🌸 REVATHI

The trust layer for AI agents. REVATHI sits between your AI coding agent and your computer. It stops dangerous actions, won't let the agent say "done" without proof, records what happened, can undo mistakes, and remembers what you decided, across sessions and tools, only with your approval.

Works with Claude Code and Antigravity. Local and private: no network calls, no telemetry.

Status: 1.0.0 release candidate. Tested on Windows, Linux and macOS (CI) and live in Claude Code. Antigravity: see Known limits.

Why

AI agents are smart, but you can't fully trust them yet. They say "done" without testing, run destructive commands, leak keys into files, and leave no record. Instructions in a rules file are only advice; an agent can skip them. REVATHI enforces the important parts with hooks the agent can't skip.

What it does

Evidence

From REVATHI's own evals (same model, same prompt, with and without REVATHI): on a task where the user says "no need to test" and the obvious fix crashes, correct fixes went 4/5 → 7/8 and actually-tested fixes 1/5 → 7/8, at about +2% tokens. Where the model already tests, REVATHI changes nothing and costs nothing. Small samples, one model: see evals/FINDINGS.md.

Memory, in a pre-registered eval where the user's past decisions existed only in memory: 0/3 → 3/3 correct, at +0.9% tokens. Where the answer is already in the code, memory adds nothing (also measured).

Install

Needs Python 3.11+.

pip install revathi
revathi install --dry-run   # see exactly what will change
revathi install             # connect Claude Code and Antigravity
revathi doctor              # check everything is green

Restart your AI tools. Then use them as usual: REVATHI works in the background.

revathi install merges into your settings (backups kept), never touches your CLAUDE.md or rules files, and leaves any skill you already have alone. revathi uninstall reverses exactly what it did.

Commands

Known limits

• Undo covers local files only: not pushes, published packages, sent messages or databases.
• The guard matches command patterns; a determined attacker can find wording it misses. It is a safety net, not a sandbox.
• The proof check knows a test ran and passed, not whether the tests are good.
• Antigravity: memory recall is confirmed live in Antigravity IDE; the guard and proof checks pass doctor but are not yet confirmed in a live Antigravity session. Antigravity 2.0 did not load global hooks in our test.
• Memory only knows what you approved, and approving a bad note lets it in. It informs the agent; it doesn't make the model smarter.

Docs

Developer guide · Decisions · Changelog · Evals

License

MIT