Skip to main content
Every tool an agent can call is a capability: a normalized entry with declared mutability, network usage, scope requirements, and audit behavior. Roles grant capabilities by group, and every invocation can be recorded. 
voss capabilities list            # grouped, compact names
voss capabilities list --json
voss capabilities inspect fs_edit # full normalized detail
voss capabilities inspect fs_edit --json

​
Groups

Capabilities are bucketed into nine groups. Role tools lists reference these names: 
fs · git · test · shell · net · code · memory · review · mcp
GroupExamples
fsfs_read, fs_glob, fs_grep, fs_write, fs_edit, fs_watch
gitgit_status, git_diff
testvoss_check, voss_probable_inspect, voss_budget_trace, voss_py_diff
shellshell_run, shell_run_background, shell_monitor, shell_signal
netweb_fetch, web_search
codecode_search, find_definition, find_references, code_refresh, code_recall
memorymemory_recall, memory_remember
reviewrecord_run
mcpdynamically loaded MCP tools

​
Capability metadata

Each entry declares:
FieldMeaning
name / description / input_schemaIdentity and call shape
output_schemaJSON-first output shape, when defined
is_mutatingDrives mode-tier denial in the permission gate
is_networkGated independently of mutation — net is default-deny
groupOne of the nine groups above (required)
scope_requirementsCoarse permission buckets
audit_behaviorfull · redact_args · metadata_only
is_statefulOrder-dependent capabilities are marked explicitly

​
Permissioning

  • Mutating capabilities require permission-gate approval unless the active role/mode already allows them.
  • Network capabilities are default-deny unless the role grants net.
  • Invocations emit recorder events; audit_behavior controls how arguments appear in the trail (full, redacted, or metadata-only).
MCP tools are unified into the same registry — to an agent and to the audit, an MCP tool is just another capability.
Capability groups are how a role is scoped: a role that lists ["fs", "code", "test"] cannot reach shell or net. voss team check rejects an unknown group at compile time.