Cli

Every agent, on Claude and on Codex, has tonoman in every turn. What Tonoman lets an agent do is a command of it, never an MCP tool.

The turn's context carries one short paragraph about tonoman, whatever the number of commands; the agent learns the rest with tonoman --help and tonoman <group> --help.

e.g. forty commands later, the paragraph is the same length.

Every command answers in a few thousand characters at most, says when there is more, and how to ask for it.

A command acts as the person the turn is for, with that person's reach, checked at every call (BRAIN-GRANTS-DECIDE); nothing the model types can change whose turn it is.

e.g. Ana's turn and Ben's turn run the same tonoman brain list and see their own brains.

The turn's credential works only while the turn runs; a command run after the turn ended, or from another turn, is refused.

tonoman brain is every agent's; a skill's group (tonoman receipts) is there only while that skill is on for the agent; otherwise it says so and does nothing.

The agent may run tonoman and nothing else: any other command, a pipe or redirect around tonoman, or a path to another program is refused. On Claude its shell allows only tonoman; on Codex, which never asks before it runs something, there is no shell at all and tonoman is its one tool. This is what keeps a turn from reading its own login, reaching the network inside the platform, or leaving a process behind — things the turn's own user cannot be kept from.

e.g. cat /root/.codex/auth.json → refused; tonoman --help; cat /etc/hostname → refused; tonoman brain read … → runs.

The shell is closed on every turn, on the path real turns take, whatever else is wrong: with the brain service down, or the speaker unknown, the agent still has no shell — it has less, never more.

e.g. the brain service fails to start → the turn runs with tonoman answering "brains are unavailable", not with --dangerously-skip-permissions.

The shell setting and the turn's model reach the agent the same whether it runs beside the worker (every Tonoman Cloud agent) or in a container of its own (self-hosted).

A Codex turn has no child agents, no plugins and no hooks: what it can do is tonoman, reading the photos it was sent, and the web.

A conversation turn of an agent granted web-search (TOOL-WEB-SEARCH) can search the web and read a page on either provider: Claude through its web search, Codex through its live web search, which also opens pages. The provider does the fetching, never the worker, so a turn reaches nothing on the platform's own network this way. A lean turn (a skill's single completion) has none. Claude's page fetcher stays off: it fetches from the worker.

e.g. Nova on Codex is asked for a person's public profile → she searches and reads it; before this she said she could not reach the internet (Oct 3).

The turn's credential is never on a command line, where any process on the machine can read it; it travels in the turn's environment only.

A tool Tonoman Cloud serves an agent — listed on its roster with its commands and a short note — is a tonoman group in that agent's turns and in no other, and each call goes to the Cloud with the agent, the person speaking and the arguments; a file goes only if the person sent it (CONVO-FILES-IN-THE-TURN). The runtime knows nothing else of the tool.

e.g. Website on for Nova → tonoman site in Nova's turns; tonoman site publish reaches the Cloud, which decides it.