What makes this different from a memory tool?

Every other tool retrieves context and trusts the model to use it correctly. Estelle retrieves too, then checks the answer against your real code before it ships. If it references an API that isn't there, it's blocked. Retrieval makes a model better informed; verification makes it reliable.

How can hallucinations be zero?

It is zero under a specific, checkable definition, and it is not a claim that a model never hallucinates. What counts as one: a code reference naming a repo symbol or import your codebase does not define. What the gate does: parses the change with tree-sitter and resolves every such symbol against your repository's real symbol graph, deterministically, with no model call and no network. The rate is candidate-level, per code reference emitted, not per task. Measured by eval_hallucination.py over our own repo and eval_hallucination_libs.py over 1,323 real third-party symbols; the 20-edit figure is a separate run on a private repository no model had seen. In that Python-scoped eval, 0 invented APIs survived. Excluded: references in the 11 navigate-only languages are not gated at all and are left out of the rate rather than counted as passes. What the gate cannot verify: that the code is correct, or that an API behaves as you expect. Python is the only language with the full guarantee of existence, arity, type and member calls on any receiver; 12 of 23 languages block, and the rest enrich the graph without gating an answer.

Is this a memory tool or a coding agent?

Neither. It's the infrastructure both run on. Estelle gives any coding agent whole-repo memory, then gates its output against your real code, runs your tests, and blocks a bad merge. It competes with the model's guessing, not with your editor.

Which tools does it work with?

Anything that speaks the OpenAI API or MCP: OpenCode, Cline, Cursor, Aider, Continue, curl, or your own code. Point it at api.fatelabs.ca/v1 and add your key. It also runs as a language server in any LSP editor (Neovim, Helix, Sublime, Zed, VS Code) and as the %estelle magic in any IPython notebook (Jupyter, Colab, Kaggle).

Can I use my existing Claude, ChatGPT, or Kimi plan?

Yes. Estelle is MCP-native: add it inside the tool where your plan already lives, Claude Code, Cursor, or any MCP client, and your subscription keeps doing the reasoning while Estelle supplies grounded memory and the verification gate underneath. Prefer raw API? Bring a key from Claude, GPT, Kimi, GLM, DeepSeek, or any OpenAI-compatible endpoint instead. Either way, Estelle never marks up a token.

Does it work on private repositories?

That is where it helps most. On code no model has seen before, a stock model starts from zero. Estelle grounds every answer in your actual repo and refuses to guess past it.

Do you train on our code, or store it?

No. Because you bring your own model and plan, your code goes to your provider under your terms, so Estelle structurally cannot train on it. What Estelle keeps is encrypted, isolated to your team, never shared, and deletable at any time. And the grounding gate is unpoisonable by design: it treats your real code as the source of truth and refuses to trust anything injected into it.

How does an agent hold three million tokens of context?

It doesn't have to. Estelle holds the whole history in grounded memory and feeds the model only the window-sized slice each step needs, cited to your code. A 4,000-turn session compresses to under 800 tokens with every decision intact, so the model's window can't overflow and the agent can't short-circuit, at any size.

How does pricing work?

You bring your own provider key or plan and pay them for tokens at their normal rate. Estelle bills only for the memory-and-verification layer, either a monthly plan or pay-as-you-go credits. We never mark up a token.

src›workers›sync.py›drain

1 from queue import Queue
2 
3 from app.jobs import handle
4 from app.metrics import counter
5 
6 JOB_TTL = 30
7 
8 def drain(q: Queue) -> int:
9     done = 0
10     while not q.empty():
11         job = q.get()
12~        try:
13+            handle(job, timeout=JOB_TTL)
14+        except TimeoutError:
15+            counter("jobs.timed_out", 1)
16+            continue
17         done += 1
18     counter("jobs.drained", done)
19     return done

estelle · orchestra

plan · 3 tasks · 3 agents · isolated worktrees

cited slices paged into each agent's window, across 4 repos

A · editing auth/tokens.py

B · drafting api/client.ts

B proposes request.retryWithJitter(url)

gate · retryWithJitter is not in api/request.ts · blocked

B · editing api/client.ts, grounded

incident · tracing the stack

C · editing workers/sync.py

merge gate · grounding ✓ · secrets ✓ · static ✓ · CVEs ✓

memory updated · 3 decisions recorded · orchestra holding

estelle indexacme/checkout

repoacme/checkout4,812 files · code graph

slack#eng-checkout1,340 messages · cited memory

linearENG-214 → ENG-90288 issues · cited memory

pull requests412 merged2,908 reviews · cited memory

productionacme-checkout-prod30d traces · cited memory

0source files in the code graph, mapped to definitions and reference sites

find_definitionissue_tokenauth/tokens.py:8

blast_radiusapp/store.py14 files downstream

verifyrequest.retryWithJitter()not in your repo

agent.tstools.tsone POST to wire it in

01// your agent, unchanged. Estelle does not wrap it

02const run = await agent.run(task);

04// one POST: the stream it just produced, grounded

05await fetch("https://api.fatelabs.ca/agent/events", {

06 method: "POST",

07 headers: {

08 authorization: `Bearer ${process.env.ESTELLE_API_KEY}`,

09 },

10 body: JSON.stringify({ events: run.events }),

11});

13// tool calls, errors and outputs go to memory; a failure

14// binds to its source symbol and opens a reviewable PR

terminalacme/checkout · dev

The agent you already wrote, with the gate inside it. The invented call never left your machine.

acme-storefront.com/checkoutoperational

Acme Storefront$48.00

Emailalex@rivera.dev

Card5312 6698 4471 2035

Pay $48.00

checkout error rate0.1%

estelledeployed with acme/checkout

caught429 rate_limited · POST /v2/charges

grouped1,204 of 3,540 sessions in 20 min, all on the retry loop

read Stripe's live docs429 now requires Retry-After

traced toapi/charge.ts:52

sandbox · a clone, never production6 tests green on the fix

acme/checkout #482open · awaiting review

fix(api): honour Retry-After and reset backoff between attempts

estelle/merge-gategrounded · 6 tests green

checkout is healthy

code graph from the repo · cited memory beside it

the software your agents are built with and run on

Build deterministic agents with Estelle so they don't fail in production.

Estelle is the infrastructure your agents are written on, checked against and deployed with. It grounds every model in your real code, refuses to ship what it can't prove, and stays running in production, where it traces what breaks and opens the fix. Your editor, your repo, your keys.

Start free Read the docs

install estelle

Free tier, no card. The gate is not plan-gated: paying raises how much of your codebase Estelle holds, never what it is allowed to do.

It runs where you already work.

Estelle is infrastructure, not another window to keep open. It sits in the editor and the repo you have now, on the keys you already pay for.

Connects from

Estelle is a hosted MCP server and a terminal CLI, so any MCP client connects and any terminal runs it — which means every IDE, because every IDE has a terminal. GET /install renders a ready-made config for each client below; the tier says what we checked.

Claude Code, over OAuthproven
Codex CLIready
Kimi Code CLIready
Cursorready
VS Codeready
Claude Desktopready
Windsurfready
Zedready
JetBrainsready
Clineready
Continueready
opencodeready
Visual Studioready
Xcodeready
aiderready
any terminal, so any IDEready
Claude Code, via the plugincoming

Indexes

Your repo, the places the reasons live, and the open web when the answer is not in either.

GitHub
Slack
Linear
Sentry
Datadog
vendor docs
the web

Routes across

Estelle is a layer in the model, not another model: it injects the grounded context and checks what comes back. Your keys, never marked up.

Anthropic
OpenAI
Google
Kimi
DeepSeek
GLM
OpenRouter
self-hosted

Set it up Read the docs

One brain, from first commit to production incident.

Grounded memory, a gate that refuses to guess, and cited PRs a human merges. Under every agent, on your keys.

Start free →Read the docs