julep

Julep is a developer framework for building AI agents, and its core idea is to write agents as composable, durable dataflows rather than using ad hoc loop logic. This allows flows to recover after a crash, retry safely, and explain each step of execution through derived projections, while also being able to reject any tool that the model was not explicitly allowed to call.

Purpose

Julep is mainly used to build AI agent systems with durable execution, recoverability, and explainability. It is suitable for complex scenarios that require reliable orchestration, tool permission control, and cross-agent collaboration.

Main capabilities

• Composable dataflows: Agents are defined as dataflows, supporting recovery after a crash, safe retries, and step explanation.
• Define-by-construction @flow: The main authoring interface. Graph steps are defined using ordinary Python names, and registered tools, pures, reasoners, branches, fan-out, retries, timeouts, and so on all compile to a unified frozen wire-format IR.
• Pure core with no dependencies: The core does not depend on external libraries, and the Temporal layer is optional.
• Frozen tool and reasoner surface: Freeze tool and reasoner interfaces via deploy(..., tools=..., reasoners=...); dry_run(...) executes locally using in-memory tools and deterministic fake reasoners.
• MCP support: Use mcp_tool(server, tool) inside @flow to reference MCP; its schema and behavioral contract come from a frozen MCP snapshot; keyword arguments with handles can directly build input records.
• Security and secret management: The self-hosted control plane includes a write-only operator vault, with values encrypted at rest; it supports binding short-lived credentials per run to secret://name MCP header references, transmitted only through encrypted Temporal payloads and not entering stored run data and projections.
• CLI tool: julep is a developer CLI for entire agent modules, described as "dbt for agents, terminal-native". Point it at a directory to discover all @flow / Agent(...) and treat them as nodes in a cross-agent graph, and it provides a unified selection syntax.
• Selector syntax: supports composite selectors such as tag:support, state:modified (Slim-CI), +agent / agent+ / @agent graph traversal, a,b intersection, --exclude, etc.
• Plan, apply, and status: julep plan --env staging reports artifact, MCP-schema, Helm/KEDA, and runtime drift; julep apply --env staging publishes an immutable S3-artifact storage version and reconciles the digest-pinned Helm version for each lane; julep status --env staging aggregates versions and live lane status.
• Signing and secure publishing: application publishing requires a 64-digit hexadecimal Ed25519 seed in JULEP_BUNDLE_SIGNING_KEY; production environments require setting the corresponding public key in the non-secret JULEP_BUNDLE_ALLOWED_SIGNERS worker environment.
• worker operation: julep worker runs continuously according to the environment contract, and supports --smoke-test-seconds N for connectivity verification.

Usage

• Installing the base package is enough for authoring and compilation, requiring Python and PyYAML. Julep 3 is currently a release candidate, so installation requires the --pre flag (for example, pip install --pre julep).
• A 10-minute quick experience without an API key: after installing the base package, run the example as an ordinary Python script. @flow runs once at definition time using data handles; registered tools, pures, think(...), cond(...), switch(...), each(...), reschedule(...) append graph steps rather than performing runtime work; | merges records, and h["key"] extracts a field. deploy(..., tools=..., reasoners=...) freezes the tool and reasoner surface, and dry_run(...) executes locally. For more @flow examples, see examples/episode_summary_flow.py and examples/cluster_labeling_flow.py.
• Production applications must declare explicit objects rather than adding a second discovery convention.
• For julep plan, apply, and application-level status, each snapshot_source receives a read-only mapping, sourced from the selected environment's [vars] followed by [worker_environment] (worker values take precedence when names collide). Secret-backed worker variables are intentionally absent. The callback must return McpSnapshot.
• Point [tool.julep].application at that object, using a module:attribute value. Each deployable environment also names the worker's explicit context factory.
• payload_encryption_secret is required for application publishing, naming an existing Kubernetes Secret in kubernetes_namespace that contains keyring and active-key-id entries. worker_priority_class is optional.
• Install julep[store,temporal] to use S3 publishing and Temporal workers. The control plane host also needs authenticated helm, kubectl, and temporal CLIs; apply --publish-only skips Helm reconciliation.
• The base installation includes only authoring and compilation (PyYAML). Optional extras add runtime features. julep.HAVE_TEMPORAL reports whether the runtime is available.

Applicable scenarios

Suitable for development scenarios that require persistent, recoverable, and explainable AI agent orchestration, especially production applications involving tool permission control, cross-agent collaboration, MCP integration, S3 artifact publishing, and Temporal workflows.

Limitations and notes

• Julep 3 is currently a release candidate, and the --pre flag will only be removed after the official 3.0.0 release.
• Julep 3 is a complete rewrite, with no migration path from Julep v1 (the agents API platform); the two are different products. v1 remains on the v1 branch and its documentation at v1.docs.julep.ai.
• Application publishing requires a signing key and allowlist configuration.
• The project uses the Apache-2.0 license.

(Note: The above content is based entirely on the provided materials; information not provided, such as features, fees, prices, platforms, or effects, is not yet available.)