Marmo Core

Modern AI agents can access tools, memories, reusable skills, external services, and even other agents. The challenge is no longer just connecting them.

The challenge is deciding:

• What should be used?
• Which resources should be selected together?
• Is the operation allowed?
• Does it require human approval?
• What happened during execution?

Marmo Core provides a common layer for handling these decisions.

1. TaskA natural language goal arrives.
2. SearchFind candidate resources in the registry.
3. SelectNarrow them down to a working set.
4. Policy & SafetyCheck permissions, side effects, and approval.
5. ActivateHand the selected set to the agent.
6. ExecuteRun under the runtime’s controls.
7. AuditRecord what was decided and what ran.

Memory, Skill, Tool, and Agent resources share a common metadata model. Every resource can describe itself with the same set of fields:

• Capabilities
• Inputs and outputs
• Required permissions
• Estimated cost
• Expected latency
• Side effects
• Trust level
• Dependencies
• Conflicts
• Operational statistics

This allows different kinds of resources to be searched, compared, selected, and governed through the same infrastructure.

Memory ─┐
Skill  ─┤
Tool   ─┼──► Resource Registry
Agent  ─┘          │
                   ▼
               Retrieval
                   │
                   ▼
                Selection
                   │
                   ▼
                Execution

Instead of exposing every available capability to an agent at once, Marmo Core retrieves and selects resources based on the current task.

User Task
   │
   ▼
Resource Registry
   │
   ▼
Retriever
   │
   ▼
Candidate Resources
   │
   ▼
Selector
   │
   ▼
Selected Resource Set

Marmo Core includes multiple retrieval and selection strategies, allowing applications to balance factors such as relevance, cost, latency, permissions, trust, dependencies, and resource compatibility.

"Summarize this document and send the result."

                    │
                    ▼

               Marmo Core

       ┌────────────┼────────────┐
       ▼            ▼            ▼

Document Skill    Memory      Email Tool

The agent receives the resources needed for the task instead of the entire capability space.

Giving AI agents access to external systems introduces risks that ordinary function calling does not solve. Marmo Core places execution behind explicit policy and runtime controls.

LLM
 │
 ▼
Resource Selection
 │
 ▼
Policy Gateway
 │
 ▼
Permission Check
 │
 ▼
Human Approval
 │
 ▼
Runtime
 │
 ▼
Audit Log

Permissionspermissions

Resources declare the permissions they require before execution.

Side effectsside effects

Operations can be classified according to their effects, including read, write, external, and irreversible actions.

Human-in-the-loopapproval

Sensitive operations can require explicit human approval before execution.

Secret handlingsecrets

Credentials can be resolved outside the model context and injected only when needed.

Prompt injection boundariesuntrusted input

External content and tool results can be treated as untrusted data rather than trusted instructions.

Isolationisolation

Connectors can declare execution isolation requirements.

Auditaudit log

Execution decisions and runtime activity can be recorded for inspection and verification.

Install

Create a resource

from marmo_core import ResourceDefinition, ResourceRegistry

registry = ResourceRegistry()

resource = ResourceDefinition.from_mapping({
    "id": "tool.math.add",
    "kind": "tool",
    "name": "Add Numbers",
    "version": "1.0.0",
    "description": "Add two numbers.",
    "capabilities": ["arithmetic", "addition"],
    "input_summary": "Two numbers.",
    "output_summary": "The calculated sum.",
    "required_permissions": ["math.add"],
    "cost_estimate": 0.0,
    "latency_class": "fast",
    "side_effect": "none",
    "trust_level": "core",
    "ref": "tool://math/add",
    "tags": ["math"],
    "input_schema": {
        "type": "object",
        "required": ["a", "b"],
        "properties": {
            "a": {"type": "number"},
            "b": {"type": "number"}
        }
    }
})

registry.add(resource)

Run a task

from marmo_core import (
    Kernel,
    MockLLMProvider,
    PolicyContext,
)

def add_numbers(a: float, b: float):
    return {"sum": a + b}

kernel = Kernel(
    registry,
    MockLLMProvider(
        tool_arguments={
            "tool.math.add": {
                "a": 2,
                "b": 3
            }
        }
    ),
    policy_context=PolicyContext(
        granted_permissions=("math.add",)
    ),
    tool_implementations={
        "tool.math.add": add_numbers
    },
)

result = kernel.run_goal(
    "Add 2 and 3 using the calculator."
)

print(result.output)

Different strategies can be combined depending on the size of the resource registry and the requirements of the application.

Marmo Core is designed to sit between AI agents and the resources they use. It does not require replacing your existing tools or services.

• OpenAI-compatible models
• Anthropic models
• MCP servers
• Python functions
• HTTP services
• File systems
• Shell commands
• SQLite databases

                   AI Agent
                      │
                      ▼
                 Marmo Core
                      │
         ┌────────────┼────────────┐
         ▼            ▼            ▼
        MCP          APIs        Python
         │            │            │
         ▼            ▼            ▼
       Tools       Services      Systems

MCP connects tools. Marmo decides when and whether to use them.

Marmo Core is not an alternative to the Model Context Protocol. MCP provides a standard way to expose tools and capabilities to AI applications. Marmo Core treats those capabilities as resources and adds:

• Retrieval
• Selection
• Permissions
• Trust
• Cost awareness
• Human approval
• Execution policies
• Auditability

MCP Server
    │
    ▼
MCP Tools
    │
    ▼
Marmo Resource Registry
    │
    ▼
Routing + Policy
    │
    ▼
AI Agent

Recoveryrecovery

Support retry, fallback, circuit breakers, and recovery strategies.

Statestate store

Persist execution state using in-memory, JSON, or SQLite-backed state stores.

Auditevent trail

Record execution activity using an auditable event trail.

Evaluationstatistics

Collect execution outcomes and operational statistics that can inform future routing decisions.

Most agent frameworks focus on defining workflows or orchestrating model calls. Marmo Core focuses on a different problem:

How should an agent discover, select, govern, and execute the capabilities available to it?

Its core principles are: