> ## Documentation Index
> Fetch the complete documentation index at: https://developer.lofty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The one invariant

> search_* never changes data. Every other tool might.

<Tip>
  **Learn this and nothing else:** `search_*` never changes data. Every other tool might.
</Tip>

**For the model:** a `search_` prefix means the call is safe, needs no confirmation, and can be retried freely after a failure. Everything else is treated as having side effects. This is a property of the tool surface itself and holds today.

**Why the split is drawn at the tool boundary:** a read-only connection can then be enforced by name prefix alone — serve the nine `search_*` tools and nothing else, and the write tools are **absent from `tools/list`** rather than present and failing. A model cannot call what it cannot see. This is what the naming buys; enforcing it needs a read/write scope split, which doesn't exist yet — today the single `openApi` scope means any connection that can read can also write.