diff --git a/docs/tools/README.md b/docs/tools/README.md
new file mode 100644
index 00000000..67d988eb
--- /dev/null
+++ b/docs/tools/README.md
@@ -0,0 +1,33 @@
+# Tools
+
+`hivectl` is *your* tool — the operator's own host CLI. Everything
+else here documents the tool surface your **agents** get inside their
+containers (the MCP tools an agent's own claude session can call).
+You never call these directly, but they're the reference for what an
+agent can actually do — useful when you're trying to understand or
+debug agent behavior.
+
+## For the operator
+
+- **[hivectl](hivectl.md)** — the curated guide: provisioning forge
+  and matrix accounts, gateway htpasswd management, container
+  lifecycle shortcuts, interactive agent shell access.
+- **[hivectl-cli](hivectl-cli.md)** — the exhaustive, auto-generated
+  flag-by-flag reference, kept in lockstep with the binary by CI.
+
+## What your agents can do
+
+- **[bash](bash.md)** — background shell execution (`mcp__bash__*`),
+  available on every agent unconditionally.
+- **[forge](forge.md)** — the `hive-forge` Forgejo CLI every agent has
+  for issues, PRs, and comments. Not an MCP tool — a binary agents
+  shell out to instead of ad-hoc curl.
+- **[lifecycle](lifecycle.md)** — kill/start/restart/update for an
+  agent's own direct children, plus the approval-gated config-change
+  tools.
+- **[matrix](matrix.md)** — the matrix MCP tool surface
+  (`mcp__matrix__*`) for agents with a matrix account, multiple
+  accounts per agent, and declaring extra MCP servers generally.
+- **[scheduling](scheduling.md)** — scheduled prompts (operator
+  approval required) and the diagnostics tools (`get_logs`,
+  `get_host_journal`).