declaragent

v0.1.3 · on npm, on Homebrew, on curl

Production AI agents,
declared in your repo.

One agent.yaml. Hash-chained audit, per-tenant quotas, secrets rotation, rolling deploys, Prometheus + OpenTelemetry out of the box. Every capability is configured through the same CLI you ship to production.

$ npm i -g @declaragent/cli Read the docs →

Apache-2.0 · 13 packages · Node ≥ 18 · No vendor lock-in

~/my-agent — declaragent 
█

Built with itself

declaragent is an agent.

Launch the REPL, you're talking to an agent built on @declaragent/core — the same runtime, same tools, same audit chain, same permission gate you'd use to build your own. One core, many agents. No second implementation, no "CLI-only" features locked out of your production path.

core @declaragent/core engine · tools · audit · permissions
agent #1 declaragent REPL the CLI you install — itself an agent
agent #2…N your agent.yaml every agent you declare + ship

Same Tool contract. Same permission gate. Same audit sink. If your agent can do it, so can the CLI. If the CLI does it, your agent can inherit it.

Capabilities

What you can add to an agent.

Every block below is declarative in agent.yaml and installable through the CLI. No hidden console, no vendor dashboard.

tools

Built-in tools

Read, Write, Edit, Bash, Glob, Grep, Agent, SendMessage. File-system grounded. MCP server tools load on top. 

tools:
  defaults: [Read, Glob, Grep, Bash]
Tools reference →
skills

Markdown skills

Prompts + input schema in one Markdown file with frontmatter. {{var}} interpolation. Tiered discovery (user / project / plugin). 

skills:
  - skills/review-pr.md
Skills reference →
plugins

npm plugins

Bundle skills, tools, channels, sources. Consent-gated permission grants on install. Versioned via changesets. 

$ declaragent plugin install \
    @declaragent/plugin-github
Plugin system →
mcp

MCP servers

First-class Model Context Protocol support — stdio + HTTP. Tools, resources, prompts. One-command registration. 

$ declaragent mcp add postgres \
    --command psql-mcp
MCP reference →
sources

Event sources

Cron, webhook, file-watch, Kafka, NATS, SQS, AMQP, MQTT. DLQ + replay + idempotency + rate limiting — declaratively. 

$ declaragent source add webhook \
    gh-events --config-file ./hook.yaml
Source adapters →
channels

Chat channels

Slack, Telegram, Discord, WhatsApp. Outbound rate limits, send idempotency, per-user session context, BlockKit / Markdown rendering. 

channels:
  - id: slack-prod
    type: slack
Channel registry →
tenancy

Multi-tenant isolation

One daemon, many tenants. Per-tenant quotas, extension scopes, residency tags, tenant-stamped buses. 

$ declaragent tenants show acme-prod
$ declaragent tenants diff
Multi-tenant guide →
secrets

Secrets rotation

Vault, AWS Secrets Manager, GCP Secret Manager, K8s, env. TTL cache, audit on every resolve, rotation monitor. 

$ declaragent secrets rotate \
    vault:kv/acme/gh-token
Secrets reference →
audit

Hash-chained audit

Every tool call, channel send, tenant boundary, secret access. SHA-256 chain verify. GDPR erase by user or correlationId. 

$ declaragent audit verify
$ declaragent audit erase --user U123
Audit format →
permissions

Permission gate

Four modes: default (prompt per call), plan (dry-run), bypass (trusted), auto (auto-approve allow-list). Sandboxing on file + shell. 

$ declaragent --mode plan
$ declaragent --mode auto
Permission modes →
observability

Metrics + traces

Prometheus exporter with per-tenant labels. OpenTelemetry spans for every turn + tool call. Structured logs with correlationId threading. 

observability:
  prometheus: { port: 9464 }
  otel: { endpoint: $OTEL_URL }
Grafana setup →
fleets

Multi-agent fleets

One fleet.yaml declares N agents + shared peer table. Inter-agent RPC, rolling / all-or-nothing deploy, version-skew detection. 

$ declaragent fleet new acme-fleet
$ declaragent fleet run
Fleet reference →

Lifecycle

One CLI. Every step of the agent lifecycle.

No separate tools for init vs. deploy vs. ops. The same binary you install on your laptop runs in CI and talks to the daemon in production.

01

Build

declaragent init \
  --template concierge \
  --provider anthropic

declaragent init --fleet acme
declaragent fleet add \
  --template rpc-server

Pick a template, scaffold an agent or a fleet of agents.

02

Configure

declaragent plugin install \
  @declaragent/plugin-github

declaragent source add webhook \
  gh-events --config-file ./hook.yaml

declaragent mcp add postgres \
  --command psql-mcp

Add plugins, event sources, MCP servers, channels. Consent-gated.

03

Operate

declaragent daemon
declaragent events list --last 20
declaragent dlq redrive \
  --source webhook:gh-events <id>
declaragent audit verify
declaragent tenants show acme-prod

Run locally or as a daemon. Observe, replay, audit, debug.

04

Deploy

declaragent deploy gcp-cloud-run \
  --project acme --region us-central1

declaragent fleet deploy \
  --target cloud-run
declaragent fleet deploy --rollback

Single agent or whole fleet. Rolling, health-gated, rollback-ready.

Enterprise primitives

Built for the ops team, not just the prompt engineer.

Audit & compliance

Every tool call, channel send, tenant boundary, and secret resolve is recorded to a SHA-256 hash chain. audit verify detects tampering; audit erase --user tombstones in a GDPR-clean pass.

Multi-tenant isolation

One tenants.yaml declares quotas, residency, extension allow/deny, and per-tenant secret scopes. The event bus is tenant-stamped; cross-tenant writes fail closed with a typed error.

Secrets rotation

Native providers for Vault, AWS Secrets Manager, GCP Secret Manager, K8s, and env. TTL cache + rotation monitor. Every resolve writes a secret_access audit record.

Permission gate

Four runtime modes — default (prompt per call), plan, bypass, auto (allow-list). File-system sandboxing, per-tool allow/deny globs, escalation on denial.

Observability

Prometheus exporter with tenant_id constLabels baked in. OpenTelemetry spans thread through every turn, tool call, and RPC hop. Structured logs keyed on correlationId.

Deploy automation

Cloud Run deploy templates generated from agent.yaml. Fleet deploys support rolling / all-or-nothing / per-agent with health-gated rollback. Every deploy records a version; one flag reverts.

Advanced — try in your browser

Paste a fleet.yaml. Run the production validator without installing anything.

This is the same validation logic that ships in @declaragent/cli, ported verbatim. Dangle a peer, duplicate a capability, reference a missing deploy target — the findings appear inline, offline, with no network hop.

fleet.yaml
Findings
  • Click Validate to run.

Install three ways.

curl -fsSL https://declaragent.dev/install.sh | sh

Then:

declaragent init --template concierge --provider anthropic
cd concierge
declaragent
Read the docs → Source on GitHub