KAOS runs swarms of AI agents on your machine. Each agent works in its own private sandbox inside a single SQLite file, every action it takes is on the record — auditing an agent is a SQL query — and the lessons that actually worked are remembered and re-ranked for next time. No cloud account, no GPU, no embeddings.
One measured screen in about 2 seconds — no API keys, nothing written to your directory. Using Claude Code? claude plugin marketplace add canivel/kaos
Rank #39 as of Jul 18; score as of Jul 24, 2026 — entered solo by canivel, run by KAOS itself. The harness, doing the competing.
uv run kaos mh searchKAOS is not another coding agent. It's the infrastructure underneath agents: you bring the model (Claude, GPT, or a local one), KAOS supplies everything around it.
--json everywhere; a live terminal dashboard.kaos.db. Copy the file and you've copied everything.The demo needs no configuration and no API keys. You connect a real model provider only when you put agents on real work.
$ pip install kaos-harness $ kaos demo --print
Seeds 50,000 memories in a temporary file, runs a real cross-agent search and prints the measured p95, shows the audit table, exits — about 2 seconds, nothing written here. pip install 'kaos-harness[all]' && kaos demo opens the live dashboard instead. The base package has 4 dependencies; extras tell you their own install line when needed.
$ claude plugin marketplace add canivel/kaos > /plugin install kaos@kaos # every session journaled; team memory recalled at start $ kaos parallel -t fix "fix the double-charge bug in payments.py" \ -t tests "write pytest tests proving the fix" \ -t review "security-review the module"
The plugin turns each Claude Code session into an auditable KAOS agent and injects the lessons your team saved (no marketplace? kaos connect claude-code). Or run three agents in parallel, each in its own sandbox, and watch them with kaos ui.
$ kaos query "SELECT agent_id, tool_name, COUNT(*) FROM tool_calls GROUP BY 1,2" $ kaos read <agent> /src/payments.py > payments.py
Nothing reaches your working directory until you copy it out. The full audit trail of who did what stays in kaos.db forever. Here's what that looks like on a real bug ↓
An actual KAOS 2.0.2 session, real model calls throughout: a payments module that double-charges on timeout retries, fixed by a swarm — then the workspace learns from it.
$ pip install 'kaos-harness[all]' && kaos init
$ kaos parallel \
-t fix "double-charges on timeout retry — fix with an idempotency key ..." \
-t tests "pytest tests proving the key is generated once and reused ..." \
-t review "security-review beyond the retry bug ..."
Agent fix (ok) Agent tests (ok) Agent review (ok)
$ kaos query "SELECT a.name, t.tool_name, COUNT(*) FROM agents a
JOIN tool_calls t ON t.agent_id=a.agent_id GROUP BY 1,2"
fix fs_write x1 tests fs_read x1, fs_write x1 review fs_mkdir x1, fs_write x1
$ ls # your working directory: untouched
kaos.db kaos.yaml payments.py
$ kaos read <fix> /src/payments.py > payments.py
$ kaos read <tests> /tests/test_payments.py > tests/test_payments.py
$ pytest tests/ -q
6 passed in 0.09s # agent tests, green against the agent fix
# sprints later: 17 skill outcomes, 6 recalls, 12 hebbian edges of telemetry
$ kaos dream consolidate --apply
{ "promoted": 1, "pruned": 1, "applied": 2 }
# the 6×-retrieved lesson became a skill; the 1/6 flaky skill is hidden:
$ kaos skills search "deploy service"
deploy-canary-checklist # only the one that actually works (5/5)
$ kaos memory search "timeout retry"
payment-retry-idempotency → "client timeout != server failure. Fix =
Idempotency-Key generated once per logical charge, reused across retries."
# an earlier run of this same session — one agent stalled:
$ kaos logs 01M1FG26...
agent_fail | {"error": "claude produced no output for 60.0s"}
# exact cause on the record → became the 2.0.2 agent_sdk fix
# (isolated in-process sessions — no CLI contention, no stalls).
# and the one recall miss we hit is filed, with a probe sketch:
$ kaos memory search "duplicate processing"
no match # FTS is literal — measured, disclosed, issue #42
# v2.1: we benchmarked ourselves and published the losses too
$ uv run python benchmarks/afb/run_afb.py
fault_localization median 9.5 entries gate ≤ 5 REJECT # real localizer bug, issue queued
$ uv run python benchmarks/cc_hook_latency/run_cc_hook_latency.py
prompt p95 275 ms gate ≤ 200 REJECT:prompt # prompt-time recall ships off
Each pillar is verifiable in the repo today — and each claim below was checked against the primary docs of the competing frameworks in the table above.
Every mechanism must survive a pass/fail test that is written and cryptographically locked before its code exists — so nobody can move the goalposts when the results disappoint. A self-test first proves the feature can lose; then the verdict (ACCEPT / REJECT / VOID) is binding, no retune-and-rerun. In research terms: a pre-registered, falsifiable kill test — KAOS is the only framework that pre-commits to one. Most candidates fail. The features you get are the survivors.
One SQLite file holds every agent's virtual filesystem, an append-only journal of every event and tool call, content-addressed blobs, and checkpoints with byte-exact restore. Audit isn't a telemetry exporter you bolt on — it's the storage engine. Any SQLite client, or plain SQL, answers "what did the agent do, and why?"
Neuroplasticity: every skill outcome, memory retrieval, and failure updates usage statistics — Wilson-bound success rates, Hebbian co-occurrence, recency decay. Retrieval reranks on evidence of what actually worked, and consolidation prunes what didn't. Not an LLM rewriting its own notes — arithmetic on recorded outcomes.
No mandatory cloud, no default telemetry upload, no SaaS eval dependency, no vendor login. Five model providers — Anthropic, OpenAI-compatible, Claude Code, Agent SDK, and fully-local vLLM — behind one router. Your agents, your data, your single file, your infrastructure.
Most tools below are coding agents or orchestration graphs. KAOS is the layer underneath — the sandbox, audit trail, and shared memory their agents can run on top of. Where we overlap, here's the honest picture, verified from primary docs (Jul–Sep 2026); competitors' real strengths are conceded below the table.
| Framework | Features proven before shipping | Full audit trail + time-travel | Memory that learns from outcomes | Runs fully local | License |
|---|---|---|---|---|---|
| KAOS | ✓ hash-locked, self-falsifying kill gates | ✓ VFS + journal + checkpoints, one SQLite file | ✓ measured, n disclosed | ✓ incl. local models | MIT |
| Pi | — | ◐ JSONL session files + branching; no tool-call journal or checkpoints | — | ✓ incl. llama.cpp | MIT |
| Hermes Agent | — | — 1 | ◐ agent-curated learning loop | ✓ (hosted tiers optional) | MIT |
| LangGraph | — eval via LangSmith SaaS | ◐ checkpoint time-travel; no event journal | — | ✓ (platform is SaaS) | MIT |
| Google ADK | ◐ eval thresholds, no pre-registration | — | — | ✓ (Vertex is the upsell) | Apache-2.0 |
| Letta | — | ◐ .af state snapshot; not an action journal | ◐ LLM self-editing memory | ◐ Postgres self-host; cloud is the push | Apache-2.0 |
| CrewAI | — scores, no gate | — logging is Enterprise-tier | ◐ memory dedup/consolidation | ✓ (AMP is SaaS) | MIT |
| OpenAI Agents SDK | — evals on OpenAI platform | — | — | — tracing to OpenAI by default | MIT |
| Claude Agent SDK | — | ◐ JSONL transcripts; DIY audit via hooks | — | — requires cloud LLM API | Commercial ToS |
| smolagents | — | — no built-in persistence | — | ✓ | Apache-2.0 |
✓ shipped in-framework · ◐ partial or different approach · — not found in primary docs as of Jul–Sep 2026 (corrections welcome — open an issue). 1 Hermes documents command-approval and container isolation; no append-only audit journal or checkpoint/restore appears in its docs. Credit where due: Pi's session trees and minimal self-extensible core are excellent — KAOS is designed to run underneath a Pi or Claude Code workflow, not to replace it. Likewise LangGraph's checkpoint time-travel, ADK's eval thresholds, smolagents' sandboxed executors, Letta's sleep-time memory agents, and Hermes' ecosystem reach are genuinely good. KAOS's bet is different: verification and auditability are the product, not features.
Your agents learn lessons the hard way — real tasks, real failures, real compute. Until now those lessons died with the workspace. Attraktor is the registry they flow into: every entry was proven against real outcomes before admission, every rejection is kept with its reasoning, and every workspace pulls what's proven — matched to the task in front of it.
chaos → organized, validated, shared. KAOS runs the chaos; Attraktor is what it converges toward.
Skills and mechanism verdicts that survive KAOS's kill-gate experiments are content-addressed and published. The server re-hashes every record's bytes — nothing enters on trust.
On task start, agents receive matched, validated lessons — each stamped with the trust level it earned and where it applies. Verified again on your side before anything is served.
A disproven idea, with the experiment that killed it, saves the next workspace from paying for the same dead end. Most registries hide failures. Attraktor keeps them, forever.
$ kaos bench pull "agent episode failed - localize the decisive failure step" graphdiff-localizer-probe-v1 · T1 · partial Contrastive failed-vs-success trajectory diffing locates decisive failure steps far better than single-trajectory heuristics — but only where trajectories share vocabulary. Before building any trajectory-graph mechanism, measure your workload's node-reuse rate first.
That lesson cost another workspace a full probe run. This fresh, empty workspace got it in one command, cryptographically verified. Open Attraktor (dev preview) →
Runnable today — these are condensed from examples/, not pseudo-code.
from kaos import Kaos
db = Kaos("team.db") # one SQLite file — the whole runtime
alice = db.spawn("alice", config={"role": "researcher"})
bob = db.spawn("bob", config={"role": "implementer"})
db.write(alice, "/notes.md", b"# Findings\n- auth.py: 3 bugs")
db.read(bob, "/notes.md") # FileNotFoundError — isolation is enforced
cp = db.checkpoint(alice, label="before-refactor")
db.write(alice, "/notes.md", b"# Findings\n- 5 bugs total")
db.restore(alice, cp) # byte-exact time travel
db.query("SELECT event_type, COUNT(*) FROM events GROUP BY 1") # audit = SQL
from kaos.eval.harness import Probe, GateOutcome, bootstrap_diff_ci
class FewshotProbe(Probe):
lock_path = "ISA.lock.json" # kill gates, written BEFORE any code
known_sha256 = {"5aa9c10d…": "v1"} # edited lock → harness refuses to run
def gates(self, arms):
md, lo, hi = bootstrap_diff_ci(arms["FULL"].labels({"hard"}),
arms["B0"].labels({"hard"}))
return [GateOutcome("G1", "beats baseline",
passed=md >= 0.10 and lo > 0.0, kill=True,
detail=f"diff={md:+.3f} lo={lo:+.3f}")]
probe = FewshotProbe()
_, verdict = probe.falsify() # FULL := B0 must emit [KILL] — or the probe is inadmissible
result = probe.run(out_dir=".") # binding ACCEPT / REJECT / VOID. No retune.
--json everywhere# From Claude Code / Cursor / any MCP client — natural language:
with kaos, review my payments module — run a security agent
and a test-writing agent in parallel
# Or the CLI:
kaos parallel -t security "find vulnerabilities in auth.py" \
-t tests "write unit tests for auth.py"
kaos ui # Gantt of every agent, live events
kaos eval probe run --probe my.bench:MyProbe --out-dir out/ # exits ≠0 on REJECT — CI-gate your harness
kaos query "SELECT tool_name, COUNT(*) FROM tool_calls GROUP BY 1"
KAOS has been building on this premise since v0.1 — and it answers the critique the discourse hasn't solved.
A decent model with a great harness beats a great model with a bad harness.
Anytime you find an agent makes a mistake, you engineer a solution such that the agent never makes that mistake again.
What's missing from the story: verification that the change actually helped.
Gartner predicts 40%+ of agentic AI projects will be canceled by 2027 — costs, unclear value, inadequate risk controls. KAOS's architecture answers each failure mode directly.
High-risk AI systems must automatically record events over their lifetime, queryable by an inspector — binding Aug 2026. KAOS's append-only event journal in SQLite is that record: every tool call, file write, and decision, answerable in SQL.
The 2026 norm: promotion decided by regression evals in CI. kaos eval probe run exits non-zero on REJECT/VOID — your agent-harness changes gate exactly like code. Pre-registration makes the gate tamper-evident.
Sovereign deployment is now a first-class procurement gate in finance, health, and public sector. KAOS runs entirely on your metal — local models included — and the whole estate is one file you can place, move, or destroy under your own regime.
Regulators want what the agent did and why. KAOS records both: the tool-call journal (execution) and the SharedLog's intent → vote → decide records (intent) — consensus before consequential actions, on the record.
Most orgs reportedly can't quickly stop a misbehaving agent. kaos kill <id> is immediate; the kill lands in the journal; systemic alerts halt auto-spawns when many agents hit the same failure fingerprint.
Agent budgets broke every model in 2026. KAOS tracks tokens and cost per tool call in the journal (SQL your spend), and AAAK context compaction delivers a measured 57% token saving at zero quality loss on its benchmark.
KAOS isn't a demo framework that hopes to grow up — it runs daily inside a real enterprise data & AI organization, built by an engineering leader who has to answer these questions for a living. It was built for audits, not just demos.
Every demo is a recording of the actual terminal surface — reproducible from the commands shown.

Spawn a swarm; watch each agent as a Gantt bar with a live event feed.

Drive KAOS from Claude Code, Cursor, or any MCP client with natural language.

Outcomes reported → weighted rank flips the top result → failures triaged → systemic alert fires.

Quality scores, taxonomy, critical-step localization, and the war-room UI.
Every release traces its numbers to a committed benchmark. Full history on GitHub.
claude plugin marketplace add canivel/kaos: every session becomes an auditable agent in kaos.db, team memory is injected at session start, the 58-tool MCP server auto-registers, /kaos:recall searches memory. A pre-registered latency probe rejected prompt-time recall (275 ms p95 vs a 200 ms gate), so that hook ships off by default — session-start passed at 241 ms.kaos demo --print — the terminal aha: 50k memories, a measured p95, the audit table, ~2 s, nothing written. ulid-py removed: it cost 216 ms of every CLI start.kaos-eval GitHub Action runs them on every release and fails on REJECT — so the next release fails until the localizer is fixed. Plus a Pi extension (integrations/pi-kaos), a plugin template, CONTRIBUTING.md, and five good-first-issues.kaos-harness — pip install 'kaos-harness[all]' then kaos demo: live dashboard, zero API keys, two commands. Slim 5-dependency base; [router] / [mcp] / [ui] / [agent-sdk] extras, each missing extra prints its own install line.kaos.plugins entry-point group: third-party providers, benchmarks, and MCP tool packs with zero core changes.consolidate --apply after a dry-run applying nothing, and two undeclared-dependency bugs only a clean-install test could catch.query() read-only bypass — now enforced at the SQLite parse layer.kaos eval probe + an experiments journal.Long-form walkthroughs with real CLI output and measured results.
A mechanism passed every pre-registered kill gate and still didn’t ship. Why 13 published agent mechanisms keep dying on workload shape, not logic — and the four “benchmark gifts” to measure before you build.
Silver-zone on ARC-AGI-3 with the harness driving itself, a 48-agent self-audit, a 125× win from a measurement, and an outside model's failed kill attempt.
Six candidates evaluated, zero shipped. How a falsifiable-eval harness became a first-class KAOS feature — and why REJECT is a success.
Inline synaptic plasticity, Hebbian associations, failure triage. Measured +10pp retrieval accuracy, +15µs hot-path overhead.
Payment-platform modernization from kaos init to production — every wave, every agent, real output.
Memory stores what happened; skills store how to do it — templates that accumulate reliability across projects.
What it takes to run a large agent fleet against a single SQLite database — and where the real limits are.
Open source, MIT, local-first. Clone it, run the demo, read the verdicts — everything, including the rejections, is on GitHub.