Reliability. Governance. Reproducible AI.
The TypeScript framework for AI systems you can trust in production.

Website · Live Demos · GitHub

Every demo is interactive and runnable: elsiumai.com/#demos

AI systems must fail predictably. AI systems must be auditable. AI systems must be reproducible. AI systems must be governed by policy, not hope.

Every feature in ElsiumAI exists to serve one of these principles. If it doesn't, it doesn't ship.

Every AI framework helps you call an LLM. None of them help you trust the result.

ElsiumAI is built on three pillars that most frameworks ignore entirely:

It also does everything you'd expect — multi-provider gateway, agents, tools, RAG, workflows, MCP, streaming, cost tracking. But those are table stakes. The three pillars are what make ElsiumAI different.

npm install @elsium-ai/core @elsium-ai/gateway @elsium-ai/agents

import { gateway } from '@elsium-ai/gateway'
import { defineAgent } from '@elsium-ai/agents'
import { env } from '@elsium-ai/core'

const llm = gateway({
  provider: 'anthropic',
  model: 'claude-sonnet-4-6',
  apiKey: env('ANTHROPIC_API_KEY'),
})

const agent = defineAgent(
  { name: 'assistant', system: 'You are a helpful assistant.' },
  { complete: (req) => llm.complete(req) },
)

const result = await agent.run('What is TypeScript?')

Since 0.13.0, every governance and reliability primitive in ElsiumAI loads on any modern JS runtime. The framework no longer depends on node:crypto for hash chains, agent identity, signed replay, idempotent checkpoints, or auth middleware — all use the Web Crypto API (globalThis.crypto) instead.

The published elsium-ai umbrella tarball is 412 KB (-67% vs 0.12.x — see #35) and contains zero node:* imports across the governance pillar. Edge deployments work out of the box.

Providers go down. Rate limits hit. Costs spiral. ElsiumAI treats failure as a first-class concern.

import { createProviderMesh } from '@elsium-ai/gateway'
import { env } from '@elsium-ai/core'

const mesh = createProviderMesh({
  providers: [
    { name: 'anthropic', config: { apiKey: env('ANTHROPIC_API_KEY') } },
    { name: 'openai', config: { apiKey: env('OPENAI_API_KEY') } },
  ],
  strategy: 'fallback',
  circuitBreaker: {         // Provider failing? Circuit opens, traffic reroutes
    failureThreshold: 5,
    resetTimeoutMs: 30_000,
  },
})

Who called which model? Did they have permission? Can you prove the audit log hasn't been tampered with?

import { createPolicySet, policyMiddleware, modelAccessPolicy, costLimitPolicy, env } from '@elsium-ai/core'
import { createAuditTrail, auditMiddleware } from '@elsium-ai/observe'
import { createRBAC } from '@elsium-ai/app'

// Policy: what's allowed
const policies = createPolicySet([
  modelAccessPolicy(['claude-sonnet-4-6', 'gpt-4o-mini']),
  costLimitPolicy(5.00),
])

// Audit: what happened (hash-chained, tamper-proof)
const audit = createAuditTrail({ hashChain: true })

// RBAC: who can do it
const rbac = createRBAC({
  roles: [{ name: 'analyst', permissions: ['model:use:gpt-4o-mini'], inherits: ['viewer'] }],
})

const llm = gateway({
  provider: 'anthropic',
  apiKey: env('ANTHROPIC_API_KEY'),
  middleware: [policyMiddleware(policies), auditMiddleware(audit)],
})

LLMs are non-deterministic by nature. ElsiumAI gives you the tools to constrain, measure, and track output consistency — but the framework cannot make a hosted model deterministic on its own. See the caveats below.

import { assertDeterministic } from '@elsium-ai/testing'
import { createProvenanceTracker } from '@elsium-ai/observe'

// Measure: how stable is the output across N runs?
const result = await assertDeterministic(
  (seed) => llm.complete({
    messages: [{ role: 'user', content: [{ type: 'text', text: 'Classify: spam' }] }],
    temperature: 0,
    seed,  // Forwarded to provider API where supported
  }).then(r => extractText(r.message.content)),
  { runs: 5, seed: 42, tolerance: 0 },
)
// { deterministic: true | false, variance: number, uniqueOutputs: number }

// Prove: who/what/when produced this output
const provenance = createProvenanceTracker()
provenance.record({ prompt, model, config, input, output, traceId })

Reproducibility caveats. True bit-exact reproducibility against a hosted provider requires temperature: 0 AND a stable system_fingerprint (OpenAI rotates these between deploys, so identical (prompt, seed, temperature) calls can still differ across days). Tool calls that hit external APIs are not seedable. For full reproducibility, pair these primitives with mockProvider from @elsium-ai/testing or replay-recorder fixtures — the determinism assertions then catch real drift instead of provider noise.

The three pillars are what make ElsiumAI unique. These are the fundamentals it also delivers:

• Multi-provider gateway — X-Ray mode, middleware, smart routing (fallback, cost-optimized, latency-racing, capability-aware)
• Agents — Memory, semantic guardrails, confidence scoring, state machines, multi-agent orchestration, ReAct reasoning loop
• Multimodal — Text, image, audio, and document content across all providers
• Structured output — Native JSON mode per provider (OpenAI json_schema, Anthropic tool-use, Google responseSchema)
• RAG — Document loading, PDF loading, chunking, embeddings, vector search, PgVector store, plugin registries
• Workflows — Retries, parallel execution, branching, checkpointing, resumable workflows
• MCP — Bidirectional client/server bridge, resources, prompts
• Custom providers — OpenAI-compatible adapter for Ollama, Groq, Together, any OpenAI-compatible API
• Caching — LRU response cache with TTL, custom adapters, streaming bypass
• Output guardrails — PII/secret detection in responses, content policy, block/redact/warn modes
• Batch processing — Concurrent LLM requests with semaphore control, per-item retry, progress callbacks
• Token counting & context management — Model-aware estimation, truncate/summarize/sliding-window strategies
• SSE streaming — Server-Sent Events for HTTP endpoints, real-time response streaming
• Multi-tenant — Tenant extraction, per-tenant rate limiting, tier-based access control
• A/B experiments — Weight-based variant assignment, deterministic user hashing, metrics aggregation
• Client SDK — TypeScript HTTP client with SSE parsing for consuming ElsiumAI servers
• Persistent storage — SQLite memory stores for agents, PgVector for RAG
• Cost intelligence — Budgets, projections, loop detection
• Testing — Mock providers, evals, LLM-as-judge, prompt versioning, regression suites, dataset loading (JSON/CSV/JSONL), baseline comparison, multi-turn conversation testing, tool call assertions, automated red-teaming (44 adversarial probes including multi-turn), agent metrics (efficiency, recovery, cost), unified agent eval runner, CI reporters (JUnit XML, GitHub Actions, Markdown)
• Structured extraction — Zod schema → typed output, auto-retry on validation failure
• Dev Studio — Local web dashboard for live traces, X-Ray, costs, streaming events
• AI Proxy — OpenAI-compatible proxy with cost tracking, caching, audit — any language, zero code changes

┌──────────────────────────────────────────────────────────────────┐
│                          @elsium-ai/app                           │
│                  HTTP server · RBAC · auth · routes               │
├────────────────────┬────────────────┬────────────────────────────┤
│  @elsium-ai/agents │ @elsium-ai/mcp │       @elsium-ai/cli       │
│  memory · approval │ client · server│  init · dev · eval · studio│
│  guardrails · multi│ resources      │  proxy                     │
│  ReAct             │ prompts        │                            │
├──────────┬─────────┼────────┬───────┼───────────┬────────────────┤
│  gateway │  tools  │observe │  rag  │ workflows │   client      │
│ providers│ define  │ trace  │ load  │   steps   │  HTTP+SSE     │
│   mesh   │ toolkit │ audit  │ chunk │  parallel │   parsing     │
│ security │         │ prove- │ embed │  branch   │               │
│ bulkhead │         │ nance  │vector │checkpoint │               │
│  cache   │         │ experi-│pgvect │ resumable │               │
│guardrail │         │  ment  │regist │           │               │
│  batch   │         │        │  PDF  │           │               │
│ openai-  │         │        │       │           │               │
│  compat  │         │        │       │           │               │
├──────────┴─────────┴────────┴───────┴───────────┴───────────────┤
│                         @elsium-ai/core                           │
│    types · errors · stream · logger · config · retry · result    │
│    circuit breaker · dedup · policy engine · shutdown manager     │
│    tokens · context manager · registry · schema · multimodal     │
└──────────────────────────────────────────────────────────────────┘
                          ·  ·  ·  ·  ·  ·
┌──────────────────────────────────────────────────────────────────┐
│                       @elsium-ai/testing                          │
│    mocks · evals · fixtures · pinning · determinism · snapshots  │
└──────────────────────────────────────────────────────────────────┘

Three Pillars — where each feature lives:

  Reliability             Governance              Determinism
  ───────────             ──────────              ───────────
  circuit breaker  [core] policy engine    [core] seed propagation [gw]
  request dedup    [core] RBAC             [app]  output pinning   [test]
  shutdown manager [core] approval gates   [agt]  determinism test [test]
  retry + backoff  [core] audit trail      [obs]  provenance       [obs]
  bulkhead         [gw]   PII detection    [gw]   req-match fixts  [test]
  provider mesh    [gw]   content classify [gw]   crypto hashing   [test]

Beyond agents, tools, RAG, and multi-provider routing, ElsiumAI ships production infrastructure out of the box:

Measured with zero-latency mock provider to isolate framework cost. Full methodology and reproduction steps in benchmarks/.

Baselines are frozen per release and checked for regressions in CI. See benchmarks/results/ for historical data.

1. Fail predictably — handle failure before you see it
2. Trust but verify — every call auditable, every output traceable
3. Reproducible by design — testable AI is trustworthy AI
4. Zero magic — createX(config) everywhere, no hidden behavior
5. Type safety end-to-end — from config to LLM output
6. Modular — use what you need, tree-shake the rest

See CONTRIBUTING.md for development setup and guidelines.

Created and maintained by Eric Utrera (@ebutrera9103).

MIT - Copyright (c) 2026 Eric Utrera