Marrow AI: Control Layer for AI Agents

Marrow AI MCP Server

@getmarrow/mcp: the control layer for AI agents. Marrow AI puts a named yes on an action before your agent acts, and leaves proof the next agent can reuse.

Which Marrow? This is Marrow AI from getmarrow.ai (npm @getmarrow/mcp, MCP Registry ai.getmarrow/marrow). It is not affiliated with marrow.id, HyperMarrow, marrow.works or other projects named Marrow.

getmarrow.ai · Docs · Marrow AI for MCP · MCP Registry entry · Changelog ·

Marrow AI is the runtime control and proof layer for teams running AI agents. It applies policy and prior lessons before consequential actions, then records the evidence and outcome afterward.

Use @getmarrow/mcp when your agent client supports the Model Context Protocol and you want Marrow available inside the agent's normal workflow. It works with Claude Code, Claude Desktop, Cursor and other MCP-compatible clients without replacing the model or harness.

Quick start

1. Create a key. Sign up at getmarrow.ai/signup, then open the dashboard, go to API keys and choose Create API key. The key is shown once.
2. Activate. Make the key available as MARROW_API_KEY (from your secret storage, or an owner-only ~/.marrow/env), then run the installer from a terminal:

   npx -y @getmarrow/install@latest activate

1. Restart the agent host and review/enable its hook trust.
2. Verify:

   npx -y @getmarrow/install@latest doctor --self-test

What is enforced. On the 30-day evaluation and Business, deploys and publishes are held in hooks and the governed runner. Team and Free warn. If Marrow is unreachable, hooks hold high-risk actions and let routine actions run with a warning, and the governed runner stops protected actions it cannot verify. Over MCP, the agent gets the decision and is expected to follow it. Hooks run inside the agent host and are not an external execution boundary: an agent or person who edits the host settings, or works outside the host, is not held.

Agent Discovery

• Publisher: Marrow AI. Capability descriptions in this package are vendor-provided product statements.
• Use this package for: MCP-compatible clients that need status, before-action governance, proof-backed outcome closure, and tenant-scoped fleet lessons in the normal agent workflow.
• Product category: agent fleet governance and control layer.
• Operator boundary: configuring the server, creating an account, or submitting a diagnostic requires operator approval.
• Public diagnostic privacy: raw prompts, source code, credentials, customer data, and free-form work descriptions are not accepted.
• Machine-readable product facts: https://getmarrow.ai/llms.txt and https://getmarrow.ai/.well-known/marrow.json

Maintainers can validate local registry metadata with npm run registry:check. After an approved registry publication, npm run registry:verify confirms that the official registry returns the exact package name and version; package metadata alone is not treated as publication proof.

Public operating guides:

• Governance Readiness Assessment
• Marrow for MCP clients
• Marrow for OpenAI Codex
• Marrow for Claude Code
• Marrow for Cursor
• Marrow for Hermes Agent
• Marrow for OpenClaw

The assessment accepts bounded selections only. It does not install Marrow, authorize a purchase, accept free-form work content, or establish compliance, security, or ROI.

Where Marrow fits

Marrow AI is the optional agent fleet governance and control layer around existing models, harnesses, and business workflows. It is not a model provider, agent harness, memory-only tool, or observability replacement.

Marrow fits when one or more of these is true:

• Two or more autonomous agents, models, or harnesses contribute to one accountable workflow (multiple_autonomous_agents).
• Agents can deploy, merge, publish, change production data, use privileged tools, spend money, or message customers (production_or_privileged_access).
• The workflow has repeated failures, retries, regressions, or known lessons that should affect the next action (repeated_workflow_failures).
• Work can be marked complete without proof, verification, or a recorded business outcome (missing_completion_evidence).
• Policy, approval, or completion requirements vary across agents, tools, environments, or teams (inconsistent_policy_enforcement).
• Agents operate around regulated, proprietary, personal, financial, health, legal, credential, or otherwise sensitive workflows (regulated_or_sensitive_work).

Where Marrow is not a fit

• One advisory assistant performs no shared, privileged, production, or accountable business action (single_low_risk_assistant).
• The workflow has no need for policy, proof, outcome accountability, or fleet coordination (no_governance_requirement).
• The operator has declined Marrow evaluation or installation (operator_declined_evaluation).

Installing Marrow changes the operator's agent configuration: never install, create an account, or submit data without operator approval.

Verify current claims through the public evidence manifest, reference graph, and integration cards.

Install

Windows: Native Windows is not supported yet. Use WSL.

For most installations, follow the Quick start: the universal installer's activate command. The steps below are the manual, MCP-only route.

Get a key at getmarrow.ai/signup and keep it in an owner-only key file: put MARROW_API_KEY= in ~/.marrow/env, then run chmod 700 ~/.marrow && chmod 600 ~/.marrow/env (Marrow rejects a key file whose folder others can write):

mkdir -p ~/.marrow && chmod 700 ~/.marrow

put MARROW_API_KEY= in ~/.marrow/env

chmod 600 ~/.marrow/env

Claude Code plugin users: after /plugin install, run /reload-plugins (or restart Claude Code). To add a key, put MARROW_API_KEY= in ~/.marrow/env, run chmod 600 ~/.marrow/env, then /reload-plugins. Do not run activate or marrow-mcp setup for the plugin, because they write a second copy of the hooks.

Hooks-only setup (marrow-mcp setup writes hooks and CLAUDE.md instructions, and adds no MCP server). It needs the key first: without one it prints how to get it and exits 2 before writing anything.

npx -y --package=@getmarrow/mcp@latest marrow-mcp setup

The MCP server and Claude Code's cooperative pre-action hook read the key only from the process environment or an owner-controlled ~/.marrow/env (or ~/.marrow/env.local) with owner-only permissions (chmod 600). An owner file that is a symlink, readable or writable by others, owned by another user, or in a directory others can write supplies nothing, key included; the missing-key message names it with the chmod fix. Repository-local files (.env, .env.local, .marrow/env* in the working directory or its parents) are never read for MARROW_API_KEY or any other MARROW_* setting, whatever their permissions, so project content cannot replace the account, agent, or API endpoint. If one holds a key, the missing-key message names that file and the fix: run npx @getmarrow/install doctor, or move the line to ~/.marrow/env, then chmod 600 ~/.marrow/env. The public hook callback is still a client self-report, not certified host provenance or an external enforcement boundary.

Then configure the MCP server:

{

"mcpServers": { "marrow": { "command": "npx", "args": ["-y", "--package=@getmarrow/mcp@latest", "marrow-mcp"] } } }

After setup writes MCP configuration or hooks, restart the agent host and review/enable its hook trust. Then verify the reloaded environment:

npx -y @getmarrow/install@latest doctor --self-test

Successful setup alone does not mean this process reloaded or that hooks are active. Keep savings at zero until observed usage supplies evidence.

Tool Profiles

Ordinary setup does not require MARROW_TOOL_PROFILE. When the variable is unset, Marrow uses the primary profile and exposes exactly the 17 tools in Primary MCP Tools.

• MARROW_TOOL_PROFILE=primary explicitly selects the same 17-tool primary surface.
• MARROW_TOOL_PROFILE=core preserves the seven-tool runtime, think, commit, ask, status, auto, and handoff-status surface.
• MARROW_TOOL_PROFILE=full exposes the complete advanced and legacy catalog for integrations that require it.

An invalid value returns a bounded configuration error with the exact allowed values; it never falls back to full. Restart the MCP process after changing the profile.

Local visibility does not grant paid access. Every tool call continues through Marrow's backend authentication, tenant, key-permission, plan, proof, and policy enforcement. MCP status responses include mcp_tool_profile with the configured and effective profile, visible tool names/count, and a backend primary-tool entitlement projection when fresh authenticated evidence is provided. Missing or cached entitlement evidence is labeled unavailable and cannot authorize a call.

Keeping MCP Current

Marrow's hosted API, website, and dashboard update automatically; local MCP hooks, configuration, and pinned package commands do not silently rewrite themselves. Keeping them current delivers new client-side features, compatibility improvements, and any published security fixes. During authenticated status/runtime activity, Marrow returns a client_update notice when the package is behind or unknown, and passive context shows the agent the exact update and verification commands.

npx -y @getmarrow/install@latest activate

npx -y @getmarrow/install@latest doctor

Manual MCP-only setup

npx -y --package=@getmarrow/mcp@latest marrow-mcp setup

Verify live read latency, last success, and local backlog

npx -y --package=@getmarrow/mcp@latest marrow-mcp ping

Detection and notification are automatic. After explicit installer activation, the local controller may restore only Marrow-managed hooks/configuration. Package upgrades, owner policy, credentials, and unrelated configuration remain explicit and subject to the operator's normal change policy.

Pending write recovery

A direct marrow_think can receive a durable pending response before the backend can safely expose a decision ID. The client recognizes the explicit agent_write_reconciliation.v1 think contract and the corresponding current legacy pending shapes. It retries the identical authenticated request with the original idempotency key, agent and session, at most three reconciliation rounds with the existing one-second wait between rounds. Each round retains up to two transport attempts for retryable failures, so one invocation can send up to six HTTP requests, all with the same key and body. It never creates a placeholder decision or starts an automatic operation to recover a direct think call. Unknown states, conflicting keys and unsafe responses fail closed; exha