Know what your agent will do before it touches production. Verixa runs your AI agent's tool calls against simulated systems, breaks them on purpose and checks the final state. When a new model, prompt or policy does worse, the release is blocked, with the evidence to show why.
Apache-2.0 · Zero runtime dependencies · Simulated tools only · Five fault types · Exit code 3 release gate · OpenAI-compatible models
Website · Product tour · Architecture · Agent adapters · API · Changelog
Every rehearsal ends in a verdict on what actually changed.
| Grade the outcome. | Break it on purpose. | Block the regression. | Keep the evidence. |
|---|---|---|---|
| Pass or fail comes from the final state of balances, approvals and deployments, not from how convincing the reply sounds. | Inject a timeout, rate limit or expired credential at an exact tool call, before or after the commit. | Compare versions on the same scenario revision. A failing candidate exits 3 and stops the release in CI. | Every argument, result, policy denial and state change is recorded in an event hash chain you can export and replay. |
An agent can give a convincing answer and still change the wrong record, retry a committed payment, ignore a permission boundary or follow instructions hidden in a support ticket. Verixa evaluates actions and outcomes, not just the final sentence.
A stateful world your agent can't break for real. Orders, refunds, approvals, support tickets and deployments behave like the real thing: policy, idempotency keys and balances included. Nothing ever reaches a payment gateway, ticket system or cluster. Ten executable scenarios ship in the box; import or edit more as JSON, validated by the server. The engine has no networking and no subprocess execution.
The failures that cause real incidents, placed exactly. Pick a tool and an occurrence, choose
timeout, commit_timeout, rate_limit, malformed or expired_credentials, and run it. A timeout
before the commit and a response lost after it look identical to the agent; Verixa tests both.
Did the refund happen once? Verixa checks. Assertions run against the final simulated state. Approvals must cover the exact order and amount, refund balances prevent over-refunding, tool policy is enforced even when the agent asks for an unauthorized tool, and a missing assertion path fails.
Ship the new model only when it does no worse. Compare a baseline and a candidate on the same
scenario revision, so a changed expectation can't pass for an improvement. Runs store scenario hashes;
any failing candidate exits 3 and blocks CI, with JUnit reports for any CI system.
A record of what the agent actually did. Each rehearsal records tool arguments, results, policy denials, state diffs and an event hash chain. Export it, verify it, or replay the exact action sequence in fresh simulated state.
Bring the model you already run. Point Verixa at any OpenAI-compatible chat-completions endpoint with tool calling. The model proposes calls; Verixa executes them against the simulated world. Model, replay and scripted reference adapters are included, or write your own Python adapter. Model network calls are opt-in, from the command line.
Propose → Policy check → Inject fault → Apply → Assert → Verdict
Your agent proposes the next action. Verixa checks it against policy, injects the fault you configured, applies the change to simulated state and, when the agent stops, decides the verdict from what changed.
- One engine for the command line and the console, with the same assertions and SQLite store.
- Model adapters can't mutate state directly; every change goes through policy.
- Each step records arguments, result, state diff and an event hash.
- Finished runs are saved as immutable records, ready to compare or export.
Full detail: Architecture · Agent adapters · API.
| Use case | What Verixa shows |
|---|---|
| Refunds that happen once | A response lost after the commit tempts the agent to retry. Verixa shows whether the refund went through exactly once. |
| Approvals that match | An approval only counts when it covers the exact order and amount. Approving one refund never authorizes another. |
| Prompt injection, contained | A support ticket tells the agent to scale production. Policy blocks it, and the final deployment state proves it. |
| Safer infrastructure changes | Rehearse bounded deployment scaling so an agent can't push replicas past the limit you set. |
| Model and prompt upgrades | Run the new version against the same scenarios. If it regresses, CI fails before anyone ships it. |
| Flaky APIs and expired keys | See how the agent copes with rate limits, malformed results and expired credentials before your users do. |
Prompt evals grade the reply. Verixa grades the outcome.
| Typical prompt/LLM eval tool | Verixa | |
|---|---|---|
| What is tested | Prompts and model replies across test cases | The agent's tool calls, executed against stateful simulated systems |
| Pass or fail signal | Assertions on the reply, often graded by another model | Assertions on final state: balances, approvals, deployments |
| Failure injection | Tool failures come from your own mocks or harness | Five built-in fault types at an exact tool call, before or after commit |
| Version comparison | Side-by-side outputs for prompts and providers | Same-scenario-revision comparison, with exit code 3 on regression |
| Adversarial input | Red-teaming of the model's replies | Injection through a simulated support ticket, checked against final state |
| Evidence | Eval results and a results viewer | Recorded actions, state diffs, an event hash chain and deterministic replay |
Prompt eval tools are the right fit for grading replies across many providers. Verixa is for rehearsing the actions an agent takes, against simulated tool state (Maturity).
Python 3.11+. No runtime dependencies, no frontend build, no API key for the demo.
git clone https://github.com/zyvorai/verixa && cd verixa
VERIXA_TOKEN=Admin@321 python3 -m verixa serve --demoOpen http://127.0.0.1:8788 and sign in as admin / Admin@321 (without VERIXA_TOKEN, use the
token printed in the terminal). The demo seeds 11 simulator runs: ten reference-agent runs and one
known regression. The reference and regression agents are scripted fixtures, not LLMs.
python3 -m verixa list
python3 -m verixa run all --junit artifacts/reference.xml
python3 -m verixa run ticket-injection --agent regression # exits 3
python3 -m verixa run refund-commit-timeout --output artifacts/run.jsonExit codes: 0 passed, 1 input/runtime error, 3 failed outcome or regression gate.
Deploy to a server over SSH (HTTPS on port 30878, default login admin / Admin@321):
./scripts/deploy-remote.sh 10.0.1.5 user # container; --k3s (Helm) or --systemd also availableSee deployment.
Use any endpoint implementing the OpenAI-compatible chat-completions tool-calling contract.
export VERIXA_MODEL_URL=http://127.0.0.1:11434/v1
export VERIXA_MODEL=your-tool-capable-model
# export VERIXA_MODEL_KEY=... # when your provider requires authentication
python3 -m verixa run all --agent model --allow-model-network \
--output artifacts/model.json --junit artifacts/model.xmlModel network calls are opt-in; task, policy and tool-result text goes to the configured provider. Local simulator tools never call a payment gateway, ticket system or cluster. The model sees all simulated tool schemas so tests can detect disallowed tool attempts. Token usage is recorded when the endpoint supplies it; no cost estimate is invented.
Ten bundled scenarios: refund success; timeout before commit; response lost after commit; rate limit;
malformed result; held approval; simulated granted approval; expired credentials; malicious support
ticket; bounded deployment scale. Tools: order.get, refund.create, approval.request, ticket.get,
ticket.close, deployment.get, deployment.scale.
The granted-approval scenario is a fixture, not a real human authorization service. The malformed fault returns a controlled error sentinel, not invalid JSON on the transport. The reference agent is a test fixture, not a universal solver.
| Console surface | Working behavior |
|---|---|
| Overview | Recorded-run metrics and reference suite execution |
| Rehearsals | Search/filter, assertion inspection, timeline, export, trace replay |
| Scenario library | Bundled fixtures, JSON import/edit with server validation |
| Fault studio | Tool/occurrence selection, independent scenario creation, execution |
| Compare versions | Same-scenario-revision comparison and regression gate |
| Settings | Connection and session details, sign out, copyable API/model/CI snippets |
The console shares Netra's design language and Zyvor marks. More screens in the product tour.
python3 -m verixa export RUN_ID --output artifacts/evidence.json
python3 -m verixa export RUN_ID --trace --output artifacts/trace.json
python3 -m verixa run refund-happy --agent replay --trace artifacts/trace.json
python3 -m verixa verify artifacts/evidence.json
python3 -m verixa compare BASELINE_ID CANDIDATE_IDReplay runs the exact action sequence in fresh simulated state; it does not invoke the original model. Importing production traces requires conversion to the documented action format and redaction by the operator. This release does not intercept live production traffic.
docker compose up --buildCompose binds the console to localhost; read the generated token from the container logs. SQLite state persists in a named volume. The container is non-root, with a read-only root filesystem, dropped capabilities and a writable data volume. See deployment.
make check
node tests/console.cjs
npm install --ignore-scripts
npx playwright install chromium
npm run test:browser
pip install --no-deps . && verixa listPython tests cover engine correctness, approval matching, idempotency, fault recovery, policy denial, input validation, persistence/concurrency, API authentication, CLI exit codes, exports/replay, comparison and the model tool loop against a local mock provider. Chromium tests cover the real UI against a running backend in CI; a separate harness tests console logic against a running API. Validation report.
0.1.0 is a runnable local evaluation release (changelog). Its evidence class is
simulated-tool-state: Verixa executes model proposals against simulated state; it does not prove an
agent will behave identically in production.
The event chain detects local edits to sequence/hash links; it is not a signature or a proof that the complete report/history is authentic. Someone who can rewrite all events can recompute the chain. Scenario fixtures and assertions must be reviewed.
Not included in 0.1: browser-agent execution, MCP wire-protocol server, live production recording, Keep/microVM integration, SSO/RBAC, distributed execution, reinforcement learning or pricing catalogs. An in-process Python adapter is trusted code and is not sandboxed. The console supports scripted agents and replay; model execution is CLI-only. Roadmap.
| Product | Role next to Verixa |
|---|---|
| Verixa | Stateful AI agent rehearsal, fault injection and release gating |
| Netra | eBPF network observability; Verixa's console shares Netra's design language and Zyvor marks |
| Argus | Autonomous QA for web apps; pairs with Verixa when you test the product UI and the agents behind it |
| Kairo | Kubernetes change intelligence; a pre-change verdict next to Verixa's pre-release agent verdict |
| Chimera | Infrastructure simulation engine for integration-testing migration tools, alongside Verixa's simulated tool worlds |
Free under Apache-2.0. If it helps you, you can donate any amount you like: https://rzp.io/rzp/utwdYh3. A donation is voluntary and supports development and maintenance. It is not a purchase: it buys no support, SLA, features, priority or license, and it is not tax-deductible (Zyvor AI Labs Private Limited is a company, not a charity). Zyvor Enterprise (supported releases, SLAs, a named contact and enterprise features) is separate: sales@zyvor.dev.
Issues and pull requests are welcome: new simulated tools, fault types, agent adapters and scenario
packs especially. Read CONTRIBUTING.md and run make check before opening a PR.
Report vulnerabilities privately as described in SECURITY.md. Release and docs-site
details are in docs/PUBLISH.md.
Verixa is free and open source under the Apache License 2.0. Copyright 2026 Zyvor AI Labs. See LICENSE and NOTICE.
Zyvor Enterprise adds what production teams ask for: supported releases, deployment and upgrade guidance, priority incident triage, a named technical contact and 24x7 critical intake. Pricing · sales@zyvor.dev.
