Every other coding agent's marginal cost is flat and its memory resets. Atlas gets cheaper, warier, and more trusted every week you use it.

Atlas is an open-source, model-agnostic, terminal-first coding agent with a persistent intelligence layer, a verification suite that attaches machine-checked receipts to every change, a learning pipeline that compiles repeated LLM work into deterministic zero-token codemods, and a workspace UI that teaches you the product from inside the product.

It works in your git repos — and in any plain folder. cd ~/scratch && atlas "write a scraper for this site" sets up a full workspace (undo, sessions, learning) with one keystroke. Git optional.

npm i -g @atlas-agent/cli                     # Node 20+ (prebuilt SQLite; C toolchain only if none matches)
# or from source:  npm i -g github:klingaling/atlas-agent#main

cd anything/                                  # a repo, or any folder at all
export ANTHROPIC_API_KEY=sk-ant-...           # or bind roles to a local model — fully offline works
atlas                                         # bare `atlas` opens the workspace UI
atlas "fix the failing test"                  # or just say what you want

Five things no other agent on the market does — each one structural, not a feature that can be bolted on:

1. Its memory is verified, not vibes. The 2026 memory arms race (inferred preference profiles, screen-watching memories, learned rules) is entirely unverified prose that decays and hallucinates. Atlas's memory is mined, replay-verified, and revocable: landmines come from your repo's actual revert history, compiled skills must pass byte-exact replay before activation, trust is a ledger of verified outcomes, and the facts it knows about you are ones you explicitly wrote (atlas remember) in a plain file you can read, edit, and delete. Other agents remember vibes. Atlas remembers evidence.

2. Its marginal cost curve bends down. Every competitor's unit economics are flat or rising. Atlas's Muscle Memory compiles the third occurrence of a repeated edit pattern into a verified AST codemod — from then on that class of work costs $0 and runs in under a second. Routine git never touches a model at all (the zero-token palette). A per-repo private benchmark, mined from your own merged PRs, tells you the cheapest model that keeps up on your code — and Drift Canaries catch a provider silently degrading that model behind a stable API name.

3. It can answer for every line — to you and to an auditor. Decision Blame records which model version wrote which line, with what context, at what cost (atlas why src/x.ts:42). That makes two things possible nobody else can do: Code Recalls — when a model version is found defective, enumerate every hunk it wrote, re-verify, and repair it like a manufactured-part recall — and atlas release manifest, a signed per-release AI-provenance disclosure (share of the diff by model fingerprint, verification coverage, recall status). With AI-content disclosure regulation now in force, this is the compliance artifact your security review asks for — and it cannot be retrofitted, because provenance can't be recorded retroactively.

4. Verification is machine-checked, not LLM opinion. Every "AI code review" product ships model judgment about model output. Atlas ships receipts: ed25519-signed claims that are executed, not asserted — API surface diffed, linked tests run, mutants planted and survived-or-killed (Polygraph: if your test suite can't catch planted bugs, Atlas tells you it doesn't trust your tests, and shows you the surviving mutants as diffs). Claims that can't be verified are skipped with a stated reason, never silently passed.

5. Autonomy is earned, never configured. Permission prompts get rubber-stamped (~93% approval rates make them behaviorally meaningless) and hand-configured allowlists are wishes. Atlas's trust ladder promotes per path scope from a verified track record — 20 clean merges with zero reverts earns src/api/ autonomous commits; one revert demotes it immediately and arms careful mode. The trust heatmap shows exactly where the agent has earned its independence and what it would take to earn more.

And the foundation under all five: a small trusted core — exactly four primitive tools, a sub-1,200-token system prompt, sandboxed execution, secrets that never enter model context, and every piece of external content (PR comments, web pages, MCP results) quarantined as data-that-cannot-instruct.

• Any folder is a workspace. In a repo, atlas just works (auto-initializes). In a plain directory, one [y/N] sets it up — sessions, checkpoints/undo, context, and learning all function without git; git init later unlocks receipts, the git palette, and history mining. Scratch folders join the cross-repo switcher like any repo.
• Talk to it naturally. atlas "why is this layout broken?" + drag a screenshot into the terminal — the image attaches automatically (any terminal: Ghostty, iTerm2, Terminal, GNOME Terminal, Windows Terminal). Steer mid-run by typing. Interrupt cleanly with Ctrl-C.
• Four modes: code (default), ask (read-only), plan (approve a plan first), review (checks, never edits). Headless NDJSON (--json) for CI and scripts.

• Master Store — a per-workspace SQLite index of files, symbols, import/test edges, co-change coupling, landmines, and provenance, built with zero AI calls and kept fresh automatically (auto-sync at task start; atlasd in the background; git hooks).
• Budgeted context engine — edit sites in full, neighbors as signatures, landmine warnings outranking breadth; hash-sealed manifests record exactly what the model saw.
• Muscle Memory — repeated edits compile into verified, zero-token codemods (atlas compile, atlas do <name>). A revert of a skill's work auto-suspends the skill.
• Per-repo benchmark + router — your merged PRs become a private, rolling 30-task benchmark (auto-mined as you work); atlas bench leaderboard recommends the cheapest adequate model per task cluster, applied only with your explicit approval.

• Polygraph (atlas polygraph) — mutation testing scoped to your change's blast radius; weak suites get called weak, with proof.
• Receipts (atlas receipts) — the signed claim catalog per diff; rendered in the TUI, attached to the trust ledger, run on Atlas's own repo in CI.
• Review (atlas review <pr>) — addresses PR threads via a staged stepper, or autonomously where the touched paths have earned T2. Reviewer comments are quarantined external data.
• Decision Blame / Recalls / Release Manifest — per-line provenance, defective-model recalls, and the signed AI-BOM (atlas why, atlas recall, atlas release manifest).
• Drift Canaries (atlas canary) — your own benchmark, run nightly against your model bindings; sustained degradation alerts with measured-vs-inferred kept visually distinct, reroutes loudly and reversibly. Off by default (spends real money, hard-capped).

• Scar Tissue — reverts, hotfixes, rejected diffs, and the agent's own failures become a landmine map; ugly-history paths trigger careful mode (mandatory plan, Polygraph, receipts, T1 ceiling, suggested reviewer).
• Contradiction Sentinel — a staged change that reverses a teammate's recent work gets flagged before commit, with author, date, and PR.
• Flake Docket — flaky tests are convicted by an evidence protocol (N sandboxed reruns at identical code), so a flake never reads as "the agent broke something".

• MCP servers — .atlas/mcp.yaml connects Slack, calendars, databases, dev tools. One gateway tool (the four-primitive core is never widened), every result quarantined, every call through the same policy gate and trust tiers as everything else.
• Skills — 82 bundled procedures plus your own at ~/.atlas/skills/ and per-project skills/ (SKILL.md + scripts, lint-gated).
• Lifecycle hooks — .atlas/hooks.yaml runs your commands around every tool call (PreToolUse can deny; PostToolUse observes; Stop fires at run end). A broken hook can never brick the loop.
• Instructions at every scope — ~/.atlas/ATLAS.md (your permanent persona/tone/style rules, injected into every run everywhere), per-project ATLAS.md/AGENTS.md (the Linux Foundation standard), and atlas remember "<fact>" for explicit cross-workspace facts in a plain markdown file you own.
• Knowledge files — drop .md/.txt/.csv notes into any workspace; they're indexed and retrieved like everything else. (PDF/xlsx text extraction is a stated boundary, not a silent gap.)
• The Logbook — a worker-owned, evidence-linked record of your impact, synthesized locally into a vault you control. Architecturally unreachable by org config — a standing CI test fails if such a key ever parses.

• Bare atlas opens the workspace UI; Ctrl-K is a search box over everything Atlas can do — type what you want ("undo", "who wrote this", "make it cheaper", "audit") and the capability surfaces with its one-liner and exact command. ? opens the full capability catalog. Empty screens teach the command that fills them. The registry behind all of it is pinned to the real CLI by a CI test, so the in-product knowledge cannot drift the way documentation does.
• When you're stuck, the Advisor already knows: bare atlas leads with your workspace's pulse and the top next actions; completed runs end with at most one contextual nudge (cooldown-rotated — it never nags).

Requires Node 20+ and git. A C toolchain is needed on first install (native better-sqlite3 / @ast-grep/napi builds). Docker is optional but recommended — with it, bash runs sandboxed (no network, non-root); without it, every shell command requires per-command approval.

npm i -g github:klingaling/atlas-agent#main   # puts `atlas` on your PATH

From source (development): git clone, pnpm install && pnpm -r build && pnpm test, then cd packages/cli && npm link.

cd your-repo               # or ANY folder — atlas sets it up on first use
atlas                      # opens the workspace UI (ctrl-k: palette · ?: all capabilities)
atlas "explain this codebase"
atlas "fix the flaky auth test" --mode plan
atlas g commit "wire the retry backoff"      # zero-token git, sentinel-checked
atlas polygraph && atlas receipts            # prove the change before the PR
atlas trust                                  # see where autonomy has been earned
atlas remember "I prefer small PRs and strict TS"

Model roles (planner/editor/weak/judge/embedder) are bound in .atlas/models.yaml — Anthropic or any OpenAI-compatible endpoint (vLLM, Ollama, llama.cpp) for fully local operation. Per-workspace state lives in .atlas/; everything personal (keys, skills, instructions, memory, logbook) lives in ~/.atlas/ and belongs to you.

The machinery above ships and is CI-gated (2,300+ tests; the eval suites plant real defects, real drift, real flaky fixtures and assert the honest outcome). What is earned over weeks of real use — the declining cost-per-change curve, promoted-skill counts — is measured in dogfood, not asserted. Known boundaries are stated where they live: the builtin embedder is lexical, bench mining doesn't detect squash-merges in v1, recalls only cover post-provenance code, PDF knowledge files aren't text-indexed yet. When Atlas can't verify something, it says so — that's the product.

packages/        TypeScript workspace packages (core, tools, store, mcp, flake, ...)
prompts/         versioned system/plan/compact/review prompts
configs/         models.yaml, policies.yaml, tools.yaml defaults
skills/          the bundled SKILL.md catalog
evals/           CI gates: P1–P3 exit criteria, canary/logbook/recall/fixtures
docker/          sandbox images

• Deterministic first. Anything expressible as code (git plumbing, formatting, codemod application) executes as code, never as model reasoning.
• Verify, don't vibe. Anything learned from the agent's own trajectories must pass deterministic replay verification before activation.
• Content-hash everything. Every derived artifact is keyed by the hash of its source; staleness is detectable, never silent.
• Small trusted core. Four primitive tools, a system prompt under 1,200 tokens, a core readable by one engineer in one sitting.
• Loud, never silent. Skipped checks carry reasons; degraded modes announce themselves; money is never spent quietly.

See CONTRIBUTING.md (DCO sign-off required), SECURITY.md for the vulnerability disclosure path and sandbox profiles, and CODE_OF_CONDUCT.md. Coding agents working in this repo should read AGENTS.md.

Apache-2.0 — Copyright 2026 Jonathan Klinger and Atlas contributors.