, and plan VRAM budgets without external utilities. 5 actions: estimate (default — VRAM needed for a model; 'params' in billions + 'quant': fp32/fp16/bf16/q8/q6/q5/q4/q3/q2/q1 or GGUF names like q4_k_m; includes KV cache and runtime overhead; shows GPU fit table), batch (max batch size for a model given VRAM budget; pass 'params'/'quant'/'vram_gb'), info (GPU specs by model name — VRAM, CUDA/tensor cores, memory bandwidth, FP16 TFLOPs, architecture; covers RTX 4xxx/3xxx/2xxx, A100, H100), parse (parse pasted nvidia-smi plain-text output; pass 'text'), budget (VRAM budget planner — which model sizes fit at each quant level; pass 'vram_gb'). Zero new deps.
mechanics_tools — Classical mechanics calculations without external utilities. 8 actions: kinematics (SUVAT — solve_for: v/s/a/t/u with the known variables), forces (Newton's 2nd law; friction; incline analysis with net force and acceleration), energy (KE/GPE/spring PE/conservation/power/work), momentum (linear momentum; impulse; elastic and perfectly inelastic collisions), rotation (torque; moment of inertia for 7 shapes; angular acceleration; rotational KE; angular momentum), oscillation (spring-mass period; simple pendulum; spring constant from period; SHM at any time t), projectile (range; max height; time of flight; optionally position/speed at time t), circular (centripetal Fc/ac/ω/period; orbital speed and period from gravitational mass). Zero new deps.
circuit_tools — Electrical circuit calculations without external utilities. 8 actions: ohm (V=IR — solve_for: V/I/R), resistors (series/parallel combinations; product-over-sum shortcut for two resistors), power (P_VI/P_IR/P_VR/efficiency; optionally energy in J and Wh from time t), capacitors (series/parallel; energy E=½CV²; RC time constant with charging/discharging equations), inductors (series/parallel; energy E=½LI²; RL time constant with current build-up; instantaneous voltage VL=L·dI/dt), divider (voltage divider and current divider with ratios), rlc (series RLC: resonant frequency, Q-factor, bandwidth, damping ratio, response type; optionally impedance at a given frequency), ac (AC impedance Z; phase angle; inductive/capacitive classification; power factor; optionally real/apparent/reactive power from V). Zero new deps.
thermo_tools — Thermodynamics and fluid mechanics calculations without external utilities. 8 actions: ideal_gas (default — PV=nRT solver; solve_for: P/V/n/T with the other 3 variables), work (thermodynamic work for process: isothermal/isobaric/isochoric/adiabatic), entropy (entropy change for process: isothermal/isobaric/isochoric/mixing), heat (mode: conduction/convection/radiation — Fourier, Newton cooling, Stefan-Boltzmann), cycles (efficiency: carnot/otto/diesel/brayton), fluid (mode: reynolds/bernoulli/poiseuille/continuity), properties (gas/fluid properties lookup: air/nitrogen/oxygen/co2/hydrogen/helium/argon/methane/steam — molar mass, Cp, Cv, γ, μ, k), psychro (psychrometrics — pass T_dry+T_wet or T_dry+RH; returns relative humidity, dew point, humidity ratio via Antoine equation). Zero new deps.
optics_tools — Optics and photonics calculations without external utilities. 8 actions: refraction (default — Snell's law, critical angle, TIR; pass n1, n2, theta1 or theta2), lens (thin lens equation — 2 of f/do/di; or lensmaker's equation with R1/R2/n_lens), mirror (mirror equation — f or R + do or di), diffraction (single-slit: pass lambda+a; grating: pass lambda+d), interference (double-slit: lambda/a/L with fringe positions; thin film: lambda/n_film/t with phase-shift analysis), polarization (Malus's law: I0+theta; Brewster's angle: n1+n2), fiber (optical fiber NA, acceptance angle, TIR critical angle, V-number — pass n_core+n_clad; optionally lambda+D), blackbody (Wien's displacement, Planck's law, Stefan-Boltzmann — pass T in K; optionally wavelength_nm for spectral radiance). Zero new deps.
quantum_tools — Quantum mechanics calculations without external utilities. 8 actions: particle_box (default — particle in an infinite square well: energy levels En=n²π²ħ²/(2mL²), probability density at position x; pass L + optional n/m_kg), hydrogen (hydrogen-like atom: energy level En=-13.6·Z²/n² eV, Rydberg wavelength λ=1/R∞·(1/n1²-1/n2²); pass n or n1+n2; optional Z for hydrogen-like), uncertainty (Heisenberg uncertainty: min Δp from Δx, min Δx from Δp, or min ΔE from Δt; pass delta_x or delta_p or delta_t; optional particle), de_broglie (de Broglie wavelength λ=h/p from velocity or momentum; relativistic correction applied above 1% of c; pass v or p; optional m_kg), photoelectric (photoelectric effect: KE_max=hf-φ; stopping potential, threshold frequency and wavelength; pass freq or wavelength_nm + work_function_ev), compton (Compton scattering: Δλ=λ_C(1-cosθ); pass theta_deg + optional initial_wavelength_nm for scattered wavelength), tunneling (quantum tunneling transmission T≈e^(-2κL): κ=√(2m(V-E))/ħ; pass E_ev + V_ev + L_m + optional m_kg), harmonic (quantum harmonic oscillator: En=(n+½)ħω energy levels, zero-point energy ½ħω, classical amplitude A, and classical/quantum turning point comparison; pass omega or freq_hz; optional n). Uses CODATA 2018 constants. Zero new deps.
em_tools — Electromagnetism calculations without external utilities. 8 actions: coulomb (default — Coulomb's law F=ke·q1·q2/r²; electric potential energy U=ke·q1·q2/r; attractive/repulsive classification; pass q1/q2/r), electric_field (point charge E=ke·q/r²; potential V=ke·q/r; field direction inward/outward; force on test charge; pass q/r and optional q_test), magnetic_field (Biot-Savart geometries — geometry: wire (B=μ₀I/(2πr)), loop (B=μ₀IR²/(2(R²+x²)^(3/2))), solenoid (B=μ₀nI), toroid (B=μ₀NI/(2πr)); pass geometry + required args + optional I for all geometries), capacitance (geometry: parallel_plate (C=ε₀·A/d), cylindrical (C=2πε₀L/ln(b/a)), spherical (C=4πε₀·ab/(b-a)); pass geometry + dimensions; optional v for charge Q=CV and energy E=½CV²), inductance (geometry: solenoid (L=μ₀N²A/l), toroid (L=μ₀N²A/(2πr)), coaxial (L=μ₀l·ln(b/a)/(2π)); pass geometry + dimensions; optional I for energy E=½LI² and flux linkage NΦ), em_wave (EM wave: c=λf; E/B amplitude ratio; radiation pressure; spectrum region detection Gamma/X-ray/UV/Visible/IR/Microwave/Radio; pass freq or wavelength_m), lorentz (Lorentz force F=q(E+v×B): E-only, B+v-only, or full combined force; magnitude and direction; pass q + E or B+v or all three), poynting (Poynting vector S=E×B/μ₀; time-averaged intensity ⟨S⟩=E₀²/(2μ₀c); electromagnetic energy density; radiation pressure; pass E_amp and optional B_amp). Uses CODATA 2018 constants. Zero new deps.
relativity_tools — Special relativity calculations without external utilities. 8 actions: gamma (default — Lorentz factor γ=1/√(1−β²) from 'beta' or 'v' in m/s; ultra-relativistic/non-relativistic approximations), lorentz (TIME DILATION Δt=γτ via 't'; LENGTH CONTRACTION L=L₀/γ via 'l'; velocity addition via 'u'), energy (E=γmc², KE=(γ−1)mc², E₀=mc², classical ratio; particle via 'particle' name/m via 'm' kg/'m_mev' in MeV/c²), momentum (p=γmv and E²=(pc)²+(mc²)² verification; 'particle'/'m'/'m_mev'), transform (Lorentz transformation x'=γ(x−vt), t'=γ(t−vx/c²) with inverse check; pass 'x' and 't_coord'), doppler (f_obs/f_src=√((1±β)/(1∓β)); 'direction' approaching/receding; 'freq' in Hz for absolute values), interval (s²=(cΔt)²−(Δx)² with TIMELIKE/SPACELIKE/LIGHTLIKE classification; proper time for timelike; pass 'x' and 't_coord'), kinematics (full γ/v/E/KE/p summary with classical comparison for any particle). Particle names: electron, proton, neutron, muon, or '#u' for N AMU. Uses CODATA 2018 constants. Zero new deps.
nuclear_tools — Nuclear physics calculations without external utilities. 8 actions: decay (default — N(t)=N₀e^(−λt); pass 'n0' atoms or 'a0' Bq; pass one of 't_half'/'lambda'/'tau'; shows remaining %/half-lives elapsed), halflife (convert T½↔λ=ln2/T½↔τ=1/λ with practical unit display), binding_energy (Bethe-Weizsäcker SEMF: volume/surface/Coulomb/asymmetry/pairing terms; pass 'z' and 'a'; gives B/A per nucleon), q_value (Q=(Σm_reactants−Σm_products)×931.494 MeV/u; 'reactants' and 'products' as mass arrays in u), activity (Bq↔Ci↔mCi↔μCi↔dps↔dpm; pass 'bq'/'ci'/'mci'), dose (Gy↔rad and Sv↔rem; optional 'radiation' type gamma/alpha/beta/neutron/proton/heavy_ion for Wᵣ weighting; context table for background/X-ray/CT levels), carbon_dating (C-14 T½=5730 yr; 'ratio' 0–1 → age in years, or 't_years' → fraction remaining), reactions (7 presets with Q-values: fusion_dt 17.59 MeV/fusion_dd 3.27 MeV/fusion_pp 0.42 MeV/fission_u235 202.5 MeV/fission_pu239 210.0 MeV/alpha_decay Ra-226 4.871 MeV/beta_decay n 0.782 MeV; use reaction='list'). Uses CODATA 2018 constants. Zero new deps.
acoustics_tools — Acoustics and sound engineering calculations without external utilities. 8 actions: wave (default — λ=v/f, period T=1/f, wave number k, angular frequency ω from 'freq' Hz; optional 'temp_c' for speed-of-sound correction; audio band label and nearest musical note), decibels (SPL=20·log₁₀(p/p₀) from 'pressure' Pa; intensity level from 'intensity' W/m²; dB→Pa inverse; context label), doppler (f_obs=f_src·(v±v_obs)/(v∓v_src); 'freq'+'v_source'/'v_observer' m/s; approaching/receding; optional 'temp_c'), resonance (fundamental and harmonics for 'type': open_pipe/closed_pipe/string; 'length' m; 'n_harmonics'), impedance (Z=ρ·c for 'medium1'/'medium2'; reflection r=(Z₂−Z₁)/(Z₂+Z₁); transmission T=4Z₁Z₂/(Z₁+Z₂)²; dB TL; media: air/water/steel/concrete/wood/tissue), rt60 (Sabine RT60=0.161·V/A; 'volume' m³ + 'absorption' m²; room type label), hearing (auditory range table 20–20000 Hz; optional 'freq' to classify infrasound/audible/ultrasound), beat (|f₁−f₂|, carrier, ratio, musical interval, overtone series; 'f1'/'f2' Hz). Zero new deps.
materials_tools — Materials science and structural engineering calculations without external utilities. 8 actions: properties (default — datasheet for 18 materials: ρ/E/ν/σ_y/α/k; accepts names like steel/aluminum/copper/titanium/glass/nylon/carbon_fiber/kevlar/bone/rubber), stress (σ=F/A, ε=σ/E, δ=εL, lateral strain; 'material'/'E_gpa'+'force'+'area'), thermal (ΔL=α·L₀·ΔT, ΔV=3α·V₀·ΔT, thermal stress σ=E·α·ΔT; 'material'+'delta_t'+'length'), bending (simply-supported beam under central load: M=FL/4, σ=M·c/I, δ=FL³/(48EI), Z=I/c, I=bh³/12; 'material'+'force'+'length'+'width'+'height'), hardness (Mohs scale 1–10; engineering table HV/HB for 11 materials; optional 'material' lookup), pressure (hydrostatic P=ρgd and buoyancy F_b=ρgV; Pa/kPa/atm/psi; 'depth' m; add 'volume'+'density' for buoyancy), safety (FS=σ_yield/σ_applied with design-quality label; 'material'/'yield_mpa'+'applied_stress'), crystal (5 structures: FCC/BCC/HCP/SC/Diamond — APF, CN, atoms/cell, representative elements; optional 'lattice_a' Å for volume). Zero new deps.
astro_tools — Compute planetary positions, rise/set times, angular separations, apparent magnitudes, constellation lookups, moon phase, and Julian date conversions without external utilities. 8 actions: planet (default — heliocentric + geocentric ecliptic longitude/latitude and distance for any of 8 planets at a given date; mean orbital elements at J2000 + linear rates; Kepler's equation via Newton iteration), rise_set (civil rise and set time in UTC for an object at given RA/Dec and observer lat/lon), separation (great-circle angular separation in degrees between two RA/Dec points), magnitude (distance-modulus apparent magnitude from absolute magnitude and distance; accepts au/ly/pc units), distance (convert between au, ly, and pc), constellation (look up the IAU constellation for a given RA/Dec, or search the 88 IAU constellations by name/abbreviation), moon_phase (simplified synodic phase for a date — illumination %, phase name, New/Full/Quarter timing), julian (convert between calendar date and Julian Day Number in both directions). Zero new deps.
signal_tools — Perform DSP operations — DFT/IDFT, FIR filter design, windowing, convolution, statistical analysis, resampling, and autocorrelation — without external utilities. 8 actions: dft (default — O(n²) DFT up to 8192 samples; optional sample_rate for frequency-bin labels in Hz; outputs magnitude/phase per bin), idft (inverse DFT from real+imaginary arrays; reconstructs time-domain signal), convolve (linear convolution of signal × kernel; output length = n+m-1), fir (windowed-sinc FIR design; 'filter_type': lowpass/highpass/bandpass/bandstop; 'cutoff'/'cutoff_low'+'cutoff_high' as normalized 0–1 frequencies; 'taps' count; 'window': rectangular/hanning/hamming/blackman/bartlett/flat_top/kaiser), window (generate a named window function of N points; 'type': rectangular/hanning/hamming/blackman/bartlett/flat_top/kaiser; optional 'beta' for Kaiser), stats (signal statistics — mean, median, variance, std, RMS, min, max, energy, power, crest factor, zero crossings, Shannon entropy), resample (polyphase rational resampling; 'up'/'down' integer ratio 1–64; anti-alias FIR applied automatically), autocorr (biased autocorrelation up to 64 lags with dominant period detection). Pure Rust stdlib, zero new deps.
cors_tools — Parse, validate, generate, explain, and simulate CORS headers. 5 actions: parse (default — decode Access-Control-* headers with annotations; 'headers' object), validate (wildcard+credentials conflict, bad methods, max-age overflow; VALID/WARNINGS/INVALID), generate (build response headers for 'origin' against server config; errors on wildcard+credentials), explain (plain-English per CORS header), preflight (simulate OPTIONS — PASS/FAIL per origin/method/header with full request/response). Zero new deps.
coverage_tools — Parse, analyze, and compare code coverage reports (LCOV and Istanbul/nyc JSON) without external utilities. 4 actions: summary (default — overall line/branch/function percentages with ASCII grade bar; accepts 'text' or 'file'; auto-detects LCOV vs Istanbul JSON), files (per-file coverage table sorted by lowest line% first; optional 'min_pct' and 'max_pct' filters), uncovered (list uncovered line ranges per file; optional 'min_uncovered' threshold), compare (side-by-side diff of two reports via 'file_a'/'file_b' or 'text_a'/'text_b' — shows coverage delta per file). LCOV format: SF:/DA:/LH:/LF:/FNF:/FNH:/BRF:/BRH:/end_of_record. Istanbul JSON: {"path": {"lines": {"total","covered","pct"}, "functions": {...}, "branches": {...}}}. Zero new deps.
strace_tools — Parse and analyze Linux strace system-call trace output without external utilities. 5 actions: summary (default — syscall frequency table ranked by call count, error rate, total elapsed time; PID distribution for multi-process traces; handles plain/-f/-T/-t/-tt formats), calls (tabular listing of every call with pid/syscall/args-preview/result/elapsed; optional 'pid', 'syscall', 'error_only' filters), files (file-path operations extracted from openat/open/creat/unlink/rename/chmod calls with syscall and result), network (socket/connect/sendto/recvfrom/bind/listen calls with extracted address/port from sockaddr structs), errors (all failed calls — result < 0 or errno set — grouped by errno name with count and first-seen example). Handles [pid NNNN] prefix, timestamp prefixes, elapsed <N.NNN> suffix. Zero new deps.
cmake_tools — Parse, inspect, and validate CMakeLists.txt files without external utilities. 5 actions: info (default — cmake_minimum_required version, project name/version/languages, executable/library/option/variable/subdirectory counts), targets (all add_executable and add_library targets with source files and library type STATIC/SHARED/INTERFACE/MODULE), options (cmake_option() variables with description and default value), deps (find_package() dependencies with target_link_libraries() relationships), validate (missing cmake_minimum_required, missing project(), executables/libraries with no sources, undefined variables in target_link_libraries). Custom depth-aware CMake tokenizer; handles nested parentheses and # comments. Zero new deps.
dotnet_tools — Parse, inspect, and validate .NET project files (.csproj, .fsproj, .vbproj) and Visual Studio solution files (.sln) without external utilities. 5 actions: info (default — format detection, SDK/TargetFramework/OutputType/AssemblyName/RootNamespace, configuration list, NuGet package count, project reference count, target count), packages (all PackageReference entries with Version; optional 'filter' by name substring), targets (custom MSBuild Target blocks with DependsOnTargets and BeforeTargets/AfterTargets), references (ProjectReference entries with path and inferred project name), validate (missing Sdk attribute, missing TargetFramework, duplicate PackageReference versions, wildcard versions '*', assets file references). SLN format: lists projects by type (C#/F#/VB/solution folder), path, and GUID. Zero new deps.
maven_tools — Parse, inspect, and validate Maven pom.xml files without external utilities. 6 actions: info (default — coordinates groupId/artifactId/version/packaging, parent info, description, dep/plugin/profile counts), deps (all dependencies from with scope/classifier/type; optional 'scope' filter), managed (dependencyManagement entries — the BOM layer), plugins (build and pluginManagement plugins with version and inherited flag), profiles (activation condition, dep count, plugin count per profile), validate (missing coordinates, LATEST/RELEASE anti-patterns, version ranges, deps missing version not in BOM, duplicate deps, Java source/target mismatch, SNAPSHOT parent in release). Pure Rust XML tag extraction, zero new deps.
gradle_tools — Parse, inspect, and validate Gradle build files (build.gradle Groovy DSL and build.gradle.kts Kotlin DSL) without external utilities. 6 actions: info (default — DSL type, group/version, Java source/target, Kotlin jvmTarget, plugin count, dep count, task count, repositories detected), deps (all dependencies grouped by configuration with GAV/project/files/platform kinds; optional 'configuration' and 'filter' args), plugins (applied plugins with id/version/apply flag; Groovy and KTS forms), tasks (task definitions — name, type, dependsOn, description), properties (ext/extra properties from ext.foo or val foo by extra()), validate (missing group/version, no repositories, jcenter deprecated, deps without version, duplicate deps, deprecated compile/runtime configs). Custom comment-stripping tokenizer for both DSLs; zero new deps.
go_mod_tools — Parse, inspect, and validate Go module files (go.mod) without external utilities. 5 actions: info (default — module path, Go version, toolchain, direct/indirect dep counts and list), require (all required modules with version; 'filter' for name substring, 'indirect: true/false' to scope), replace (all replace directives; local path replacements flagged as CI risk), exclude (excluded module versions in tabular view), validate (VALID/WARNINGS/INVALID — old Go version, local replaces, pseudo-version direct deps, multiple major versions of same base module). Pass 'file' (path to go.mod) or 'gomod' (inline content). Pure Rust, zero new deps.
git_log_tools — Parse and analyze git log output without running git. 5 actions: parse (default — commit table with hash/author/date/subject; 'author' filter, 'limit'), authors (ranked leaderboard with commit count, first/last dates, unique day count), frequency (day-of-week commit bar chart + hour-of-day heatmap), files (churn ranking from --stat output: files changed, insertions, deletions per path), summary (total commits, date range, author count, busiest day/hour). Detects three formats: pipe-delimited %H|%an|%ae|%ai|%s, oneline (short-hash + subject), and traditional verbose (commit/Author/Date headers). Absorbs --stat summary lines. Pass 'log' (inline text) or 'file'. Pure Rust stdlib, zero new deps.
requirements_tools — Parse, inspect, and validate Python dependency files (requirements.txt, pyproject.toml PEP 621, pyproject.toml Poetry) without external utilities. Auto-detects format. 5 actions: info (default — total packages, pinned/loose/unpinned/editable/URL counts), list (tabular listing; 'group' and 'filter' args for scoping), validate (VALID/WARNINGS/INVALID — unpinned main deps, duplicates, editable installs in main group, URL deps, mixed pinning), extras (dependency groups for Poetry/PEP 621 or package-level extras for requirements.txt), export (re-emit as pip requirements.txt). Pass 'file' or 'requirements' (inline text). Pure Rust, zero new deps.
web_manifest_tools — Parse, validate, and inspect PWA Web App Manifest (manifest.json). 5 actions: parse (default — full field summary with icon/screenshot/shortcut counts; 'manifest' JSON or 'file' path), validate (installability: name, 192×192/512×512 icons, maskable icon, display mode; VALID/WARNINGS/INVALID), icons (tabular: src/sizes/type/purpose), screenshots (sizes/form_factor/label/platform), info (display mode, orientation, scope, theme/bg colors, advanced API declarations, shortcuts). Zero new deps.
gitignore_tools — Parse, check paths, generate, and explain .gitignore files. 4 actions: parse (patterns grouped by comment sections; [DIR]/[UNIGNORE] flags), check (IGNORED/NOT IGNORED verdict for a path; pass 'path'), generate (standard template for language: rust/node/python/go/java/dotnet/react/docker), explain (plain-English per pattern: scope, glob, negation, anchoring). Pure Rust stdlib, zero new deps.
graphql_tools — Parse, inspect, and validate GraphQL schema definitions and query documents. 4 actions: info (default — document kind, counts for types/interfaces/inputs/enums/unions/scalars/operations/fragments, root type bindings), types (list all types with fields, args, implements, deprecation flags; optional 'filter' for name substring), queries (list operations and fragments with top-level fields), validate (empty types, undefined type references, missing query root). Custom recursive-descent parser (GTok stream). Zero new deps.
license_tools — Look up, detect, compare, and list 14 SPDX software licenses. 4 actions: info (full detail: category, copyleft, patent-grant, commercial, sublicensing, conditions, permissions, limitations), detect (identify from raw license text), compare (side-by-side table for two licenses 'a'/'b'), list (all licenses by category; optional 'category' filter). Covers MIT, Apache-2.0, GPL-2.0/3.0, LGPL-2.1/3.0, MPL-2.0, AGPL-3.0, BSD-2/3-Clause, ISC, Unlicense, CC0-1.0, EUPL-1.2. Pure Rust stdlib, zero new deps.
lock_file_tools — Analyze Cargo.lock, package-lock.json (v1/v2/v3), yarn.lock, and poetry.lock files. 4 actions: info (default — format, version, total packages, multi-version count), list (all packages with name/version/source; 'limit' cap), search (name substring filter via 'query'), duplicates (packages at more than one version). Auto-detects format from filename or content heuristics. Pass 'file' or 'text'. Zero new deps — pure Rust stdlib + serde_json.
make_tools — Parse and analyze Makefiles. 4 actions: list (all targets with deps, phony flag, inline comments), explain (detail for one target — description, phony, deps, numbered commands; pass 'target'), deps (dependency graph for all or one target), vars (variable assignments with operator and value). Handles .PHONY, comment association, @ and - prefixes. Pure Rust stdlib, zero new deps.
changelog_tools — Parse, query, and validate Keep a Changelog format files. 4 actions: list (all releases with version/date/sections/item counts/YANKED), get (body of a specific version; pass 'version'), latest (most recent non-Unreleased release), validate (compliance — Unreleased section, dates, standard section names, empty releases). Pure Rust stdlib, zero new deps.
ssh_config_tools — Parse, query, explain, and validate ~/.ssh/config files. 4 actions: list (default — summary of all Host blocks with HostName/User/Port/IdentityFile/ProxyJump), get (all options for a named host; pass 'host'), explain (plain-English for ~25 SSH directives), validate (duplicate patterns, StrictHostKeyChecking=no risk, relative IdentityFile). Auto-detects: host present → get. Pure Rust stdlib, zero new deps.
docker_compose_tools — Parse, inspect, and validate docker-compose.yml files without Docker. 7 actions: services (default — image, ports, restart, depends_on, counts), inspect (full service detail including healthcheck; pass 'service'), ports (host:container mappings with well-known port labels), volumes (named volumes + bind-mount classification), networks (driver + service membership), env (env vars with secrets redacted; pass 'service' to filter), validate (missing image/build, undefined depends_on, privileged mode, host network). Uses serde_yaml (existing dep).
nginx_conf_tools — Parse, inspect, and validate nginx.conf files. 5 actions: list (default — server blocks with server_name/listen/root/SSL/location count), inspect (full server block detail with location blocks; pass 'server'), locations (location blocks with proxy_pass/root/alias; optional 'server' filter), directives (global + http-context directives + upstream blocks), validate (missing server_name, SSL without cert, proxy without Host header). Custom tokenizer, zero new deps.
openapi_tools — Parse, query, search, and validate OpenAPI 3.x / Swagger 2.x specs (YAML or JSON). 5 actions: info (default — title, version, servers, endpoint/schema counts, tags, auth schemes), endpoints (all methods + paths + summaries; pass 'tag' to filter), schemas (schema names + types + properties with required flags; pass 'schema' to filter), search (filter by path/summary/operationId/tag/method; pass 'query'), validate (missing info, empty paths, missing summaries/operationIds, duplicates, deprecated). Uses serde_yaml (existing dep).
dockerfile_tools — Parse, inspect, and validate Dockerfiles. 3 actions: info (default — base image/tag per stage, ports, USER, WORKDIR, CMD, instruction counts), layers (all instructions in order), validate (latest tag, root user, ADD, curl|sh pipe, secrets in ENV/ARG, missing CMD, no HEALTHCHECK). Zero new dependencies.
k8s_tools — Parse, inspect, and validate Kubernetes manifests (Deployment, Service, Pod, StatefulSet, DaemonSet, Job, CronJob, Ingress, ConfigMap). 4 actions: info (default — kind/name/namespace/labels, replica/selector/port summary), containers (image, ports, resource limits, probes, security context per container), volumes (ConfigMap/Secret/PVC/HostPath/EmptyDir/NFS types with source detail), validate (missing fields, latest image tag, no resource limits, privileged, no runAsNonRoot, missing probes, hostPath, single replica). Uses serde_yaml.
github_actions_tools — Parse, inspect, and validate GitHub Actions workflow YAML. 5 actions: info (default — name, triggers, per-job overview), jobs (detailed listing with runner, steps, needs, matrix, concurrency), steps (per-job step list with uses/run/if; optional 'job' filter), triggers (event filters, cron schedules, workflow_dispatch inputs, concurrency group), validate (missing triggers, missing runs-on, undefined needs, steps without uses/run, missing permissions). Uses serde_yaml (existing dep).
systemd_tools — Parse, inspect, and validate systemd unit files (.service/.timer/.socket). 4 actions: info (default — unit type, description, all section summaries), service (exec commands, identity, restart policy, environment, security hardening directives), timer (trigger schedule with human-readable explanations for named shortcuts, Persistent flag), validate (missing Description, missing ExecStart, forking without PIDFile, no Restart=, running as root, missing security hardening, missing [Install]). Zero new dependencies.
terraform_tools — Parse, inspect, and validate Terraform HCL files (.tf) without external utilities. 5 actions: info (default — required_version, providers with source/version, block counts), resources (list resource blocks with key attributes), variables (type, description, default, SENSITIVE flag), outputs (value expression, SENSITIVE flag), validate (missing required_version, permissive provider versions, hardcoded credentials, sensitive names without sensitive=true). Custom character-level HCL parser. Zero new dependencies.
package_json_tools — Parse, inspect, and validate package.json files without external utilities. 4 actions: info (default — name, version, license, author, engines, dep/script counts), scripts (all npm scripts; optional 'filter'), deps (all dependency sections with version and flag annotations; optional 'kind': prod/dev/peer/optional), validate (missing fields, no engines, wildcard versions, http:// deps, missing test/build scripts, no files whitelist, duplicate deps). Uses serde_json (existing dep).
tsconfig_tools — Parse, inspect, and validate tsconfig.json files (with JSONC comment stripping) without external utilities. 5 actions: info (default — extends chain, compilerOptions summary with target/module/strict/outDir/baseUrl, include/exclude/files counts), compiler (all compilerOptions organized by category: type checking, module, emit, JS support, language/environment, paths), includes (include/exclude/files/paths arrays with pattern counts), references (project reference list with path and composite flag; detects mismatches), validate (best-practice checks: strict not enabled, missing outDir, noEmit+outDir conflict, paths without baseUrl, deprecated moduleResolution: node, experimentalDecorators without emitDecoratorMetadata, composite missing on referenced projects). Strips // and /* */ comments before parsing. Pass 'tsconfig' (inline JSONC) or 'file' (path). Zero new dependencies.
eslint_tools — Parse, inspect, and validate ESLint configuration files (legacy .eslintrc.json and flat eslint.config.js) without external utilities. Auto-detects format from JSON structure (array = flat config, object = legacy). 5 actions: info (default — format, root flag, parser, environments, globals count, plugins, extends, rule count, overrides count), rules (tabular listing with error/warn/off severity icons; optional 'filter' for name substring), plugins (all configured plugins with prefix and rule-import note), extends (base configs in order), validate (missing parser for TypeScript rules, @typescript-eslint rules without the plugin configured, react rules without react plugin, duplicate extends, security/unicorn plugins without their rule prefix). Pass 'config' (inline JSON) or 'file' (path). Zero new dependencies.
prettier_tools — Parse, inspect, validate, and explain Prettier configuration files (.prettierrc, .prettierrc.json, .prettierrc.yaml) without external utilities. Auto-detects JSON vs YAML format. 4 actions: info (default — all configured options with current values and defaults-not-configured), validate (deprecated options jsxBracketSameLine/experimentalTernaries, invalid endOfLine/trailingComma/quoteProps/arrowParens/proseWrap values, insertPragma+requirePragma conflict, rangeStart>rangeEnd, unknown options, overrides missing files/options), explain (plain-English per-option description with Set-to/Default/Effect), overrides (file-pattern override blocks with option listings). Pass 'config' (inline JSON or YAML) or 'file' (path). Zero new dependencies.
jest_tools — Parse, inspect, and validate Jest configuration (jest.config.json, or 'jest' key in package.json) without external utilities. Auto-detects package.json by checking for 'name'+'version' keys. 6 actions: info (default — preset, testEnvironment, transforms, module mappings, setupFiles, coverage flag), testmatch (test file patterns and ignore paths; shows defaults when not configured), transforms (file transformer rules with options), modules (moduleNameMapper entries, moduleDirectories, setupFiles), coverage (collectCoverage, reporters, directory, provider, thresholds), validate (conflicting testMatch+testRegex, testTimeout=0, threshold without collectCoverage, ts-jest preset+transform redundancy, unknown keys). Pass 'config' (inline JSON) or 'file' (path). Zero new dependencies.
babel_tools — Parse, inspect, and validate Babel configuration files (babel.config.json, .babelrc, .babelrc.json, .babelrc.yaml, or 'babel' key in package.json) without external utilities. Auto-detects JSON vs YAML; auto-detects package.json by checking for 'name'+'version' keys. 5 actions: info (default — preset/plugin/env/override counts, tables with options annotation), presets (numbered preset listing with options from [name, {opts}] form), plugins (numbered plugin listing with options), env (environment-specific blocks: production/development/test with their presets/plugins), validate (@babel/preset-env without targets WARN, deprecated babel-preset-es2015/react/stage-x WARNs, deprecated transform-class-properties/transform-object-rest-spread INFOs, duplicate preset/plugin detection WARNs). Pass 'config' (inline JSON or YAML) or 'file' (path). Zero new dependencies.
stylelint_tools — Parse, inspect, and validate Stylelint configuration files (.stylelintrc, .stylelintrc.json, .stylelintrc.yaml, or 'stylelint' key in package.json) without external utilities. Auto-detects JSON vs YAML; note JS config files (.js/.mjs/.cjs) cannot be statically parsed. 5 actions: info (default — rule/plugin/extends/override counts, extends chain, rule severity summary error/warning/off), rules (grouped by severity with options from [severity, opts] form), plugins (numbered list), extends (inheritance chain with base-to-top ordering note), validate (no rules/extends/plugins warning, deprecated v15+ rules, SCSS rules without stylelint-scss plugin, order rules without stylelint-order plugin, invalid severity values, unknown top-level keys, missing extends baseline suggestion). Pass 'config' (inline JSON or YAML) or 'file' (path). Zero new dependencies.
sql_migrate_tools — Analyze SQL migration files for risk, operation types, and safety. 4 actions: analyze (default — per-statement risk label with overall verdict: SAFE/LOW/MEDIUM/HIGH/CRITICAL, critical and high-risk counts), risk (show only medium/high/critical operations for pre-flight review), ops (operation-type summary table + detailed listing), validate (transaction wrapping, destructive-ops-without-BEGIN warning, CONCURRENTLY-in-transaction detection). 5-tier risk: Safe (CREATE TABLE, BEGIN/COMMIT), Low (INSERT, CREATE INDEX CONCURRENTLY), Medium (UPDATE with WHERE, CREATE INDEX), High (DROP TABLE, ALTER TABLE DROP COLUMN, DELETE with WHERE, TRUNCATE), Critical (DROP without IF EXISTS, DELETE without WHERE, DROP DATABASE). Zero new dependencies.
sql_tools — Parse, explain, and validate SQL statements (DDL and DML) without external utilities. 4 actions: parse (default — statement types, referenced tables, join count, subquery flag), tables (CREATE TABLE definitions with columns, types, constraints, FK relationships), explain (plain-English per-statement explanation), validate (SELECT *, DELETE/UPDATE without WHERE, implicit cross joins, NOT IN NULL risk, leading-wildcard LIKE, CREATE TABLE without PK). Custom tokenizer with comment stripping. Zero new dependencies.
proto_tools — Parse, inspect, and validate Protocol Buffer (.proto) files without external utilities. 4 actions: info (default — syntax, package, imports, file options, message/enum/service counts), messages (field names/types/numbers/labels/options + enum values), services (RPC signatures with unary/streaming classification), validate (unrecognised syntax, missing package, duplicate field numbers, reserved range violations, proto2 required fields, proto3 enum first value ≠ 0). Zero new dependencies.
pem_tools — Inspect, decode, and validate PEM-encoded certificates, certificate chains, and private keys without a crypto library. 3 actions: info (default — block type, subject/issuer DN, validity window, expiry countdown, SANs, key algorithm + RSA bit size, CA flag), chain (ordered chain display with issuer→subject linkage and completeness check), validate (expired/expiring-soon, SHA-1/MD5 weakness, RSA < 2048 bits, missing SANs, private key bundled with cert, out-of-order chain). Custom pure-Rust base64 + minimal DER/ASN.1 parser. Zero new dependencies.
env_schema_tools — Validate a .env file against a .env.example schema. 4 actions: validate (default — VALID/INVALID verdict, missing required keys, empty required values, extra keys), diff (absent keys), required (required vs optional key listing), info (coverage percentage). Placeholder detection for empty values and CHANGE_ME/<your-...>/xxx/todo patterns. Zero new dependencies.
tls_tools — Parse and decode TLS records and handshake messages from hex bytes without external utilities. 5 actions: parse (default — auto-detect record type and decode; content-type, version, length, handshake type), client_hello (full ClientHello breakdown: all cipher suites graded STRONG/GOOD/WEAK/BROKEN, all extensions with explanations, SNI hostname, ALPN protocols, Heartbleed and GREASE detection), server_hello (chosen cipher suite grade, negotiated TLS version from supported_versions extension), cipher_suites (enumerate and grade all cipher suites from a ClientHello hex), extensions (list all extensions with type, length, and explanation). Pass 'hex' for raw hex bytes or 'file' for a binary file. Zero new dependencies.
protobuf_wire_tools — Decode raw protobuf wire format bytes without a .proto schema. 4 actions: decode (default — recursive field-by-field decode; field number, wire type, and value; auto-expands nested messages and labels UTF-8 strings), fields (field number + wire type summary table), strings (extract all UTF-8 string candidates from length-delimited fields), explain (verbose: all type interpretations per field — uint64/int64/sint64/bool/float for wire type 0; raw hex + UTF-8 attempt for wire type 2). Optional 'depth' parameter (default 3) controls nested message recursion. Pass 'hex' for hex-encoded bytes or 'file' for a binary file. Zero new dependencies.
ssh_key_tools — Parse and inspect SSH public keys without external utilities. 4 actions: info (default — key type, bit size, SHA256/MD5 fingerprints, comment, security assessment), fingerprint (SHA256 and MD5 fingerprints only), validate (VALID/INVALID verdict with weak-key warnings for DSA and RSA<2048), authorized_keys (tabular multi-key summary for an authorized_keys file — type/bits/fingerprint/comment per key). Handles ssh-rsa, ssh-dss, ecdsa-sha2-nistp256/384/521, ssh-ed25519. Reads raw wire format from base64 payload. Options prefix on authorized_keys lines handled transparently. Zero new dependencies.
wireguard_tools — Parse, inspect, and validate WireGuard configuration files without external utilities. 4 actions: info (default — interface summary with Address/ListenPort/DNS/MTU and peer table with public key prefix/endpoint/allowed IPs), peers (detailed per-peer listing), validate (VALID/INVALID verdict — Curve25519 key format, CIDR notation, endpoint host:port, AllowedIPs presence; counts issues), keys (redacted key presence summary showing which interface/peer slots are populated without exposing secrets). Handles [Interface] and [Peer] sections, comment-based peer names. Zero new dependencies.
prometheus_tools — Parse and analyze Prometheus/OpenMetrics text exposition format without external utilities. 5 actions: parse/list (default — metric family table with type, sample count, and help text), metrics/detail (per-family breakdown with sample values and label sets; 'filter'/'limit' args), labels (label name distribution — occurrence counts, unique value counts, and top values), filter (metric families by name substring), stats (totals by type, unique label cardinality). Custom label parser handles escaped chars. Two-pass parsing correctly attributes histogram _bucket/_sum/_count suffixes to their base family. Input: 'text'/'metrics'/'input' for inline, 'file' for file path. Zero new dependencies.
http_cache_tools — Parse, explain, and analyze HTTP Cache-Control and caching headers without external utilities. 4 actions: parse (default — directive-by-directive breakdown with conflict detection: no-store+max-age, public+private, immutable without max-age; CACHEABLE/CONDITIONAL/NOT CACHEABLE summary), analyze (freshness calculation — s-maxage overrides max-age; stale-while-revalidate grace window; must-revalidate staleness note; pass 'age' seconds), etag (ETag matching: weak vs strong ETags, If-None-Match including * wildcard; 304 vs 200 verdict), vary (Vary field explanations; Cookie/Authorization/User-Agent fragmentation risk warnings; cache key formula). Pass 'request: true' for request-side directives. Zero new dependencies.
webhook_tools — Verify, generate, and explain webhook HMAC-SHA256 signatures for GitHub, Stripe, Slack, Shopify, and generic endpoints. 3 actions: verify (default — VALID/INVALID verdict with expected value on mismatch; constant-time XOR-fold comparison to prevent timing attacks), generate (produce provider-specific header value), explain (all providers' header names, signing algorithms, payload formats, and security notes). Providers: GitHub (sha256=hex of body), Stripe (t=ts,v1=hex of ts.body), Slack (v0=hex of v0:ts:body), Shopify (base64 of HMAC of body). Uses existing hmac/sha2/base64 dependencies. Zero new dependencies.
jwk_tools — Parse, inspect, validate, and compute RFC 7638 thumbprints for JSON Web Keys (JWK and JWKS). 4 actions: info (default — key type RSA/EC/OKP/oct, bit size, algorithm, intended use, key ID, and RFC 7638 SHA-256 thumbprint; handles JWKS {"keys":[...]}), validate (required fields per key type; weak RSA<2048/oct<128 bit warnings; use vs key_ops conflict detection), thumbprint (RFC 7638 SHA-256: canonical sorted minimal JSON → SHA-256 → base64url; also shows hex), list (tabular JWKS summary). Uses existing sha2/base64 dependencies. Zero new dependencies.
gitlab_ci_tools — Parse, inspect, and validate .gitlab-ci.yml GitLab CI/CD configurations without external utilities. 4 actions: info (default — stages pipeline with job mapping, job count, template count, global image/variables/includes, workflow rules), jobs (per-job breakdown: stage, image, extends, when, tags, parallel, script/before/after line counts, needs, rules, artifacts, variables; 'stage' filter), stages (stage list with job counts; flags undeclared stage references), validate (missing script/trigger, undeclared stages, unknown needs references, deprecated only/except, image:latest, empty rules). Handles hidden template jobs (. prefix). Uses existing serde_yaml dependency. Zero new dependencies.
junit_tools — Parse and analyze JUnit/xUnit XML test result files without external utilities. 4 actions: parse (default — suite overview with total tests/passed/failed/errors/skipped/time; per-suite breakdown with failing test names and first-line message highlighted), failures (only failing and erroring test cases with status, class name, message, and up to 12 lines of stack trace), summary (aggregate stats with ASCII pass-rate progress bar and PASSED/FAILED verdict), list (all test cases with status icon, time, and class::name; optional 'status' filter: passed/failed/error/skipped). Input: 'xml' for inline JUnit XML, 'file' for .xml path. Uses existing quick-xml dependency. Zero new dependencies.
ansible_tools — Parse and inspect Ansible playbooks without external utilities. 5 actions: parse (default — play overview with hosts, task/handler/var/role counts, module usage frequency; supports pre_tasks/post_tasks), tasks (all tasks with module name, display name, tags, when, notify, loop flag, delegate_to; optional 'tag' filter), vars (all variables from vars:/vars_files: across all plays), handlers (all handlers with module and notify/listen info), validate (warn on: missing hosts, missing task names, bare variable usage, become_user without become). Handles block/rescue/always nesting. Uses existing serde_yaml dependency. Zero new dependencies.
grpc_tools — Look up gRPC status codes and well-known metadata headers without external utilities. 4 actions: status (default — look up code by number 0–16 or name like NOT_FOUND/UNAVAILABLE; shows code, name, HTTP equivalent, summary), explain (detailed breakdown: description, common causes, fix steps, retryability classification — CANCELLED/DEADLINE_EXCEEDED/RESOURCE_EXHAUSTED/UNAVAILABLE=retryable with backoff; ABORTED=restart transaction; others=not retryable), list (all 17 gRPC status codes from OK to UNAUTHENTICATED with HTTP equivalent and one-line summary), headers (13 well-known gRPC metadata headers with direction request/response/trailer and description). Zero new dependencies.
haproxy_tools — Parse, inspect, and validate HAProxy configuration files without external utilities. 5 actions: parse (default — overview: global directives, defaults, frontend/backend/listen counts), frontends (per-frontend: bind addresses, ACL rules with name and pattern, use_backend/default_backend), backends (per-backend: balance algorithm, option directives, server list with name/address/options), servers (flat tabular listing across all backends), validate (warn on: frontends without bind, use_backend referencing undefined backend, unreferenced backends, duplicate section names). Handles inline # comments and multi-word directives. Zero new dependencies.
helm_tools — Inspect Helm charts without external utilities — no helm binary or Kubernetes cluster required. 5 actions: chart (default — Chart.yaml metadata: name, version, appVersion, apiVersion, type, description, keywords, maintainers, dependency count), values (top-level keys from values.yaml with type label and value preview; type distribution summary; detected features: image/ingress/service/resources/replicas/autoscaling/serviceAccount/security), deps (dependency table: name, version, repository, condition, alias — reads Chart.yaml dependencies or requirements.yaml), validate (required field checks, non-semver version warning, apiVersion v1 deprecation warning), templates (list files under templates/ with detected Kubernetes resource type; requires chart_dir). Input: 'chart_dir' for chart root path; or 'chart_yaml'/'values_yaml' for inline YAML. Uses existing serde_yaml dependency. Zero new dependencies.
cvss_tools — Score and decode CVSS v3.1 vectors without external utilities. 4 actions: decode (default — parse a CVSS:3.1/... vector string into all 8 metric abbreviations with full names and selected values; shows Base Score and severity label), score (compute the numeric Base Score from a vector or from individual metric fields: AV/AC/PR/UI/S/C/I/A), severity (classify a numeric score as None/Low/Medium/High/Critical per NIST thresholds), compare (side-by-side comparison of two vectors with per-metric diff and score delta). Zero new dependencies — pure Rust stdlib.
nmap_tools — Parse and analyze nmap XML output without external utilities — no nmap binary required at runtime. 5 actions: parse (default — per-host port table with open/closed/filtered icons, OS guess, and service versions), hosts (summary table of all hosts with IP, hostname, status, open port count, OS), ports (flat sorted port list across all hosts filtered by state, default open), services (service distribution table — service name, count, and host:port samples), summary (scan totals: hosts up/down, open/filtered port counts, top services, OS identification count). Accepts 'xml' for inline nmap XML or 'file' for a .xml path. Pure line-by-line XML state machine. Zero new dependencies.
postman_tools — Parse and analyze Postman Collection v2.1 files without external utilities. 5 actions: parse (default — tabular METHOD/NAME/FOLDER/AUTH/URL view with folder, method, and query filters), requests (detailed per-request view: URL, auth, body type, headers count, params count, test/pre-request script flags), folders (folder hierarchy with request counts), vars (collection-level variables with sensitive values redacted), summary (totals: request count, folder count, variables, with-tests count, HTTP method breakdown, auth type breakdown). Accepts 'json' for inline JSON or 'file' for a .json path. Zero new dependencies.
ldif_tools — Parse and analyze LDIF (LDAP Data Interchange Format) files without external utilities. 5 actions: parse (default — entries with DN, objectClass, changetype, and attributes; sensitive attributes like userPassword redacted), search (filter entries by keyword across DN and attribute values; shows DN/cn/uid/mail summary), attrs (attribute coverage table — attribute name, count, percentage with bar), schema (schema entries or objectClass distribution fallback), summary (entry count, avg attributes, objectClass breakdown, directory domain inference from DC components). Handles RFC 2849 line unfolding, base64-encoded values (::), and URL references (<). Accepts 'ldif'/'text' for inline content or 'file' for a .ldif path. Zero new dependencies.
iptables_tools — Parse and analyze iptables-save output without external utilities. 5 actions: parse (default — tabular rule listing per table/chain with target icons ✓ ACCEPT / ✗ DROP / L LOG / ⇄ NAT; filter by table, chain, or target), chains (chain summary: policy, packet/byte counters, and rule count per chain), stats (rule count by table and target type with percentage bars), summary (total rules, chain policies, broad-accept and FORWARD-accept warnings), security (flag suspicious rules: broad ACCEPT without src/dst/port, FORWARD blanket accepts, INPUT accepting all, disabled logging). Handles *table headers, :CHAIN POLICY [packets:bytes] lines, and -A rule lines. Accepts 'text' for inline iptables-save output or 'file' for a path. Zero new dependencies.
spdx_tools — Parse, validate, and analyze SPDX license expressions and identifiers without external utilities. 5 actions: info (default — full detail for a license by SPDX ID or name: category, OSI approval, FSF approval, copyleft flag, deprecated flag), parse (parse a compound SPDX expression like 'MIT AND Apache-2.0 OR GPL-2.0-only' into an AST with compatibility analysis and copyleft detection), validate (VALID/INVALID verdict for an expression string), list (browse all 52 known SPDX licenses; optional 'category' filter: permissive/copyleft/weak-copyleft/public-domain/other), check (check if an expression satisfies a target license policy). Covers all major open-source licenses. Zero new dependencies.
aws_tools — Parse and analyze AWS ARNs and S3 URLs without external utilities or AWS credentials. 4 actions: arn (default — decode an ARN: partition, service, region, account ID, resource type hint with category), s3 (parse an S3 URI or bucket URL — bucket name, object key, region, URL style virtual-hosted/path), region (look up an AWS region by code or name; omit arg for all 33 regions), service (look up an AWS service by code or name; omit arg for all 42 services). Accepts 'arn' string, 's3://' URIs, 'bucket.s3.region.amazonaws.com' virtual-hosted URLs. Zero new dependencies.
curl_tools — Parse, build, and convert curl commands without external utilities. 3 actions: parse (default — decode a curl command string into method, URL, headers, body, auth, flags, and options; authorization values redacted), build (generate a curl command from 'url', 'method', 'headers', 'body', 'auth_user'/'auth_pass', 'insecure', 'follow_redirects', 'timeout' options), convert (translate a curl command to Python requests, Go net/http, or JavaScript fetch; pass 'language': python/go/javascript). Shell tokenizer handles single/double quotes and backslash line continuations. Pass 'command' for the curl command string. Zero new dependencies.
oauth_tools — Work with OAuth 2.0 flows, PKCE, authorization URLs, and tokens without external utilities or network calls. 5 actions: pkce (default — generate a PKCE code_verifier + code_challenge pair per RFC 7636; optional 'verifier' override; 'method': S256 default or plain), grant (explain an OAuth 2.0 grant type with flow steps, use case, and security notes; 'grant_type': authorization_code/client_credentials/device_code/implicit/password/refresh_token), url (build an authorization URL from client_id/redirect_uri/scope/state; auto-generates PKCE pair; pass 'auth_endpoint' for the IdP URL), token (decode a JWT access token without signature verification — header algorithm, claims, exp/iat human-readable timestamps), explain (plain-English OAuth 2.0 concept overview). Zero new dependencies — uses sha2 + rand (already in Cargo.toml).
saml_tools — Parse and inspect SAML 2.0 assertions and responses without external utilities. 4 actions: parse (default — full SAML document summary: issuer, subject NameID/format, conditions NotBefore/NotOnOrAfter/audience, attributes table, assertion ID, status code), attributes (extract all SAML attribute name→value pairs), validate (check NotBefore/NotOnOrAfter validity window against current system time; flag unsigned assertions), explain (plain-English breakdown of each SAML field and its security role). Input: 'xml' for raw SAML XML, 'base64' for base64-encoded SAMLResponse (HTTP POST binding), 'file' for a file path (auto-detects base64 content). Uses quick-xml (already in Cargo.toml). Zero new dependencies.
multipart_tools — Parse, inspect, validate, and build multipart/form-data (RFC 2046) bodies without external utilities. 6 actions: parse (default — tabular part summary: name/content-type/size/filename), parts (detailed per-part with all headers and body preview), files (only file-upload parts with filename=), form (only non-file form fields as name=value), validate (RFC 2046 compliance: boundary length ≤70 chars, final delimiter present, Content-Disposition on all parts), build (generate well-formed multipart body from fields array of {name, value, filename?, content_type?} objects). Boundary auto-detected from first 1 KB or pass boundary= explicitly or content_type= with full header string. Zero new dependencies — pure Rust stdlib + serde_json.
openid_tools — Inspect OpenID Connect (OIDC) discovery documents, ID tokens, and userinfo responses without external utilities. 5 actions: discover (default — all endpoints: authorization/token/userinfo/jwks/end_session; response types; grant types; scopes; claims; signing algorithms; PKCE methods), id_token (decode OIDC ID token JWT: core claims iss/sub/aud/azp/nonce/acr/amr; time claims iat/exp/auth_time with expiry status; at_hash/c_hash/s_hash; profile and custom claims; signature NOT verified), userinfo (parse userinfo JSON and explain each standard claim with its scope source), scopes (explain all 6 OIDC scopes with full claim lists), client (generate Python authlib client config from discovery document with PKCE setup and env var template). Zero new dependencies — pure Rust stdlib + serde_json.
exif_tools — Parse EXIF/IPTC metadata from JPEG and TIFF images without external tools. 4 actions: info (default — all EXIF fields grouped by IFD: Image, Camera Settings, GPS), camera (make/model/lens/exposure/ISO/focal length summary), gps (latitude, longitude, altitude, speed, bearing, and Google Maps URL when GPS IFD is present), thumbnail (detect embedded IFD1 thumbnail with dimensions). Accepts 'file' (JPEG or TIFF path) or 'hex' (hex-encoded bytes). Pure Rust IFD parser handles little-endian and big-endian TIFF, JPEG APP1 scanning, and sub-IFD pointers (ExifIFD/GPSIFD/IFD1). Zero new dependencies.
office_tools — Inspect DOCX, XLSX, and PPTX Office Open XML documents without Microsoft Office. 4 actions: info (default — format detection, core metadata: title/creator/dates, document statistics: pages/words for DOCX, sheet count for XLSX, slide count for PPTX), content (extract text for DOCX, sheet names + cell counts for XLSX, slide titles for PPTX), structure (list all ZIP parts with sizes), validate (check required Open XML parts are present). Accepts 'file' path to a .docx, .xlsx, or .pptx file. Uses the existing 'zip' crate — zero new dependencies.
font_tools — Inspect TrueType (TTF), OpenType (OTF), and WOFF/WOFF2 font files without external tools. 4 actions: info (default — font format, family name, subfamily, full name, PostScript name, version, copyright, glyph count, units per em, weight class, embedding/license flags, style flags from OS/2 and head tables), names (all name table entries with platform, name ID label, and decoded string value), tables (SFNT table directory with tag, offset, length, and checksum), chars (character coverage: total mapped code points, cmap format, Latin/Greek/CJK range presence). Accepts 'file' (path to .ttf, .otf, .woff, or .woff2) or 'hex' (hex-encoded bytes). WOFF containers are unwrapped to SFNT before parsing; WOFF2 handled gracefully. Zero new dependencies — pure Rust stdlib.
svg_tools — Parse, inspect, and validate SVG (Scalable Vector Graphics) documents without external utilities. 6 actions: info (default — width/height/viewBox, xmlns, SVG version, title, desc, top-level element count, and detected SVG feature flags: defs/symbols/use/clipPath/mask/filter/animation/text/image), elements (element frequency table sorted by count), ids (all id= attributes with element type for selector and animation targeting), links (external href/xlink:href references on , , , , and CSS url() in style attributes), styles (inline style= and class= usage plus embedded <style> block size), validate (viewBox/xmlns checks, missing <title>/ accessibility warnings, <script> XSS risk, deprecated xlink:href/xml:space attributes, embedding risk, duplicate id detection). Accepts 'text'/'svg' for inline SVG or 'file' for a .svg path. Zero new dependencies — custom char-level XML tokenizer, pure Rust stdlib.
image_tools — Parse image file metadata (PNG, JPEG, GIF, WebP, BMP) without external utilities. 5 actions: info (default — format, dimensions, color type, bit depth, DPI, animation frame count, ICC/sRGB/EXIF/XMP presence, file size, embedded text tags), dimensions (width x height and aspect ratio), color (color mode — RGB/RGBA/Grayscale/Palette/etc., bit depth, palette size, alpha/transparency, DPI, color space hints), metadata (format-specific embedded content: JFIF density, EXIF/XMP/ICC presence, sRGB intent, gamma, PNG text chunks, GIF comments, WebP chunk flags), validate (format-specific structural checks: magic bytes, IHDR/SOF0 presence, PLTE consistency, dimension sanity, BMP header integrity). Zero new dependencies — pure Rust stdlib.
audio_file_tools — Parse audio file metadata (WAV, MP3 with ID3v1/v2, FLAC, Ogg Vorbis/Opus) without external utilities. 3 actions: info (default — format/encoding, channels, sample rate, bit depth, duration estimate, bitrate, embedded tags), tags (ID3 or Vorbis comment fields only: title, artist, album, year, genre, track, composer, BPM, etc.), validate (WAV: byte-rate consistency, channel/depth sanity; MP3: MPEG frame header presence, tag completeness; FLAC: STREAMINFO validity; Ogg: codec detection, comment presence). Zero new dependencies — pure Rust stdlib.
video_file_tools — Parse video file metadata (MP4/MOV, MKV/WebM, AVI) without external utilities or ffprobe. 4 actions: info (default — format, duration, overall bitrate, video/audio track counts, container brand/version), streams (per-track breakdown with codec, dimensions, frame rate, bitrate, language tag for video; codec, channels, sample rate, language for audio), metadata (embedded tags: title, artist, comment, encoder, creation date), validate (magic bytes, key container atom/chunk presence). Handles MP4/MOV box walking, EBML variable-length encoding for MKV/WebM, and RIFF chunk structure for AVI. Accepts 'file' path or 'hex' hex-encoded bytes. Zero new dependencies — pure Rust stdlib.
pdf_tools — Parse and inspect PDF file metadata and structure without external utilities. 5 actions: info (default — PDF version, page count, file size, page dimensions in pt/mm/in with A4/Letter/Legal detection, linearization, xref type), pages (page count and MediaBox dimensions), metadata (Info dictionary: title, author, subject, keywords, creator, producer, creation date, mod date — dates decoded from PDF D:YYYYMMDDHHmmSS format), structure (object count, xref type cross-reference/stream, linearized flag, %%EOF position), validate (PDF magic header, %%EOF marker, page count sanity). Decodes both literal and hex-encoded PDF strings; handles UTF-16 BOM for Unicode fields. Accepts 'file' path or 'hex' hex-encoded bytes. Zero new dependencies — pure Rust stdlib.
epub_tools — Parse and inspect EPUB 2/3 ebook files without external utilities. 5 actions: info (default — EPUB version, title, author, publisher, language, identifier, cover present flag, spine item count, TOC entry count, manifest file count), metadata (full OPF Dublin Core fields: title, language, identifier, date, publisher, subject, description, rights, all authors), toc (table of contents from NCX or nav.xhtml, numbered list of chapter titles), spine (reading order of content documents with resolved hrefs), validate (mimetype entry present, container.xml present, dc:title/dc:language/dc:identifier present, non-empty spine). Accepts 'file' (path to .epub) or 'hex' (hex-encoded EPUB bytes). Pure Rust ZIP central-directory parser; only stored entries are extractable (compressed entries noted). Zero new dependencies — pure Rust stdlib.
sbom_tools — Parse and analyze Software Bill of Materials (SBOM) files in CycloneDX JSON, SPDX JSON, and SPDX tag-value formats without external utilities. 5 actions: info (default — SBOM format, spec version, serial number, component count, vulnerability count, tool name, timestamp, metadata component name), components (tabular listing of all components with name/version/license/purl/type; optional 'limit'), licenses (unique license summary sorted by usage count — shows which components use each license), vulnerabilities (vulnerability table with ID/severity/description/affected component), validate (required fields for each format: bomFormat/specVersion/components for CycloneDX; spdxVersion/SPDXID/packages for SPDX JSON; SPDXVersion/PackageName for tag-value; VALID/WARNINGS/INVALID verdict). Accepts 'text' for inline SBOM content or 'file' for a path. Zero new dependencies — pure Rust stdlib + serde_json.

7. Stateful Local Workflow

Hematite is built for repeated project use, not one-off prompts.

Lightweight session handoff: Hematite carries forward compact task/project signal instead of replaying full chat residue by default
Architect -> code handoff: /architect can persist a compact implementation brief in .hematite/PLAN.md and session memory so /code can resume from a structured plan
Safe Gemma 4 native layer: Gemma 4 runs get narrow argument normalization for malformed tool calls without changing Hematite's broader conversation protocol
Gemma numeric-arg hygiene: float-shaped tool arguments like limit: 50.0 or context: 5.0 are normalized so bounded inspections stay bounded
Opt-in Gemma native formatting: .hematite/settings.json can enable Gemma-native request shaping for Gemma 4 models without changing the default path for other models
Provider-side prompt preflight: oversized requests can be blocked before they go to LM Studio, reducing silent near-ceiling hangs
Structured runtime failures: degraded provider turns, context-window overruns, blocked tool calls, and repeated tool loops are surfaced as classified operator states instead of ad hoc error prose
One-shot provider recovery: empty or degraded LM Studio turns get one automatic retry before Hematite escalates the structured failure
Streaming-path failure discipline: plain text generations and startup flows now surface structured provider failures instead of raw stream errors or silent empty completions
LM Studio context-mismatch detection: provider errors like n_keep >= n_ctx are classified as context_window failures so Hematite points at the real budget mismatch instead of mislabeling them as generic provider degradation
Budgeted recursive summaries: compaction summaries are normalized, deduplicated, and clamped to a real line/character budget so recursive context carry-forward stays cheaper and more stable on small local contexts
Session persistence: active state is saved under the resolved runtime-state directory (.hematite/ for normal project workspaces, ~/.hematite/ for sovereign OS directories)
Task awareness: local task and planning files can shape agent behavior
Instruction discovery: project rules are loaded automatically from workspace instruction files
Sticky workflow modes: /ask, /code, /architect, /read-only, /teach, and /auto let the operator choose between analysis, implementation, plan-first, hard read-only, and grounded walkthrough behavior
Ultra-Deterministic Teleportation: Seamlessly transition between folders. When moving to a new workspace, Hematite spawns a fresh, pre-navigated terminal, preserves the source window's size and position, skips the splash screen, and gracefully closes the original shell or tab to maintain workstation hygiene. New sessions include a Teleportation Handshake greeting that confirms the origin context and transition reasoning.
Teacher mode (/teach) — inspects real machine state first via inspect_host, then delivers a numbered step-by-step walkthrough for any admin/config/system task; never executes write operations itself; covers driver installs, Group Policy, firewall rules, SSH key generation, WSL setup, service config, Windows activation, registry edits, scheduled tasks, and disk cleanup
Grounded storage walkthroughs: teacher mode can now build step-by-step remediation around docker_filesystems and wsl_filesystems, so mount/path/storage fixes start from observed bind mounts, VHDX growth, and bridge health rather than generic advice

8. Voice and TUI Integration

Hematite includes built-in operator experience features that are part of the product, not bolted on later.

Integrated TUI: dedicated chat, reasoning, status, and input surfaces
Self-contained TTS: Kokoro voice engine (311 MB model, 54 voices, ONNX Runtime 1.24.2) is statically linked into the binary — no install, no Python, no system DLL dependency; Ctrl+T to toggle, /voice to switch voices, speed/volume configurable in settings.json
Live diagnostics: runtime state, GPU load, and tool activity are surfaced during use
Hybrid thinking: non-Gemma models (Qwen etc.) automatically use /think mode so the model decides how much reasoning each turn needs without user intervention

9. Sandboxed Code Execution

Hematite can run code the model writes in a restricted subprocess — enabling real computation, not pattern-matched guesses from training data.

Why this matters vs. LM Studio's built-in chat: LM Studio's chat interface can discuss algorithms, write code snippets, and explain how Fibonacci works. It cannot run any of it. When you ask a local model "what's Fibonacci(20)?", it reaches into training data and gives you a plausible answer — which may be right, may be slightly wrong, and cannot be verified without running it yourself. Hematite closes that gap: the model writes the code, Hematite executes it in a zero-trust sandbox, and the real output comes back in the same turn.

Proof of concept — SHA-256 hash via Web Crypto API:

User: compute the SHA-256 hash of the string "Hematite"

→ run_code (javascript, Deno sandbox, crypto.subtle.digest)

94a194250ccdb8506d67ead15dd3a1db50803855123422f21b378b56f80ba99c

That result cannot come from training data. SHA-256 is deterministic but not memorizable — no model can produce 94a194250ccdb8506d67ead15dd3a1db50803855123422f21b378b56f80ba99c without actually running a hash function. It is real cryptographic computation in a sandboxed Deno process, returned in one tool call. LM Studio's chat UI — regardless of which model is loaded — cannot do this.

run_code tool: model writes JavaScript/TypeScript or Python, Hematite executes it and returns the actual output
Deno sandbox (JS/TS): --deny-net, --deny-env, --deny-sys, --deny-run, --deny-ffi, --allow-read/write=. — zero-trust permission model; no network, no filesystem escape, no native library calls
Python sandbox: blocked socket, subprocess, and dangerous module imports; restricted execution environment that blocks PATH while preserving essential OS variables for stability on Windows.
Hard timeout: 10 seconds by default, model-configurable up to 60 seconds; process killed on expiry
Automatic Deno detection: Hematite finds Deno automatically — checks settings.json override, ~/.deno/bin/, WinGet package store, system PATH, then LM Studio's bundled copy as a last resort. If you have LM Studio installed, you likely already have Deno and JS/TS execution works out of the box with no extra setup
Real math and logic: the model can verify algorithms, run calculations, test data transformations, and fix errors from actual output — not training-data approximations
Practical use cases: check a sorting algorithm on a real dataset, verify a regex against real strings, compute checksums, generate test fixtures, run a quick proof — all without leaving the conversation
Lead Computational Researcher Mandate: Hematite detects when a query requires precise numeric or structural results (symbolic algebra, physics with unit safety, Big-O complexity audits, financial math, statistics) and automatically nudges the model to use scientific_compute instead of guessing from training data. It follows a "Bring Your Own Engine" philosophy: it defaults to pure Python for maximum portability but detects and leverages high-performance libraries if you provide them in your environment.
Symbolic Solver: Integrated SymPy-based engine for algebraic derivations, calculus, and equation solving.
Unit-Aware Physics: Dimensional analysis engine that prevents category errors (e.g., adding meters to seconds) and handles automatic unit conversion.
Empirical Big-O Auditor: Verifies algorithmic complexity claims by running performance regressions against varying input sizes ($N$).
Computational Ledger (Scientific Memory): A persistent, RAG-indexed notebook (.hematite/docs/scientific_ledger.md) where Hematite stores derivations, constants, and multi-step theorem proofs. This allows the model to recall previous project math in future turns without eating context.
Dataset Bridge: Seamless integration between SQL data (CSV/DB/JSON) and high-precision scientific solvers, enabling statistical analysis and formal math on production datasets.
Python-sandbox data analysis CLI (--sample, --correlate, --timeseries, --fourier, --cluster, --normalize, --pca, --hypothesis, --polyfit): batch data-analysis commands that run via the Python stdlib sandbox against CSV/TSV/JSON/SQLite files — random sampling with train/test split, Pearson/Spearman correlation matrix with heatmap, trend/seasonality/moving-average/change-point detection, FFT frequency analysis, k-means clustering, feature scaling (z-score/min-max/robust/L2), principal component analysis, hypothesis testing (one-sample and two-sample t-test, chi-square, ANOVA, Mann-Whitney, Pearson correlation, proportion z-test, confidence intervals), and polynomial curve fitting with R²/RMSE/MAE and an ASCII scatter chart — no external libraries required.

12. Unlimited Hardened Technical Research

Hematite transforms technical discovery into a privacy-first, grounded competency using a hardened, self-healing search infrastructure — a curated technical-source engine pool with no cloud API keys or rate limits.

Privacy-First Research: Research queries never leave the machine or are tracked by third-party search providers. All searches are routed through your local SearXNG container.
Unlimited Volume: By hosting the search backend locally, Hematite bypasses the rate limits and per-search costs associated with cloud research APIs.
Proactive Verification Mandate: The model is explicitly instructed to verify its own technical uncertainty. Instead of hallucinating versions or API specs, it proactively uses the research tool for grounding via your local backend.
Self-Healing Lifecycle: Hematite manages the search engine's health autonomously, performing heartbeat checks during the runtime boot sequence and auto-booting the container if it's offline. If Docker is unavailable, Hematite surfaces a compact startup note with the fix instead of silently failing.
Intent-Aware Routing: The system's intent classifier distinguishes between "Research" (external web discovery) and "Analysis" (local codebase exploration), ensuring that "search" queries meant for the repository don't wander to the internet.

13. Headless IT Automation

Every diagnostic command runs without a model, TUI, or network. The full headless surface is scriptable and CI-friendly.

Report commands — save a file and print the path:

--triage [preset] — 5-topic IT-first-look (health, security, connectivity, identity, updates). Presets: network, security, performance, storage, apps.
--diagnose — staged triage: health_report → dynamic follow-up topics → fix plan.
--fix "<issue>" — keyword-routed fix plan. Add --execute to run safe auto-fixes; --execute --yes to skip the prompt.
--fix-all — maintenance sweep: pre-check every safe auto-fix, skip healthy, run what needs fixing, verify each fix resolved.
--report — full workstation snapshot (health, hardware, storage, network, security, toolchains).

Inspection commands — output to stdout, no file saved by default:

--inspect <topic[,topic2,...]> — run any of 128+ topics directly. Comma-separate for multi-topic.
--query "<text>" — natural-language routing to the right topics.
--watch <topic> — continuous polling. Add --count N to stop after N cycles, --alert <pattern> for bell-on-match.
--diff <topic> — before/after snapshot diff. Add --from <name> to diff against a saved snapshot instead of a live first capture.
--compare <name1>,<name2> — diff two saved snapshots without a live run.
--inventory — full 128+ topic catalog by category.
--snapshots — list saved snapshots with name, size, and age.

Output modifiers — all headless commands accept:

Flag	Effect
`--report-format json`	Structured JSON output with health grade, action items, and per-section data
`--report-format html`	Self-contained dark-theme HTML with "Copy for AI" button
`--output <path>`	Save to explicit file instead of auto-dated `.hematite/reports/`
`--clipboard`	Copy output to clipboard after run
`--notify`	Windows 10/11 desktop toast on completion or `--alert` match
`--quiet`	Suppress output when healthy (exit 0); print only on issues (exit 1)
`--open`	Save to file and open in browser/editor immediately
`--field <pattern>`	Filter output to lines containing PATTERN (case-insensitive)
`--dry-run`	Preview topics or fix commands without executing (works with `--triage`, `--diagnose`, `--fix`, `--fix-all`)

Scheduling — --fix-all --schedule [weekly|daily|remove|status] registers a Windows Task Scheduler task that runs the maintenance sweep silently (with --quiet) at 03:00.

--fix-all --only list --report-format json — emits the sweep fix catalog as a JSON array of {"label", "verify_topic", "verify_gone"} objects for CI enumeration and selective automation. Supports --output.

--diff / --compare + --field — --field <pattern> filters both snapshot A and B before diffing, so only matching lines appear in the diff output. Works in both ANSI and JSON modes; before/after fields in JSON reflect the filtered content.

JSON consistency — every command's JSON output follows the same envelope:

{"generated": "...", "host": "...", "hematite_version": "...", "grade": "A", "action_count": 0, ...}

Fix-all JSON adds sweep-specific fields (checks_run, applied, verified, unresolved, checks[]). Watch JSON emits NDJSON (one object per line): {"timestamp", "cycle", "topics", "alert_matched", "output"}. Diff/Compare JSON includes before, after, diff_lines[], and changed — with --field filtering applied to snapshot content before diffing.

Hematite is strongest when treated as a complete local AI workstation partner: a polished coding harness, a grounded SysAdmin and Network Admin, and a natural-language terminal interface — all GPU-aware, terminal-native, tool-rich, and tuned for serious work on single-GPU consumer hardware, especially RTX 4070-class machines.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hematite Capabilities

What Makes It Distinct

1. Model-Native Reasoning Flow

2. Precision Editing

3. Hardware Awareness

4. SysAdmin and Network Admin

5. Workspace-Native Tooling

6. Developer Utility Tools

7. Stateful Local Workflow

8. Voice and TUI Integration

9. Sandboxed Code Execution

12. Unlimited Hardened Technical Research

13. Headless IT Automation

FilesExpand file tree

CAPABILITIES.md

Latest commit

History

CAPABILITIES.md

File metadata and controls

Hematite Capabilities

What Makes It Distinct

1. Model-Native Reasoning Flow

2. Precision Editing

3. Hardware Awareness

4. SysAdmin and Network Admin

5. Workspace-Native Tooling

6. Developer Utility Tools

7. Stateful Local Workflow

8. Voice and TUI Integration

9. Sandboxed Code Execution

12. Unlimited Hardened Technical Research

13. Headless IT Automation