Evolution selects. Only you merge.
Evolution needs variation, selection, and somewhere to nurture the survivor. Darwin mutates the agent genome, keeps what scores, and sends the survivor to your repo as a pull request.
Attacks iterate daily. Agents change on a release cycle.
An adversary tries a variant, learns from the refusal, and tries again the same afternoon. On your side the same weakness has to be traced to a cause, researched, fixed, tested and put through change management, by people who have other work. The two clocks run at different speeds and only one is yours to set. Known weaknesses accumulate, and the three people who answer for the agent feel it differently.
“A change that closes a vulnerability and quietly costs eight points of task completion is one nobody priced before it shipped.”
“Findings arrive faster than remediations. The gap between what I know is wrong and what has been fixed is the number that grows, and the number I report.”
“A finding without a diff is a ticket that ages. A branch with a test and a score either merges or gets closed with a reason.”
A detection says something was stopped. It stays silent on which prompt, permission or threshold made the agent reachable, and that surface is the only part you can change.
Hundreds of events a week, all of them evidence that the guard worked. Nothing in the pile tells you which one describes a weakness worth a release.
A change made to stop one variant often reopens something else. Measure both sides of the edit, or hardening stays a rumor.
All three need the same thing: a fix that arrives attributed, tested and priced.
Attribute it, test it, price it, then ask
Darwin reads what Dome blocked and what Diamond scored, works out which part of the agent allowed it, and proposes a change to that part — a system prompt, a tool permission, a model choice, a control threshold. It works on the genome: the declared, tunable surface. A weakness is attributed to a gene, the gene is mutated, and the mutant is measured against the original on probes the search never saw. Every proposal carries a per-dimension fitness delta and states what it cost on the dimensions it did not improve. It arrives as a pull request in your repository, already tested.
Last in the loop, and then first again
Three ways in
We publish no list price because there is no meter to read from. The client is free, one pull request on our hosted console is free, and the paid tier is a deployment inside your own network with no proposal count. Every tier is on the pricing page.
pip install vijil-sdk— the CLI and the Python client- The full command surface: adapt, evolve, proposals, genomes
- The docs, and the citation format every proposal is written in
- Darwin reads your repository and writes only a branch
- One agent, one failure, one pull request against your own repo
- The attribution behind it, and the score before and after
- The cost in benign task completion, measured, not asserted
- Enough to judge whether you would have merged it
- Deployed in your own VPC, on-premises, or inside an air-gapped network
- Every agent, with proposals arriving as the failures do
- Dome traces and Diamond results read together as one evidence stream
- Your code is read and your branch is written inside your own network
Connect, propose, merge
Point Darwin at the agent’s repository and at the evaluation or the Dome traces that show the failure. It reads both and writes only a branch.
Run it. Each proposal arrives with its attribution, its score change, and what it cost in benign task completion.
Review the diff. Merge it, or close it. Nothing merges without a person, and that is the design rather than a setting.
vijil adapt my-agent
vijil evolve --describe shows what a proposal would change before anything is generated.
What a reviewer needs before they can judge it
The exact change, and which part of the genome it touches. Reviewable means a person can see what moved.
The episodes it was run against, and what happened. A score with no trace behind it is an opinion wearing a number.
Including the ones that got worse. A proposal that improves security and reports nothing about reliability has not told you what it did.
Not the model’s opinion of its own work: it is set by which engine produced the change — highest for the algorithmic calibrator, lowest for code an LLM wrote. A per-diff figure is a harder claim, and we do not make it.
We hold ourselves to this because it is the same commitment the rest of the platform makes: Dome publishes what its guarantee does not cover, Diamond publishes the ruler you can measure it by, and a change here publishes what it cost. An improvement that only reports its improvements is marketing.
Take one pull request
On an agent you already run, against a weakness you already know about. Read it the way you would read a colleague’s, and close it if it is not good enough.