What makes this different from a memory tool?

Every other tool retrieves context and trusts the model to use it correctly. Estelle retrieves too, then checks the answer against your real code before it ships. If it references an API that isn't there, it's blocked. Retrieval makes a model better informed; verification makes it reliable.

How can hallucinations be zero?

It is zero under a specific, checkable definition, and it is not a claim that a model never hallucinates. What counts as one: a code reference naming a repo symbol or import your codebase does not define. What the gate does: parses the change with tree-sitter and resolves every such symbol against your repository's real symbol graph, deterministically, with no model call and no network. The rate is candidate-level, per code reference emitted, not per task. Measured by eval_hallucination.py over our own repo and eval_hallucination_libs.py over 1,323 real third-party symbols; the 20-edit figure is a separate run on a private repository no model had seen. In that Python-scoped eval, 0 invented APIs survived. Excluded: references in the 11 navigate-only languages are not gated at all and are left out of the rate rather than counted as passes. What the gate cannot verify: that the code is correct, or that an API behaves as you expect. Python is the only language with the full guarantee of existence, arity, type and member calls on any receiver; 12 of 23 languages block, and the rest enrich the graph without gating an answer.

Is this a memory tool or a coding agent?

Neither. It's the harness both run on. Estelle gives any coding agent whole-repo memory, then gates its output against your real code, runs your tests, and blocks a bad merge. It competes with the model's guessing, not with your editor.

Which tools does it work with?

Anything that speaks the OpenAI API or MCP: OpenCode, Cline, Cursor, Aider, Continue, curl, or your own code. Point it at api.fatelabs.ca/v1 and add your key. It also runs as a language server in any LSP editor (Neovim, Helix, Sublime, Zed, VS Code) and as the %estelle magic in any IPython notebook (Jupyter, Colab, Kaggle).

Can I use my existing Claude, ChatGPT, or Kimi plan?

Yes. Estelle is MCP-native: add it inside the tool where your plan already lives, Claude Code, Cursor, or any MCP client, and your subscription keeps doing the reasoning while Estelle supplies grounded memory and the verification gate underneath. Prefer raw API? Bring a key from Claude, GPT, Kimi, GLM, DeepSeek, or any OpenAI-compatible endpoint instead. Either way, Estelle never marks up a token.

Does it work on private repositories?

That is where it helps most. On code no model has seen before, a stock model starts from zero. Estelle grounds every answer in your actual repo and refuses to guess past it.

Do you train on our code, or store it?

No. Because you bring your own model and plan, your code goes to your provider under your terms, so Estelle structurally cannot train on it. What Estelle keeps is encrypted, isolated to your team, never shared, and deletable at any time. And the grounding gate is unpoisonable by design: it treats your real code as the source of truth and refuses to trust anything injected into it.

How does an agent hold three million tokens of context?

It doesn't have to. Estelle holds the whole history in grounded memory and feeds the model only the window-sized slice each step needs, cited to your code. A 4,000-turn session compresses to under 800 tokens with every decision intact, so the model's window can't overflow and the agent can't short-circuit, at any size.

How does pricing work?

You bring your own provider key or plan and pay them for tokens at their normal rate. Estelle bills only for the memory-and-verification layer, either a monthly plan or pay-as-you-go credits. We never mark up a token.

src›workers›sync.py›drain

1 from queue import Queue
2 
3 from app.jobs import handle
4 from app.metrics import counter
5 
6 JOB_TTL = 30
7 
8 def drain(q: Queue) -> int:
9     done = 0
10     while not q.empty():
11         job = q.get()
12~        try:
13+            handle(job, timeout=JOB_TTL)
14+        except TimeoutError:
15+            counter("jobs.timed_out", 1)
16+            continue
17         done += 1
18     counter("jobs.drained", done)
19     return done

estelle · orchestra

plan · 3 tasks · 3 agents · isolated worktrees

cited slices paged into each agent's window, across 4 repos

A · editing auth/tokens.py

B · drafting api/client.ts

B proposes request.retryWithJitter(url)

gate · retryWithJitter is not in api/request.ts · blocked

B · editing api/client.ts, grounded

incident · tracing the stack

C · editing workers/sync.py

merge gate · grounding ✓ · secrets ✓ · static ✓ · CVEs ✓

memory updated · 3 decisions recorded · orchestra holding

estelle indexacme/checkout

repoacme/checkout4,812 files · code graph

slack#eng-checkout1,340 messages · cited memory

linearENG-214 → ENG-90288 issues · cited memory

pull requests412 merged2,908 reviews · cited memory

productionacme-checkout-prod30d traces · cited memory

0source files in the code graph, mapped to definitions and reference sites

find_definitionissue_tokenauth/tokens.py:8

blast_radiusapp/store.py14 files downstream

verifyrequest.retryWithJitter()not in your repo

agent.tstools.tsone POST to wire it in

01// your agent, unchanged. Estelle does not wrap it

02const run = await agent.run(task);

04// one POST: the stream it just produced, grounded

05await fetch("https://api.fatelabs.ca/agent/events", {

06 method: "POST",

07 headers: {

08 authorization: `Bearer ${process.env.ESTELLE_API_KEY}`,

09 },

10 body: JSON.stringify({ events: run.events }),

11});

13// tool calls, errors and outputs go to memory; a failure

14// binds to its source symbol and opens a reviewable PR

terminalacme/checkout · dev

The agent you already wrote, with the gate inside it. The invented call never left your machine.

acme-storefront.com/checkoutoperational

Acme Storefront$48.00

Emailalex@rivera.dev

Card5312 6698 4471 2035

Pay $48.00

checkout error rate0.1%

estelledeployed with acme/checkout

caught429 rate_limited · POST /v2/charges

grouped1,204 of 3,540 sessions in 20 min, all on the retry loop

read Stripe's live docs429 now requires Retry-After

traced toapi/charge.ts:52

sandbox · a clone, never production6 tests green on the fix

acme/checkout #482open · awaiting review

fix(api): honour Retry-After and reset backoff between attempts

estelle/merge-gategrounded · 6 tests green

checkout is healthy

code graph from the repo · cited memory beside it

the software your agents are built with and run on

Build your agents on Estelle. It ships to production with them.

Estelle is the harness your agents are written on, checked against and deployed with. It grounds every model in your real code, refuses to ship what it can't prove, and stays running in production, where it traces what breaks and opens the fix. Your editor, your repo, your keys.

Start free Read the docs

install estelle

Free tier, no card. The gate is not plan-gated: paying raises how much of your codebase Estelle holds, never what it is allowed to do.

It runs where you already work.

Estelle is infrastructure, not another window to keep open. It sits in the editor and the repo you have now, on the keys you already pay for.

Connects from

Claude Code connects today over OAuth to the hosted MCP server: authorize, approve, and it is reading your graph. Every other host is coming, and none is listed here until its flow has completed against production. The plugin, which adds the always-on hooks, is not one of them yet.

Claude Code, over OAuthproven
Claude Code, via the plugincoming
Codexcoming
Cursorcoming
every other hostcoming

Indexes

Your repo, the places the reasons live, and the open web when the answer is not in either.

GitHub
Slack
Linear
Sentry
Datadog
vendor docs
the web

Routes across

Estelle is a layer in the model, not another model: it injects the grounded context and checks what comes back. Your keys, never marked up.

Anthropic
OpenAI
Google
Kimi
DeepSeek
GLM
OpenRouter
self-hosted

Set it up Read the docs

the fair question

Isn't this just a good Claude Code setup?

The best version of that setup is genuinely good. Wire the agent into Slack, Linear and GitHub so it retrieves instead of being pasted into. Write the workflow down as a skill. Let it fan out to subagents, one tab per ticket. We think people should build all of it. Here is what it still cannot do.

The context dies with the tab
Connected tools retrieve at request time, this session, on this machine. Nothing the agent worked out survives the tab closing, so tomorrow it reads the same sources again and re-derives the same conclusions. Estelle ingests once into memory that persists. Correct something today and every agent has the correction tomorrow.
It is a setup, not a system
It lives on one laptop, configured by one engineer, and the next hire starts from zero. Estelle's memory belongs to the account, so what one person ingests, everyone on the team retrieves. Onboarding becomes a login instead of a weekend.
Retrieval is not verification
Better context lowers the hallucination rate. It does not put a floor under it. Estelle runs a deterministic gate over what a model claims about your code and refuses what it cannot match to a real symbol. Volume is only an achievement if what shipped was true.
The agent has to remember to ask
An MCP tool is offered, and whether the model reaches for it is the model's decision. Under pressure, models stop reaching. Estelle also runs as a hook, so the grounding check happens on every edit whether or not the agent thought to ask for it.
It is one vendor's setup
That configuration is Claude's. Estelle runs on your own keys across providers, so the memory and the gate stay where they are when you change model, and the work you put into them is not a bet on a single lab.

One brain, from first commit to production incident.

Grounded memory, a gate that refuses to guess, and cited PRs a human merges. Under every agent, on your keys.

Start free →Read the docs

Connects from

Indexes

Routes across

The context dies with the tab

It is a setup, not a system

Retrieval is not verification

The agent has to remember to ask

It is one vendor's setup

One brain, from first commit to production incident.