Tools
For tool artifacts, Murmur supports both:
- WASM tools (preferred, stronger isolation)
- Native tools (compatibility path, process-level boundary)
Tools reach the runtime through one of two invocation paths behind a single agent-facing contract: a WASM path (tool exposed through typed WIT interfaces) and a native path (tool launched as a subprocess and normalized into the same result envelope). The goal is consistent agent behavior regardless of tool implementation language.
Tool dispatch
Each tool call is resolved in a fixed precedence order:
- A native binary staged for that artifact
- The shell allowlist
- A skill artifact (
workdir/tools/<name>/skill.md, returned directly) - A WASM-artifact tool
- Otherwise, an error
share-file, fetch-peer-file, delegate-task and submit-plan sit ahead of all five: they are
runtime-provided tools, answered by the runtime rather
than by an artifact, and their names are reserved.
Non-zero shell exit codes are data, not errors — only spawn/IO failures set is_error: true.
An undeclared tool feeds an error back to the model as a tool_result and the session
continues. See Lock down a capsule's capabilities for how the
native/shell subprocess environment is built.