article research
Programmatic tool calling: pattern and Prime Agent
Programmatic tool calling lets an agent compose, invoke, and process tools through code rather than a fixed JSON schema. Prime Agent's model-facing tool is a persistent IPython kernel: file edits, shell commands, skills, and subagent calls are ordinary Python calls. This differs from provider-native function calling and inherits the kernel's trust boundary.
First-party announcement, documentation, release, or installer.
Generic pattern
Programmatic tool calling gives a model a code environment in which it can compose calls, transform results, branch on intermediate values, and repeat operations. The orchestration is expressed as a program rather than as a sequence chosen only from a static JSON function menu.
The pattern can reduce repeated model round trips for data-heavy workflows, but it also moves more control and error handling into generated code.
Persistent Python
Prime Agent exposes a persistent IPython kernel as its single built-in model-facing tool. Imports, variables, and helper functions can carry across calls, allowing later code to build on earlier inspection or computation.
File operations, shell commands, skills, and recursive subagent calls are reached from this Python environment instead of each appearing as an independent provider-native function.
Host requests
Operations requested from the host are made through ordinary Python calls or the facilities Python invokes. This allows results to be filtered and combined locally before another model turn is needed.
The host still controls what is actually available through the installed runtime, credentials, and OS permissions. Programmatic composition does not bypass those practical dependencies.
Security and cost trade-offs
A general Python surface is more expressive than a narrowly constrained schema, but generated code runs with the user's permissions and can perform unintended file, shell, or network actions. The flexibility therefore expands the review burden.
Programmatic composition can save model turns in some workflows while consuming local execution time and making failures less structurally constrained. It is a trade-off, not an automatic security or cost improvement over provider-native function calling.