Autolith

The Common Lisp agent that rewrites itself and rocks.

A self-modifying terminal programming agent inside a live image it can inspect, edit, break & recover, and shape to fit any use case.

nix run github:lambda-symbolics/autolith
Read the docs

Linux, macOS, FreeBSD, NetBSD, OpenBSD, and Windows. See more.

The whole agent is one Common Lisp image.

Autolith is a self-sufficient runtime that lets agents maintain all sorts of states and tools, from MCP servers, to memories, additional tools, agendas and LSP servers. Some might say it's a monolith.

Common Lisp provides describe, conditions, restarts, CLOS protocols, and source forms at runtime. The agent uses them to inspect and change its own implementation.

File search is powered through the amazing and blazingly fast fff Rust library. Autolith can spawn and maintain persistent Lisp workers for experiments and scripts.

The Autolith rock formation
provider
clientterminal
interfacetool
registryMCP
connectionsconversation
storepersistent
memoriesworkspace
agendamutation
journalwhat happens
next

In your repository

Repository work
Effective filesystem, shell, and search tools that let the agent quickly navigate any project. Integrations LSP servers are available and Autolith can connect itself to your projects in other ways.
Unattended jobs
Run Autolith inside your own workflows through its headless mode, which prescribes the input and output schemas.

In its image

Live Lisp
A runtime it can inspect, test, and extend, with heap-isolated workers for experiments. The bedrock of safe self-modification.
Oversized context
Autolith implements RLM to process large amounts of data effectively
Continuity
Portable conversations, memories, agendas, checkpoints. If Autolith breaks itself, it can recover via its recovery image.

The input prompt is a REPL with syntactic sugar.

The sentence "Hello Autolith! What's your favorite rock?" is read as the Lisp form (prompt :to 'autolith "Hello Autolith! What's your favorite rock?")

Prose, typed at the prompt. Autolith reads it as a call to (prompt). Talk to a specific agent using the :to parameter.

Your messages are just calls to (prompt ...)

You can try it here. This syntax lets you send messages to sub-agents (you will see their responses if they decide to respond).

The reader

Read as a call to (prompt), addressed to the primary agent.

You don't need to know Lisp.

Plain text works, and most people never need to type a Lisp form.

But... If you want to learn it, AL is a good place to start: the input is a Lisp REPL, the agent sees what you typed, its result, and any condition (AKA error) it produced, so you can ask it why it failed and let it help you out.

Prompts can be computed.

Text, commands, tools, and Common Lisp are the same text input. A Lisp form runs in the Autolith image and the agent sees its result. Read a prompt off disk, template it, or, I dunno, generate it from the program you are debugging. 

;; a computed prompt
(prompt (read-file "review-notes.org"))

;; a tool, called by hand
(resource.read :uri "workspace:.")

;; introspection, right there
(describe 'application)

And you can steer any child in the tree.

Autolith keeps working while its children run. Talk to one to correct it while it's doing something. Its next text reply comes back to your terminal.

(prompt :to 'test-review
        "Run the focused tests and
         report only failures.")

Update the running agent without restarting it.

Autolith replaces complete functions, methods, classes, macros, conditions, and global settings in its image at runtime. The change is instantly live.

If it outlives the process depends on you and Autolith. You can have changes that are persisted and changes that aren't.

Figure 2. Autolith mutations.

self.redefine compiles and installs a complete definition into the image and appends it to the journal.

self.exercise runs asserts against the pending change to let Autolith verify it did not screw up the change.

self.diff lets Autolith review all pending changes.

self.discard is used to discard the live changes that did not really work out, or that you decided you don't want anymore.

self.commit turns a pending change into an automatic commit in Autolith's internal git repo. That way, your modified image can be rebuilt when needed.

Figure 3. When Autolith crashes.

If Autolith breaks:

If you or Autolith somehow manage to crash the process, it will write a crash capsule, boot a separately built pristine image, and select a known-working generation from it.

The conversation you had going on will come back and Autolith will immediately look into what caused the crash in read-only mode.

You can then decide, if there's anything to fix, if and how you want to fix it.

Note: Most ordinary conditions (AKA errors) do not crash Autolith, but instead start its Lisp debugger and let you and the model decide how to handle the error.

Figure 1. RLM paritioning

Work beyond the context window.

Every model has a hard limit on how much it can read at once.

Autolith can work around it effectively. If you ask it to process a log, a codebase, or a folder of documents far too big to fit, it will use recursive inference tools to partition and process all the data, so it can answer questions about the whole thing.

The approach comes from Recursive Language Models, by Alex L. Zhang, Tim Kraska, and Omar Khattab. Autolith is a compromise between a traditional agent and Prime Agent (which also rocks, by the way!), because it is still mostly a normal agent that just has RLM tools available.

Here's how it broadly works: It writes small programs to search and slice the material, sends the parts that matter to itself in separate side conversations, and keeps just those answers. It's like an avalanche.

Autolith will set a ceiling on calls and tokens before RLM starts, so a large question does not blow an insane amount of tokens.

Budget
32 calls, 400 000 tokens, depth 2
Corpus
3.1 MB, 121 src/*.lisp files
Root conversation
59.6 K tokens in, 915 out
Answer
83 condition classes across 14 subsystems, each with its file
Trace
inference:s2Wb1o2, which the agent access like any other resource.

Example recorded sessions.

  :::.      :::        AUTOLITH v0.35.0
  ;;`;;     ;;;        ─────────────────────────────────
 ,[[ '[[,   [[[        model      gpt-5.6-terra
c$$$cc$$$c  $$'        workspace  /root/common-lisp/frob/
 888   888,o88oo,.__
 YMM   ""` """"YUMMM
Download recording
Asked
List every condition class in a 3.1 MB concatenation of 121 source files, grouped by subsystem, with the defining file. Budget of 32 calls, 400 000 tokens, depth 2. Do not read or search the file directly.
Cost
59.6 K tokens in the root conversation. The corpus never enters a prompt.
Answer
All 83 condition classes across 14 subsystems, each with its defining file.

Attach to a session from another terminal.

Every Autolith instance has an authenticated local endpoint on loopback, keyed by the session ID. You can (detach), and Autolith will continue your work in the background.

From any other terminal on the machine

$ autolith localgroup status
$ autolith localgroup tell   SESSION "use the staging config"
$ autolith localgroup attach SESSION --read-only
$ autolith localgroup attach SESSION --take-over
$ autolith localgroup pause  SESSION
$ autolith localgroup kill   SESSION

These are basic monitoring tools you can use to watch running Autolith sessions and instruct them. Autolith also has an authenticated Lisp REPL TCP endpoint, which lets you do anything you like to the agent, with no limitations.

We will support ACP very soon.

Calling it a rock formation was considered, but none sounded that well, so old Windows NT terminology it is.

You can also move your work between machines.

$ autolith data export project.sexp --workspace ~/code/project
$ autolith data import project.sexp --workspace ~/src/project

The result is an S-expression archive containing conversations, memories, agendas, plans, papercuts, and other session assets. You will not be surprised by something miraculously missing on import

Even self-modified cores can be rebuilt on another machine by running their replay script.

  • Linux x86_64
  • Linux aarch64
  • musl static
  • macOS x86_64
  • macOS arm64
  • FreeBSD
  • NetBSD
  • OpenBSD
  • Windows x86_64

Sandboxing and security.

Executed commands go through authorization checks before execution, just like in any solid agent.

We have a sandbox with process isolation and scoped filesystem access to limit accidental damage.

Sandbox
cl-exec-sandbox is our platform abstraction for sandboxing, which works on Linux, Mac and Windows.

The default policy is to give commands no network, a read-only host access, allow writing in the workspace and temp directories, forbid changing repo metadata, and a sixty seconds timeout.

On Linux it adds process, user, IPC, UTS, and network namespaces, no_new_privs, and seccomp.
Classification
In automatic mode one RLM inference frame judges each command under a two-call, eight-thousand-token budget and answers: sandboxed, full access, or denied.
Approvals
You can select different permission levels: approve once, run sandboxed, full access, or denied. Headless jobs deny anything that would otherwise open the picker, so make sure to select the correct default setting.
Credentials
In a number of places, Autolith will censor your credentials for MCPs, OAuth, tokens and similar.
Bounds
Most things have defined boundaries to prevent runaway doom loops and reckless spending. These things are of course configurable.
Revision gating
We use careful hashline-based editing (similar to Pi agent), which ensures the agent correctly selects places to edit and does not clobber over forgotten changes.
Immutable mode
--immutable prevents Autolith from self-modifying when you need maximum predictability and security.

You can use it when you are integrating Autolith into another program as a worker, or you just don't want self-modification.

The levels of knowledge

Autolith has several tools and places where it can store information, each with a different purpose and functionality to remind the agent of their existence.

Conversations

Append-only portable S-expressions-based format which serves as a ledger of everything you said, AL said, and everything that happened, including errors and crashes.

Memories

Scoped memories where general facts to be remembered are stored.

Agenda

Long term tracking and planning. Imagine it being like a limited-size Jira / Kanban board.

Plan

Short-term temporary planning, if you've ever used Codex or Claude Code, you know what this is

Git image commits

Complete replay scripts for durable definitions and settings.

Generations

We stole this from Nix. A generation contains a saved image version (core), and everything else needed to restore Autolith to a previous state.

Worker images

AL can have long-running child Lisp images in which it can develop and triage small programs and experiments. These can be checkpointerd and roll-backed too.

Stores are either append-only or transactional. Shared-state storage places are serialized across processes, meaning that 2+ AL instances can work in the workspace at the same time.

Change anything about AL from the prompt.

Configuration is files and Lisp forms, and the running agent can help you with both.

Skills
We support standard SKILL.md with frontmatter, or native SKILL.sexp format, which can also load modifications into the AL image on load (so audit your skills before use).

Project skills take precedence over user's skills, if there's a conflict.
MCP servers
Both stdio and streamable HTTP are supported, with a per-server approval policy. A project can have its own addition MCP servers defined and loaded if marked as trusted in directory-scopes.sexp.
Child roles
Six predefined child roles are available: scout, designer, reviewer, librarian, task, sonic (GOTTA GO FAST). You can add your own to .autolith/agents/ and define tools, models, and efforts the role is assigned by default.
Providers
Nine providers are built-in, see below, and other OpenAI-compatible providers are trivial to add.
init.lisp
Your entrypoint to scripts being loaded on launch to change any settings to your preferences, or modify Autolith in any way you like.
Request context
define-context-contributor attaches what we call ephemeral notes to provider requests. You can use this to give the model temporary additional context to steer it better. They will quickly erode in a way that does not bust your whole cache.
Commands
define-application-command is a simple macro that lets you add your own commands that affect the harness the agent, or well, anything else in your system. The result will be a plain Common Lisp function with some metadata, so you can easily test it by hand and ask AL to help you debug it. Adding commands is cheap, you can litter them like small pebbles on the beach.
Instructions
AGENTS.md, no surprises here. Autolith can also create AUTOLITH.org, where it can track information that's specific to it and should not confuse other agents you might use.

Install it.

nix run github:lambda-symbolics/autolith

The high testosterone, high estrogen way to install Autolith.

Then sign in to a provider

autolith auth anthropic autolith auth chatgpt autolith auth fireworks autolith auth gemini autolith auth grok autolith auth mistral autolith auth nous autolith auth opencode autolith auth openrouter

Once you authenticate, it's time to have fun. Run autolith to get started.

Autolith 5th grade report card

Licence
ISC
Linux
x86_64 and aarch64, glibc and static musl
macOS
x86_64 and arm64
BSD
FreeBSD, NetBSD, OpenBSD on x86_64
Windows
x86_64
Updates
(update) inside AL, autolith update from the CLI

Yes, piping a URL into a shell is evil. Read the installer first, it's not so bad.

Nix is the preferred installation method on worthy operating systems.