Tools don't access the system directly — they go through Operators that enforce security:
FileOperator
All file I/O goes through here. Security features:
- Path traversal blocked: Component-level depth tracking rejects
../escapes - Absolute paths blocked: Only relative paths within project allowed
- Base path enforcement: All operations scoped to a root directory
TerminalOperator
Executes shell commands with a blocklist:
- Blocks:
rm -rf /,sudo,python3 -c(code injection) - Timeout: kills processes after 30 seconds
- Captures stdout + stderr + exit code
ShadowOperator
Undo system: before any file write, saves the old content to .mithril/shadow/.
The /undo command restores the last session's file changes.
GitOperator
Git operations (status, log, diff, blame, branch) via subprocess calls to git.
WebOperator
HTTP fetching with a search API adapter for web_search tool.