Leviath

Most agent tools hand an LLM a flat message array and hope for the best. Leviath gives it structure: context that stays coherent across hundreds of tool calls, the right model for each phase of a task, and hundreds of agents running at once without melting your machine.

Use it for:

• Agents beyond coding: research, log analysis, daily briefings, and writing all ship out of the box
• Long tasks that stay coherent: context regions instead of a flat transcript
• Agents you drive from anything that speaks HTTP: a REST + WebSocket API with webhooks, backed by an always-on daemon
• Headless agents inside any Agent Client Protocol host
• Tinkering: an ECS world, workflow graphs, Rhai script tools, and a full TUI

lev run coder --task "Build a CLI that converts CSV to JSON"    # run a coding agent...
lev run deep-researcher --task "Survey solid-state batteries"   # ...or a research agent
lev ps                           # list running agents
lev msg <agent-id> "..."         # steer a running agent mid-task
lev respond                      # answer questions agents are waiting on
lev dash                         # watch everything in the TUI dashboard
lev serve                        # REST + WebSocket API server
lev agent-client --agent coder   # serve an agent over the Agent Client Protocol
lev create my-agent              # scaffold your own agent

macOS (Homebrew, recommended):

brew tap gemisis/leviath https://github.com/GEMISIS/leviath-dist.git
brew trust gemisis/leviath          # Homebrew 6 requires trusting third-party taps
brew install leviath                     # stable - or: leviath-beta, leviath-alpha

Linux:

curl -fsSL https://raw.githubusercontent.com/GEMISIS/leviath-dist/main/install.sh | bash -s -- --channel stable

Windows (PowerShell or Scoop):

irm https://raw.githubusercontent.com/GEMISIS/leviath-dist/main/install.ps1 | iex
# or: scoop bucket add leviath https://github.com/GEMISIS/leviath-dist.git && scoop install leviath

All of the above install prebuilt binaries; no Rust toolchain needed.

Cargo (any platform, requires Rust):

cargo install leviath-cli                # released version from crates.io
cargo install --git https://github.com/GEMISIS/leviath.git --bin lev   # latest development build

Leviath is also a library: add the leviath crate to embed the runtime in your own application.

One provider is all you need: an API key from Anthropic, OpenAI, Google AI, or OpenRouter. No key at all? Run a local Ollama, or use the Claude Code transport below.

lev setup                                            # interactive wizard
lev setup --non-interactive --anthropic-key sk-ant-...  # scriptable

lev run coder --task "Add pagination to the /users endpoint"

# ...or try a non-coding agent
lev run log-analyzer --task "Find what caused the error spike in ./logs last night"

lev run hands the agent to a background daemon that hosts every agent in one shared world, so runs keep going after your terminal closes. For unattended agents, lev daemon install puts it under launchd/systemd so it starts at login, restarts if it dies, and reloads interrupted runs. Daemon docs →

lev create my-agent        # scaffolds a new agent directory
cd my-agent
lev run . --task "Your task here"

This writes an agent.leviath config you can customize: models per stage, context regions and their budgets, tools, and the workflow graph. Agent configuration →

Ten agents ship out of the box, each a multi-stage directed graph with structured context regions, per-stage model fallback, and error recovery. In the graphs below, diamonds are LLM-routed or human-in-the-loop decisions, and dotted edges fire automatically on a runtime condition (like the stuck detector) rather than by the agent's choice.

Agent	Workflow
software-engineer Full coding workflow: codebase discovery, human-approved planning, an optional prototype spike, stuck detection
wide-researcher Broad multi-topic landscape survey: compares approaches, dives on interesting threads
deep-researcher Thorough single-topic investigation: follows citation chains, cross-checks claims, writes a cited report

The other seven: coder, reviewer, parallel-fixer, researcher, log-analyzer, daily-briefer, writing-assistant

Agent	Workflow
coder Focused implementation with discovery, an optional prototype spike, stuck detection, and a review loop
reviewer Code review and audit, grounded in a discovery pass; read-only
parallel-fixer Fixes many failing tests at once: one sub-agent worker per failure, merged and re-verified
researcher General-purpose research with a gather↔analyze refinement loop
log-analyzer Log analysis with scripted aggregation, severity-ranked findings
daily-briefer Morning summaries from local and web sources
writing-assistant Research-backed writing with an interactive outline checkpoint and a draft⇄edit loop

Eight region kinds with deterministic eviction: architecture stays pinned, tool results evict first, and conversation auto-compacts into summaries. Route reads to specific regions so a file dump can't push out your system prompt. Budgets can be percentages of the model's context window, so a blueprint's intent survives across models of different sizes. And when the built-ins don't fit, a custom region hands one region's rendering, writes, and eviction to a Rhai script you control - up to owning the entire context window as a single scripted region. Learn more →

Each stage gets its own model, tools, and context layout. Run them linearly or as a directed graph with conditional transitions, error recovery, and LLM-driven routing, then check the graph with lev validate. A stuck edge escapes a stage that is making no progress, and stuckness is measured by the runtime (iteration counts, repeated edits to one file), not self-reported by the model. Learn more →

Agents run as entities in a bevy_ecs world. Hundreds can share one process with game-engine-style scheduling (ten agents each fanning out to ten sub-agents is still one process), instead of that many OS processes fighting for resources.

And no, hundreds of agents won't stampede your provider: a shared per-model inference pool caps how many requests are in flight to each model across the whole world, and an agent waiting for a slot just sits as data until one frees. Optional per-provider rate limits (requests and tokens per minute) are enforced on top, before every call. Learn more →

Agents spawn children with different blueprints. A fan-out stage splits a task into work items, runs one sub-agent worker per item concurrently, and merges the results back into the parent, all in the same process. Any sub-agent, at any depth, can ask the user questions directly. Learn more →

The core primitive is mid-run message injection: lev msg (or the API) drops a message straight into a running agent's context, and the model sees it on its next inference call, so you redirect or add constraints without restarting. Stages can opt out with accepts_messages = false; a message then waits in the inbox until a stage that accepts it. Force checkpoints with interaction_points (approve, request revisions, or edit the agent's output directly), or grant ask_user_* tools so the agent asks on its own judgment. Learn more →

By default an agent's shell commands run on your machine with nothing extra to install. When you want isolation, opt in per agent or per stage: hardened containers (Docker/Podman, capabilities dropped, warm per agent) or lighter Linux namespaces, mixable within one workflow - and an installed agent can tighten its sandbox but never turn one off. Experimental taint tracking labels every context region's sensitivity and gates exfiltration-capable tool calls before they fire, with allowlists and scripted policy rules on top. Learn more →

lev dash is a full TUI for managing concurrent agents: stage tabs, context-window visualization, markdown rendering, sub-agent tree view, and full mouse support including drag-to-copy (works over SSH). Press m to manage MCP tool servers without leaving the dashboard. Dashboard docs →

lev serve exposes a REST + WebSocket API, so anything that speaks HTTP can integrate with it. No SDK required. It covers agent lifecycle, human-in-the-loop interaction, per-agent streaming, and signed webhook callbacks on completion, and it ships a browser console at /app for driving agents from a web page. Because the API can spawn tool-executing agents, it refuses to start without a token and binds to 127.0.0.1 by default.

export LEVIATH_API_TOKEN="$(openssl rand -hex 16)"
lev serve --port 3000

# spawn an agent (with a completion webhook + signing secret)
curl -X POST http://localhost:3000/api/agents \
  -H "Authorization: Bearer $LEVIATH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"blueprint": "coder", "task": "Add input validation",
       "callback_url": "https://example.com/hook",
       "callback_secret": "whsec_…"}'

Full API reference →

Production deployments can export structured traces, metrics, and logs over OpenTelemetry. Every run becomes a trace (agent.run → agent.stage → per-call agent.inference / agent.tool_call spans) alongside token counters, latency histograms, and log records carrying the run's trace ID. Off by default; one config block turns it on. Observability docs →

lev agent-client --agent coder serves any Leviath agent over the Agent Client Protocol (JSON-RPC 2.0 over stdio), so hosts like Zed and Gas City can drive a headless agent as a child process. Wiring it into a host is config, not code. A session/prompt stays in flight until the run genuinely finishes, and hosts with session/request_permission get interactive tool approval in-turn. Editor integration docs →

"ACP" is claimed by two unrelated protocols; Leviath implements the Agent Client Protocol (JSON-RPC/stdio), not BeeAI's Agent Communication Protocol.

Leviath is a runtime that orchestrates agents, not a coding agent itself, so we don't publish head-to-head numbers against tools like Claude Code or Codex. They sit at a different layer of the stack. What we measure, on the same tasks with the same models:

• Structured vs flat context: the same Leviath runtime with regions enabled vs disabled, scored on held-out test pass rate, total billed tokens (including cache reads and writes), and cost.
• Resource footprint: absolute memory of one daemon running many concurrent agents.

Methodology and raw data will be published alongside the benchmark results.

These four tools sit at different layers of the agent stack and make different architectural bets. Claude Code is a polished coding agent with an SDK to embed its harness, CrewAI and LangGraph are frameworks you build agents in, and Leviath is a standalone runtime agents run on. None is a drop-in replacement for another, so this table compares models, not merit; competitor descriptions come from each project's own documentation.

And here is Leviath scored against 12-Factor Agents, including where it falls short today:

• It's not a replacement for Claude Code, Codex, or your favorite coding agent. Leviath is a runtime for building and orchestrating agents. Those are polished interactive products at a different layer, and Leviath can even run on top of Claude Code as a transport.
• Agents are config, not code. A Leviath agent is a TOML blueprint plus optional Rhai script tools. If you want to write agent logic as Python or TypeScript against an SDK, that model isn't here; other languages drive Leviath through the REST API instead.
• It runs on one machine. The daemon hosts every agent in a single process on a single box. There is no hosted service and no multi-machine orchestration.
• You need a model provider: an API key, a local Ollama, or the Claude Code transport (with its terms-of-service caveat).

The At a glance block above covers the daily commands; the full surface (packaging, testing, policy, auth, daemon control) is in lev --help and the CLI reference.

Leviath also connects to Model Context Protocol tool servers over stdio or HTTP: lev mcp add detects OAuth servers and opens your browser to log in, and tokens are stored with 0600 permissions and refreshed automatically. MCP docs →

Anthropic, OpenAI, Google (Gemini), OpenRouter, local Ollama with no key, and the Claude Code subscription transport, with per-stage model fallback, optional client-side rate limits enforced before each call, and custom OpenAI-compatible providers as Rhai scripts. Provider docs →

Channel tags roll with every publish; each stable deploy also cuts an immutable versioned release (vX.Y.Z, date-suffixed when the same version ships twice). One binary is built on alpha and promoted unchanged through beta and stable, checksum-verified at every hop, and each channel's docs are rendered from the exact commit its binaries came from. Release docs → · distribution repo

Leviath runs LLM-driven tools on your machine, so SECURITY.md states plainly what it defends against (a malicious agent package, prompt injection reaching an agent's tools, a hostile MCP server, another local user) and what it does not, including that the model can do anything you granted it. It also covers vulnerability reporting, where every secret lives, hardening a lev serve deployment, and verifying a release's signed build provenance.

git clone https://github.com/GEMISIS/leviath.git
cd leviath
cargo build
cargo test --workspace

The pre-commit hook installs itself on first build, with no setup step, and enforces formatting, clippy, doc lints, and the full test suite. The workspace is gated at a hard 100% coverage on lines, regions, and functions, with no opt-outs and coverage-suppression markers banned by lint; CI enforces it on Linux, macOS, and Windows. The only exclusion is the thin lev binary entrypoint, guarded by a CI check. Details on the hook, ast-grep, and the coverage tooling: CONTRIBUTING.md.

graph TD
    CLI["leviath-cli<br/><i>CLI binary (lev): args, TUI, serve, run adapters</i>"]
    RT["leviath-runtime<br/><i>ECS engine (bevy_ecs) + stage-run orchestration seams</i>"]
    CORE["leviath-core<br/><i>Regions, layouts, blueprints, manifest, run metadata</i>"]
    ACP["leviath-agent-client<br/><i>Agent Client Protocol wire types (JSON-RPC/stdio)</i>"]
    PROV["leviath-providers<br/><i>Anthropic · OpenAI · Google<br/>OpenRouter · Ollama · Claude Code</i>"]
    MCP["leviath-mcp<br/><i>MCP tool integration (stdio + HTTP/SSE)</i>"]
    SCRIPT["leviath-scripting<br/><i>Rhai sandbox</i>"]
    PKG["leviath-package<br/><i>Agent bundling & install</i>"]
    TOOLS["leviath-tools<br/><i>Built-in tool implementations</i>"]
    SYS["leviath-sys<br/><i>All OS-specific syscalls (perms, signals, TTY)</i>"]

    CLI --> RT
    CLI --> ACP
    ACP --> CORE
    CLI --> SCRIPT
    CLI --> PKG
    CLI --> TOOLS
    CLI --> SYS
    RT --> CORE
    RT --> PROV
    RT --> MCP
    PROV --> SYS
    PKG --> SYS

MIT © Gerald McAlister

Website · Docs · GitHub · Issues