Status: MVP (v0) Apache-2.0 Python 3.11+ Runtime: CrewAI

Self-healing infrastructure
for AI agents

When an agent's tool breaks at runtime, Kaula captures the failure, has a repair agent rewrite the tool, verifies the candidate in a sandbox — tests and a security scan — and hot-swaps it live. Only if it passes. Every change lands in an immutable audit trail and is reversible in one step.

Get started See how it works
terminal 
# the verified-healing core: loop + sandbox + audit
$ pip install kaula-self-healing \
              kaula-sandbox-local \
              kaula-audit-local

# the CrewAI adapter
$ pip install kaula-runtime

# watch a broken tool heal itself, end to end
$ make demo-healing
The problem

Agent tools break quietly — and stay broken

An upstream API changes shape, an edge case surfaces, a schema drifts. Without intervention, the agent either crashes or silently produces garbage.

⚠

Silent failure in production

A tool starts throwing on inputs it never saw in testing, and nobody notices until downstream data is already wrong.

🔒

No verified path to a fix

Patching a tool by hand means a human in the loop for every drift — or shipping an untested change straight into a live run.

🔍

No record of what changed

Without an audit trail, "what changed and why" is a Slack thread, not something you can verify, replay, or roll back.

How it works

One loop, gated at every step

Kaula's guiding principle: easy to change, impossible to change invisibly. A candidate fix only ever reaches production after it earns its way through the whole pipeline.

1detect
→
2diagnose
→
3sandbox
→
4test
→
5scan
→
6gate
→
7hot-swap
→
8record
→
9persist
→
10resume
quickstart.py 
from kaula.audit_local import SqliteAuditSink, ToolVersionStore
from kaula.core import ToolTest
from kaula.runtime import HealingToolWrapper
from kaula.sandbox_local import DockerSandbox
from kaula.self_healing import (
    BasicStaticScanner, LLMRepairAgent, SelfHealingLoop,
)

# a tool that works today — until someone passes "$1,234.56"
def parse_price(text: str) -> float:
    return float(text)

# what "correct" means for this tool — candidates ship
# only if every test passes inside the sandbox
tests = (
    ToolTest(args=("19.99",), expected=19.99),
    ToolTest(args=("$1,234.56",), expected=1234.56),
)
What you get

A production-usable open core

The open packages run a real self-healing loop on your own infrastructure — not a demo, not a teaser.

⚡

Self-healing loop

Capture a failure, invoke a repair agent, and verify a candidate fix — fully automated, gated by tests and a security scan.

🛡

Sandboxed verification

Every candidate runs isolated, with resource limits, no ambient credentials, and restricted egress — before it ever touches a live run.

📜

Hash-chained audit trail

Append-only, content-hashed records of every swap. Verifiable, not just readable — and PII goes in by reference, never in the raw.

↺

One-step rollback

Every hot-swap is a logged, version-addressable action. Reverting a bad fix is a single command, not an incident.

🧩

CrewAI-native

Intercepts tool calls through public extension points, pauses state on failure, and resumes cleanly — no vendored or patched internals.

🔌

Framework-agnostic core

The loop itself never imports CrewAI. Runtime adapters are a thin, swappable layer — a LangGraph adapter is next, not a rewrite.

Open core

A clean seam, drawn in code

Every interface that becomes commercial is defined in kaula-core and implemented twice: an honest reference implementation in the open, a hardened implementation held back. No fork, no rewrite — a dependency swap.

easy to change, impossible to change invisibly

Interface Open reference impl Commercial impl Why the seam is here
Sandbox kaula-sandbox-local kaula-sandbox-hardened Escape-hardened, multi-tenant execution is the top paid wedge.
AuditSink kaula-audit-local kaula-audit-cloud Local append-only log is real; fleet-scale tamper-evident storage is operational work.
MemoryStore kaula-memory-local kaula-memory-cloud Procedural memory compounds — persistent cross-run memory is where.
MCPGateway kaula-mcp kaula-mcp-governed Connecting is open; allow-listing, screening, credential brokering is governance.
PolicyEngine permissive default kaula-governance Open default is single-user, all-autonomous-if-green; RBAC and approval tiers are enterprise.
ⓘ Honest boundary: the open tier does not include an escape-hardened multi-tenant sandbox, persistent cross-run memory, governed MCP, RBAC/approval workflows, or fleet-scale tamper-evident audit storage. Those are commercial implementations of the same interfaces, resolved by configuration — installing them is a dependency swap, not a rewrite.
Use cases

Recipes from the user guide

Ready-to-use patterns for wiring Kaula into a real agent stack.

UC-1

Self-heal a broken parsing tool

The canonical loop: a tool fails on a new input shape, a candidate is generated, verified, and swapped in live.

UC-2

Make a CrewAI tool self-healing

Wrap an existing CrewAI tool with HealingToolWrapper — no change to the agent or crew definition.

UC-3

Survive an upstream API format change

A vendor reshapes its response payload; the repair agent adapts the parser instead of the whole run failing.

UC-4

Heal a data-cleaning tool in an ETL step

Keep a pipeline moving when a cleaning tool meets a malformed record it wasn't written for.

UC-5

Inspect, verify, and roll back

The ops runbook: read the audit trail, verify a swap's provenance, and revert in one logged action.

UC-6

Durable pause and resume

Human-in-the-loop: a run pauses on failure and resumes exactly where it left off once a fix is approved.

UC-7

Assemble everything from configuration

Wire sandbox, audit, memory, and policy implementations from a single config file — no code change to swap tiers.

UC-8

Enforce your own swap policy

Write a custom PolicyEngine gate — e.g. require a human approval above a risk threshold.

UC-9

Route healing alerts to your team

Hook the audit event stream into Slack, PagerDuty, or a custom sink so healing is observed, not just logged.

Build order

Where Kaula stands today

v0 validates the differentiator before anything else gets built. Numbers below are design intent, not a finished product claim.

✓

kaula-core — interfaces & loop state machine

Typed, fully unit-tested contract. No runtime required.

v0 · step 1
✓

kaula-self-healing + sandbox-local + audit-local

The contained loop, provable on a fixed toolset.

v0 · step 2
✓

kaula-runtime — real CrewAI integration

Broken-tool → heal → resume runs end to end. v0 ends here.

v0 · step 3
•

kaula-kit

Thin meta-package bundling the open set behind from kaula import Kaula.

post-validation
•

Commercial tier

Hardened sandbox, cloud memory, governed MCP, governance, fleet-scale audit — registered against the same interfaces, no open-tier rewrite.

future

Break a tool. Watch it heal.

The bundled demo runs the whole loop end to end — offline, with a scripted repair agent — and prints the audit trail.

terminal 
# clone, install, and run the healing demo
$ git clone https://github.com/kaulasystems/kaula
$ cd kaula && make install
$ make demo-healing

# or, with a live LLM repair agent
$ ANTHROPIC_API_KEY=... make demo-healing
View on GitHub Read the user guide