Run a team of AI agents.
Sandboxed. Recorded. Learning.

KAOS runs swarms of AI agents on your machine. Each agent works in its own private sandbox inside a single SQLite file, every action it takes is on the record — auditing an agent is a SQL query — and the lessons that actually worked are remembered and re-ranked for next time. No cloud account, no GPU, no embeddings.

$pip install kaos-harness && kaos demo --print

One measured screen in about 2 seconds — no API keys, nothing written to your directory. Using Claude Code? claude plugin marketplace add canivel/kaos

v2.1.1 falsifiable eval 16 mechanisms evaluated · 0 shipped on hope Claude Code plugin 58 MCP tools 971 tests on PyPI · MIT · local-first
ARC-AGI-3 · ARC Prize 2026 #39of ~1,700 teams · top 2.3% 🥈 KAOS competing autonomously · score 1.33 (Jul 24, ↑ from 1.02) · view leaderboard →

Rank #39 as of Jul 18; score as of Jul 24, 2026 — entered solo by canivel, run by KAOS itself. The harness, doing the competing.

KAOS Meta-Harness: a text classifier improves from 45% to 87% accuracy across 10 automated search iterations, in the terminal
Harness engineering, automated: 45% → 87% classifier accuracy in 10 search iterations · uv run kaos mh search
What is KAOS?

A safe place for agents to work — that gets smarter as they do.

KAOS is not another coding agent. It's the infrastructure underneath agents: you bring the model (Claude, GPT, or a local one), KAOS supplies everything around it.

Sandboxed agentsEach agent gets its own private filesystem. Your real files are never touched until you copy results out yourself.
Everything on the recordEvery tool call, file write, and decision lands in an append-only journal. "What did the agent do, and why?" is a SQL query.
Checkpoints & time-travelSnapshot an agent before a risky step; restore it byte-for-byte when things go wrong.
Memory that learnsTeam lessons and skills are re-ranked by real outcomes — what worked rises, what keeps failing is pruned. We call it neuroplasticity.
Features proven, not promisedEvery KAOS mechanism must survive a pass/fail kill test locked before its code exists. Most candidates fail; you get the survivors.
Works with your tools58 MCP tools for Claude Code, Cursor, or any MCP client; a CLI with --json everywhere; a live terminal dashboard.
Any model, five providersAnthropic, OpenAI-compatible, Claude Code, Claude Agent SDK, or fully-local vLLM — all behind one router.
One file, zero servicesThe entire runtime — agents, files, journal, memory — is one SQLite kaos.db. Copy the file and you've copied everything.
Get started

Three steps to your first swarm.

The demo needs no configuration and no API keys. You connect a real model provider only when you put agents on real work.

1

Install and see it run

$ pip install kaos-harness
$ kaos demo --print

Seeds 50,000 memories in a temporary file, runs a real cross-agent search and prints the measured p95, shows the audit table, exits — about 2 seconds, nothing written here. pip install 'kaos-harness[all]' && kaos demo opens the live dashboard instead. The base package has 4 dependencies; extras tell you their own install line when needed.

2

Plug it into Claude Code — or run your own swarm

$ claude plugin marketplace add canivel/kaos
> /plugin install kaos@kaos            # every session journaled; team memory recalled at start

$ kaos parallel -t fix   "fix the double-charge bug in payments.py" \
               -t tests "write pytest tests proving the fix" \
               -t review "security-review the module"

The plugin turns each Claude Code session into an auditable KAOS agent and injects the lessons your team saved (no marketplace? kaos connect claude-code). Or run three agents in parallel, each in its own sandbox, and watch them with kaos ui.

3

Inspect, then take what's good

$ kaos query "SELECT agent_id, tool_name, COUNT(*) FROM tool_calls GROUP BY 1,2"
$ kaos read <agent> /src/payments.py > payments.py

Nothing reaches your working directory until you copy it out. The full audit trail of who did what stays in kaos.db forever. Here's what that looks like on a real bug ↓

A real session

Bug to green tests to a smarter brain.

An actual KAOS 2.0.2 session, real model calls throughout: a payments module that double-charges on timeout retries, fixed by a swarm — then the workspace learns from it.

01

Three agents on the bug, in parallel

$ pip install 'kaos-harness[all]' && kaos init
$ kaos parallel \
    -t fix    "double-charges on timeout retry — fix with an idempotency key ..." \
    -t tests  "pytest tests proving the key is generated once and reused ..." \
    -t review "security-review beyond the retry bug ..."

Agent fix (ok)    Agent tests (ok)    Agent review (ok)
02

Sandboxed and on the record

$ kaos query "SELECT a.name, t.tool_name, COUNT(*) FROM agents a
    JOIN tool_calls t ON t.agent_id=a.agent_id GROUP BY 1,2"
fix     fs_write x1   tests  fs_read x1, fs_write x1   review  fs_mkdir x1, fs_write x1

$ ls                        # your working directory: untouched
kaos.db  kaos.yaml  payments.py

$ kaos read <fix> /src/payments.py > payments.py
$ kaos read <tests> /tests/test_payments.py > tests/test_payments.py
$ pytest tests/ -q
6 passed in 0.09s          # agent tests, green against the agent fix
03

Then the brain learns

# sprints later: 17 skill outcomes, 6 recalls, 12 hebbian edges of telemetry
$ kaos dream consolidate --apply
{ "promoted": 1, "pruned": 1, "applied": 2 }

# the 6×-retrieved lesson became a skill; the 1/6 flaky skill is hidden:
$ kaos skills search "deploy service"
deploy-canary-checklist     # only the one that actually works (5/5)

$ kaos memory search "timeout retry"
payment-retry-idempotency → "client timeout != server failure. Fix =
Idempotency-Key generated once per logical charge, reused across retries."
04

Failures stay honest

# an earlier run of this same session — one agent stalled:
$ kaos logs 01M1FG26...
agent_fail | {"error": "claude produced no output for 60.0s"}

# exact cause on the record → became the 2.0.2 agent_sdk fix
# (isolated in-process sessions — no CLI contention, no stalls).
# and the one recall miss we hit is filed, with a probe sketch:
$ kaos memory search "duplicate processing"
no match   # FTS is literal — measured, disclosed, issue #42

# v2.1: we benchmarked ourselves and published the losses too
$ uv run python benchmarks/afb/run_afb.py
fault_localization  median 9.5 entries  gate ≤ 5   REJECT   # real localizer bug, issue queued
$ uv run python benchmarks/cc_hook_latency/run_cc_hook_latency.py
prompt p95 275 ms  gate ≤ 200          REJECT:prompt  # prompt-time recall ships off
Why KAOS

Four things no other harness combines.

Each pillar is verifiable in the repo today — and each claim below was checked against the primary docs of the competing frameworks in the table above.

01 · Proof, not vibes

We try to kill our own features before you meet them

Every mechanism must survive a pass/fail test that is written and cryptographically locked before its code exists — so nobody can move the goalposts when the results disappoint. A self-test first proves the feature can lose; then the verdict (ACCEPT / REJECT / VOID) is binding, no retune-and-rerun. In research terms: a pre-registered, falsifiable kill test — KAOS is the only framework that pre-commits to one. Most candidates fail. The features you get are the survivors.

13 candidates evaluated since v0.7 · 0 shipped on hope · every verdict on disk with its audit trail
02 · Flight recorder

Auditable by construction, not by add-on

One SQLite file holds every agent's virtual filesystem, an append-only journal of every event and tool call, content-addressed blobs, and checkpoints with byte-exact restore. Audit isn't a telemetry exporter you bolt on — it's the storage engine. Any SQLite client, or plain SQL, answers "what did the agent do, and why?"

Read-only enforced at the SQLite parse layer · checkpoint time-travel · copy one file = full forensic snapshot
03 · Compounds with use

Memory that earns its ranking

Neuroplasticity: every skill outcome, memory retrieval, and failure updates usage statistics — Wilson-bound success rates, Hebbian co-occurrence, recency decay. Retrieval reranks on evidence of what actually worked, and consolidation prunes what didn't. Not an LLM rewriting its own notes — arithmetic on recorded outcomes.

Measured +13.3pp top-1 retrieval (15-query realistic bench; +10pp on the 10-query adversarial one — small-n, disclosed) · +15µs hot-path — benches committed in repo
04 · Sovereign by default

Local-first. Nothing phones home.

No mandatory cloud, no default telemetry upload, no SaaS eval dependency, no vendor login. Five model providers — Anthropic, OpenAI-compatible, Claude Code, Agent SDK, and fully-local vLLM — behind one router. Your agents, your data, your single file, your infrastructure.

Cross-agent search: 9ms p95 at 10,000 agents in one file — measured, bench in repo
Honest comparison

Where each harness stands.

Most tools below are coding agents or orchestration graphs. KAOS is the layer underneath — the sandbox, audit trail, and shared memory their agents can run on top of. Where we overlap, here's the honest picture, verified from primary docs (Jul–Sep 2026); competitors' real strengths are conceded below the table.

Framework Features proven before shipping Full audit trail + time-travel Memory that learns from outcomes Runs fully local License
KAOS✓ hash-locked, self-falsifying kill gates✓ VFS + journal + checkpoints, one SQLite file✓ measured, n disclosed✓ incl. local modelsMIT
Pi◐ JSONL session files + branching; no tool-call journal or checkpoints✓ incl. llama.cppMIT
Hermes Agent1◐ agent-curated learning loop✓ (hosted tiers optional)MIT
LangGraph— eval via LangSmith SaaS◐ checkpoint time-travel; no event journal✓ (platform is SaaS)MIT
Google ADK◐ eval thresholds, no pre-registration✓ (Vertex is the upsell)Apache-2.0
Letta◐ .af state snapshot; not an action journal◐ LLM self-editing memory◐ Postgres self-host; cloud is the pushApache-2.0
CrewAI— scores, no gate— logging is Enterprise-tier◐ memory dedup/consolidation✓ (AMP is SaaS)MIT
OpenAI Agents SDK— evals on OpenAI platform— tracing to OpenAI by defaultMIT
Claude Agent SDK◐ JSONL transcripts; DIY audit via hooks— requires cloud LLM APICommercial ToS
smolagents— no built-in persistenceApache-2.0

✓ shipped in-framework · ◐ partial or different approach · — not found in primary docs as of Jul–Sep 2026 (corrections welcome — open an issue). 1 Hermes documents command-approval and container isolation; no append-only audit journal or checkpoint/restore appears in its docs. Credit where due: Pi's session trees and minimal self-extensible core are excellent — KAOS is designed to run underneath a Pi or Claude Code workflow, not to replace it. Likewise LangGraph's checkpoint time-travel, ADK's eval thresholds, smolagents' sandboxed executors, Letta's sleep-time memory agents, and Hermes' ecosystem reach are genuinely good. KAOS's bet is different: verification and auditability are the product, not features.

New · The shared brain

KAOS workspaces now share a brain: Attraktor.

Your agents learn lessons the hard way — real tasks, real failures, real compute. Until now those lessons died with the workspace. Attraktor is the registry they flow into: every entry was proven against real outcomes before admission, every rejection is kept with its reasoning, and every workspace pulls what's proven — matched to the task in front of it.

chaos → organized, validated, shared. KAOS runs the chaos; Attraktor is what it converges toward.

Push what you proved

Skills and mechanism verdicts that survive KAOS's kill-gate experiments are content-addressed and published. The server re-hashes every record's bytes — nothing enters on trust.

Pull what's proven

On task start, agents receive matched, validated lessons — each stamped with the trust level it earned and where it applies. Verified again on your side before anything is served.

Failures are data

A disproven idea, with the experiment that killed it, saves the next workspace from paying for the same dead end. Most registries hide failures. Attraktor keeps them, forever.

$ kaos bench pull "agent episode failed - localize the decisive failure step"

graphdiff-localizer-probe-v1 · T1 · partial
  Contrastive failed-vs-success trajectory diffing locates decisive failure
  steps far better than single-trajectory heuristics — but only where
  trajectories share vocabulary. Before building any trajectory-graph
  mechanism, measure your workload's node-reuse rate first.

That lesson cost another workspace a full probe run. This fresh, empty workspace got it in one command, cryptographically verified.  Open Attraktor (dev preview) →

Real code

Three examples, straight from the repo.

Runnable today — these are condensed from examples/, not pseudo-code.

01

Isolated agents, audit, and time-travel — in 12 lines

library_basics.py
from kaos import Kaos

db = Kaos("team.db")                    # one SQLite file — the whole runtime

alice = db.spawn("alice", config={"role": "researcher"})
bob   = db.spawn("bob",   config={"role": "implementer"})

db.write(alice, "/notes.md", b"# Findings\n- auth.py: 3 bugs")
db.read(bob, "/notes.md")                # FileNotFoundError — isolation is enforced

cp = db.checkpoint(alice, label="before-refactor")
db.write(alice, "/notes.md", b"# Findings\n- 5 bugs total")
db.restore(alice, cp)                    # byte-exact time travel

db.query("SELECT event_type, COUNT(*) FROM events GROUP BY 1")  # audit = SQL
02

Prove your harness change actually helps

falsifiable_probe.py
from kaos.eval.harness import Probe, GateOutcome, bootstrap_diff_ci

class FewshotProbe(Probe):
    lock_path    = "ISA.lock.json"        # kill gates, written BEFORE any code
    known_sha256 = {"5aa9c10d…": "v1"}    # edited lock → harness refuses to run

    def gates(self, arms):
        md, lo, hi = bootstrap_diff_ci(arms["FULL"].labels({"hard"}),
                                       arms["B0"].labels({"hard"}))
        return [GateOutcome("G1", "beats baseline",
                            passed=md >= 0.10 and lo > 0.0, kill=True,
                            detail=f"diff={md:+.3f} lo={lo:+.3f}")]

probe = FewshotProbe()
_, verdict = probe.falsify()   # FULL := B0 must emit [KILL] — or the probe is inadmissible
result = probe.run(out_dir=".")  # binding ACCEPT / REJECT / VOID. No retune.
03

Drive it from your editor, terminal, or CI

58 MCP tools · CLI --json everywhere
# From Claude Code / Cursor / any MCP client — natural language:
with kaos, review my payments module — run a security agent
and a test-writing agent in parallel

# Or the CLI:
kaos parallel -t security "find vulnerabilities in auth.py" \
              -t tests    "write unit tests for auth.py"
kaos ui                                  # Gantt of every agent, live events
kaos eval probe run --probe my.bench:MyProbe --out-dir out/   # exits ≠0 on REJECT — CI-gate your harness
kaos query "SELECT tool_name, COUNT(*) FROM tool_calls GROUP BY 1"
The harness era

2026 is the year "harness engineering" got a name.

KAOS has been building on this premise since v0.1 — and it answers the critique the discourse hasn't solved.

A decent model with a great harness beats a great model with a bad harness.
Anytime you find an agent makes a mistake, you engineer a solution such that the agent never makes that mistake again.
What's missing from the story: verification that the change actually helped.
The open critique of harness engineering (Böckeler, martinfowler.com, paraphrased) — exactly the gap KAOS closes
Enterprise

Built for the questions procurement actually asks.

Gartner predicts 40%+ of agentic AI projects will be canceled by 2027 — costs, unclear value, inadequate risk controls. KAOS's architecture answers each failure mode directly.

EU AI Act · Art. 12

Automatic, tamper-evident logging

High-risk AI systems must automatically record events over their lifetime, queryable by an inspector — binding Aug 2026. KAOS's append-only event journal in SQLite is that record: every tool call, file write, and decision, answerable in SQL.

Deployment gates

Eval-gated releases, not spot checks

The 2026 norm: promotion decided by regression evals in CI. kaos eval probe run exits non-zero on REJECT/VOID — your agent-harness changes gate exactly like code. Pre-registration makes the gate tamper-evident.

Data sovereignty

On-prem is the default, not a tier

Sovereign deployment is now a first-class procurement gate in finance, health, and public sector. KAOS runs entirely on your metal — local models included — and the whole estate is one file you can place, move, or destroy under your own regime.

Observability

Execution and intent

Regulators want what the agent did and why. KAOS records both: the tool-call journal (execution) and the SharedLog's intent → vote → decide records (intent) — consensus before consequential actions, on the record.

Kill switch

Terminate and prove you terminated

Most orgs reportedly can't quickly stop a misbehaving agent. kaos kill <id> is immediate; the kill lands in the journal; systemic alerts halt auto-spawns when many agents hit the same failure fingerprint.

Cost control

Token discipline, measured

Agent budgets broke every model in 2026. KAOS tracks tokens and cost per tool call in the journal (SQL your spend), and AAAK context compaction delivers a measured 57% token saving at zero quality loss on its benchmark.

KAOS isn't a demo framework that hopes to grow up — it runs daily inside a real enterprise data & AI organization, built by an engineering leader who has to answer these questions for a living. It was built for audits, not just demos.

See it run

Real CLI. Reproducible.

Every demo is a recording of the actual terminal surface — reproducible from the commands shown.

Parallel agents on a Gantt dashboard with live events

Parallel agents + dashboard

Spawn a swarm; watch each agent as a Gantt bar with a live event feed.

KAOS MCP server exposing 58 tools to Claude Code

MCP server · 58 tools

Drive KAOS from Claude Code, Cursor, or any MCP client with natural language.

Neuroplasticity: weighted rank flips top-1, failure triage, systemic alert

Neuroplasticity in action

Outcomes reported → weighted rank flips the top result → failures triaged → systemic alert fires.

v0.8.3: quality score, failure taxonomy, critical-step localizer, war room

Failure intelligence & war room

Quality scores, taxonomy, critical-step localization, and the war-room UI.

Release history

Shipped, in the open.

Every release traces its numbers to a committed benchmark. Full history on GitHub.

v2.1.0–2.1.1Sep 2, 2026latest
Attaches to the tools you already run — and publishes its numbers, including the failed ones. 971 tests.
  • Claude Code pluginclaude plugin marketplace add canivel/kaos: every session becomes an auditable agent in kaos.db, team memory is injected at session start, the 58-tool MCP server auto-registers, /kaos:recall searches memory. A pre-registered latency probe rejected prompt-time recall (275 ms p95 vs a 200 ms gate), so that hook ships off by default — session-start passed at 241 ms.
  • kaos demo --print — the terminal aha: 50k memories, a measured p95, the audit table, ~2 s, nothing written. ulid-py removed: it cost 216 ms of every CLI start.
  • Benchmarks, hash-locked before running, results committed as found — Paraphrase Recall Gap (owns issue #42: 100 % miss on paraphrases with the default query); LongMemEval-S split-reported (verbatim 0.991 / paraphrase 0.965, with the caveats spelled out); Agent Forensics Bench v1 — five tests pass, fault localization REJECTED (median 9.5 entries vs ≤ 5): a real localizer bug, published, issue queued.
  • kaos-eval GitHub Action runs them on every release and fails on REJECT — so the next release fails until the localizer is fixed. Plus a Pi extension (integrations/pi-kaos), a plugin template, CONTRIBUTING.md, and five good-first-issues.
v2.0.0–2.0.2Sep 1, 2026
KAOS 2 — pip-installable, modular, extensible. 948 tests passing.
  • On PyPI as kaos-harnesspip install 'kaos-harness[all]' then kaos demo: live dashboard, zero API keys, two commands. Slim 5-dependency base; [router] / [mcp] / [ui] / [agent-sdk] extras, each missing extra prints its own install line.
  • Plugin surface — the kaos.plugins entry-point group: third-party providers, benchmarks, and MCP tool packs with zero core changes.
  • agent_sdk provider fixed (2.0.2) — fully isolated in-process sessions (the SDK used to inherit the user's own MCP servers into agents) with real tool-calling; the recommended provider next to an active Claude Code session. Validated by a live end-to-end run: 3 parallel agents, all writes in sandboxes, agent-written tests green against the agent-written fix, then the dream cycle promoting one memory to a skill and pruning a 1/6 flaky skill.
  • Launch sweep fixed 4 latent defects red-first — including consolidate --apply after a dry-run applying nothing, and two undeclared-dependency bugs only a clean-install test could catch.
v0.10Aug 8, 2026
Tier-1: measure & harden — 764 tests passing
  • storage-scale-bench: single-DB does not saturate — cross-agent FTS5 search is 9 ms p95 at 10k agents. Per-agent-DB sharding rejected by measurement.
  • synchronous=NORMAL default — measured ~125× faster write p95 (1895 ms → 15 ms) and ~38× throughput under contention.
  • verify-numerics — numbers in generated artifacts must trace to recorded measurements; router reliability + cluster-bootstrap verdict statistics.
v0.9.2Jun 24, 2026
Tier-0 correctness debt — 650 tests passing
  • Storage hardening: fixed a version-collision crash, a reader-lock that blocked writers, and a query() read-only bypass — now enforced at the SQLite parse layer.
  • Eval-harness integrity: the verdict instrument's own bugs (a tautological judge, empty-gates auto-ACCEPT) fixed red-first.
  • CORAL pivot un-deadlocked — the stagnation pivot could never fire; now it does, with regression coverage.
v0.9.0–0.9.1May 24–26, 2026
Falsifiable-eval primitive + MCP exposure (50 → 58 tools)
  • Six candidates evaluated, zero mechanisms shipped — the discipline is the deliverable. Each verdict on disk with its audit trail.
  • kaos.eval.harness — hash-locked probes, blind judge, uniform ACCEPT/REJECT/VOID rule; kaos eval probe + an experiments journal.
  • P0 proposer-timeout fix (streaming + idle/wall timeouts); 58 MCP tools. Read the post →
v0.8.3May 13, 2026
Finer-grained outcomes, failures, objectives — and a war room
  • Quality score [0,1], reasoning-class failure taxonomy, and a critical-step localizer (5/5 planted bugs localized within ±1 step).
  • Ideal-State Artifacts (declare what "done" means) and a war-room UI — a single static file, no stack change.
Writing

How it works, in depth.

Long-form walkthroughs with real CLI output and measured results.

The harness is the product.
Make yours provable.

Open source, MIT, local-first. Clone it, run the demo, read the verdicts — everything, including the rejections, is on GitHub.