ElsiumAI

The TypeScript framework for
governed AI agents

Multi-provider mesh, capability tokens, signed proofs, validators, replay — every layer of a production AI system, with the same TypeScript API.

Every AI framework helps you call an LLM.
None of them help you trust the result.

AI systems must fail predictably. They must be auditable. They must be reproducible. They must be governed by policy, not hope. Every feature in ElsiumAI exists to serve one of these principles. If it doesn't, it doesn't ship.

Three Pillars

What most frameworks ignore entirely.

Reliability

Your system stays up when providers break, recovers when outputs fail, and pauses gracefully when humans must decide — circuit breakers, bulkhead isolation, provider mesh, request dedup, graceful shutdown, CARG cascade routing, VAG repair loops, and pause + resume across restarts.

const mesh = createProviderMesh({
  providers: [
    { name: 'anthropic', config: { apiKey: env('ANTHROPIC_API_KEY') } },
    { name: 'openai',    config: { apiKey: env('OPENAI_API_KEY')    } },
  ],
  strategy: 'fallback',
  circuitBreaker: {
    failureThreshold: 5,
    resetTimeoutMs: 30_000,
  },
})

Governance

You control who does what, you can prove it, and you can revoke it — policy engine, RBAC, approval gates, hash-chained audit trail, agent identity, runtime policy enforcement, memory integrity, MCP trust framework, compliance reporting (OWASP Agentic, EU AI Act, Colorado AI Act), Ed25519 capability tokens (scoped, delegated, revocable), signed execution proofs anyone can verify offline, auto-approval gates on destructive tools, information-flow control that labels data and blocks exfiltration at the sink, a signed AI-BOM that fails CI on composition drift, and policy simulation that replays a candidate rule over recorded runs so you know its blast radius before enabling it.

const policies = createPolicySet([
  modelAccessPolicy([
    'claude-sonnet-4-6', 'gpt-4o-mini'
  ]),
  costLimitPolicy(5.00),
])

const audit = createAuditTrail({
  hashChain: true,
})

Reproducible AI

Tools to measure, pin, reproduce — and rewind — AI outputs. Seed propagation, output pinning, provenance tracking, determinism assertions, CAG confidence scoring (self-consistency, judge ensemble, logprob), fluent verification on the agent (withVerifier, withRetryPolicy), and auto-record + time-travel replay of every run.

const result = await assertDeterministic(
  (seed) => llm.complete({
    messages: [{ role: 'user', content }],
    temperature: 0,
    seed,
  }),
  { runs: 5, seed: 42, tolerance: 0 },
)

See It in Action

Clean APIs. Zero magic. TypeScript end-to-end.

import { gateway } from '@elsium-ai/gateway'
import { defineAgent } from '@elsium-ai/agents'
import { env } from '@elsium-ai/core'

const llm = gateway({
  provider: 'anthropic',
  model: 'claude-sonnet-4-6',
  apiKey: env('ANTHROPIC_API_KEY'),
  xray: true,  // Inspect every LLM call
})

const agent = defineAgent(
  {
    name: 'assistant',
    system: 'You are a helpful AI assistant.',
    model: 'claude-sonnet-4-6',
  },
  { complete: (req) => llm.complete(req) },
)

const result = await agent.run('What is TypeScript?')
console.log(result.message.content)
14 capabilities

Everything else, built in

The three pillars define the framework. These fourteen capabilities make it ship.

Agents

Memory, guardrails, confidence, state machines, ReAct, multi-agent orchestration, async + scheduled tasks.

RAG

Document loading, chunking, embeddings, vector search with MMR reranking, pgvector, hybrid search.

Workflows

Sequential, parallel, branching, retries, validation, resumable + idempotent checkpoints.

MCP

Bidirectional Model Context Protocol — client + server bridge, trust framework, capability-guarded calls.

NEW

Capability Tokens

Ed25519-signed, scoped, time-bound tokens for tools, LLM, MCP, RAG, data classes. Delegation + revocation built in.

NEW

Information Flow

Taint labels travel with the data and are checked at every sink. A prompt injection can succeed and the exfiltration still fails.

NEW

Verifiable Execution

Every agent run produces a signed ExecutionProof. Anyone can verify offline with the public key alone.

NEW

AI-BOM

A signed manifest of the models, prompts, tools and policies an agent is made of. elsium bom diff fails CI on drift.

NEW

VAG · CAG

Verification-Augmented Generation (validators + repair loop) and Confidence-Augmented Generation (self-consistency, judge ensembles).

NEW

Replay · Time-travel

Every agent.run() auto-records. Rewind to any step, swap a prompt, re-execute the tail. Free debugging time machine.

NEW

Pause + Resume

Agents that survive restarts. A tool throws pauseAgent(), state snapshots to a StateStore, resume hours later.

Cost Intelligence

Budgets, projections, loop detection, model recommendations. Now with CARG cascade routing + budget-aware policies.

Testing · Eval

Mock providers, LLM-as-judge, regression suites + budgets, multi-turn, red-team (44 probes), replay-vcr, signed replay, CI reporters.

Observability

Tracing, spans, metrics, X-Ray, OpenTelemetry + OTel GenAI semantic conventions, drift detection.

Negligible Overhead

Measured with zero-latency mock provider to isolate framework cost.

<10µs
P95 Overhead
33KB
Bundle Size (core, gzipped)
<3ms
Cold Start
2620
Passing Tests

Framework cost contribution: <0.01% of total request time. Typical LLM latency is 200–800ms.

Architecture

Modular by design. Use what you need, tree-shake the rest.

@elsium-ai/app
HTTP server · RBAC · auth · routes
agents
memory · guardrails · multi-agent
VAG · CAG · askHuman
pause + resume · auto-record + replay
mcp
client · server · tool bridge
trust framework · cap guard
cli
init · dev · eval · xray
prompts · verify · replay
bom verify · bom diff
gateway
providers
mesh
security
bulkhead
cache · batch
generateObject
CARG cascade
cap middleware
PII routing
flow middleware
tools
define
toolkit
validate
built-in
sandbox
contracts
cap guard
flow guard
observe
trace
audit
provenance
cost · experiment
proof recorder
verifyProof
AI-BOM · gate
policy simulation
OTel GenAI
drift · budget
rag
load
chunk
embed
vector
pgvector
registry
cap guard
workflows
steps
parallel
branch
retry
resumable
idempotent ckpt
client
HTTP+SSE
parsing
typed routes
@elsium-ai/core
types · errors · stream · logger · config · retry · result
circuit breaker · dedup · policy engine · shutdown manager
tokens · context manager · registry · schema · multimodal
Ed25519 crypto · key registry · write-once store · web crypto
capability tokens (mint · verify · delegate · revoke)
taint labels · label joins · flow policy · lethal trifecta · declassify
state store · pause signal · trace recorder · replayFrom · withToolTypes
@elsium-ai/testing
mocks · evals · red-team · multi-turn · agent metrics · CI reporters
replay-vcr · trace-replay overrides · regression budgets · signed replay · eval datasets · baselines

Reliability

core circuit breaker
core request dedup
core shutdown manager
core retry + backoff
gw bulkhead isolation
gw provider mesh
gw CARG cascade router
agt VAG repair loop
agt pause + resume
wfl resumable workflows

Governance

core policy engine
core Ed25519 capability tokens
obs verifiable execution (signed proofs)
agt runtime policy enforcement
agt agent identity
agt memory integrity
obs audit trail
obs compliance reporting
mcp trust framework
app RBAC
agt approval gates + auto-approval

Reproducible AI

gw seed propagation
test output pinning
test determinism assertions
obs provenance tracking
test req-matched fixtures
core crypto hashing
agt CAG confidence scoring
agt fluent verification
agt/core auto-record + replay
test trace replay + overrides

Get Started

Install ElsiumAI and build your first production-ready AI system.

bun add @elsium-ai/core @elsium-ai/gateway @elsium-ai/agents