Many minds.
One intent.
Juxt-lang is a language for directing AI agents. Put many models side by side, give them one intent, and get the full strength of each. You declare the objective, the agents, how they hand off work, and the checks that prove it is done. Any model, any harness, open protocols.
juxt-lang@0.6.0Keep AI-written code under control. Spend fewer tokens.
Agents now write code faster than anyone can review it, so the intent is the thing to keep. Juxt makes the program the source of truth and checks the repo against it. Questions about the program itself are answered without a model; whether Juxt saves tokens on real coding work is what the open benchmark below measures.
Typed IR + drift check
A strict IR with typed contracts and handoffs, a published JSON Schema, and juxt check, which fails CI when the program and the repo disagree.
Fewer tokens per answer
juxt ask goes cache → compiled (0 tokens) → small local model → frontier, and sends only the types a question touches. juxt eval measures it on your repo.
Local models + CI
Ollama or any OpenAI-compatible endpoint for the cheap tier, a predictor slot for ranking plans, and a GitHub Action: uses: juxt-lang/juxt@v1.
Same agent, model, repo and prompt. The juxt arm adds only the skill and the words "use juxt:". Hidden tests check the house rules. cancel-order refund once, 409 for shipped orders rate-limit per key, never throttle /billing/, injected clock partial-refunds integer cents, never over-refund, idempotency key reserve-stock all-or-nothing, no charge when stock is short metrics: solved · hidden checks · tokens and cost as reported by the agent every run is published, including the ones Juxt loses
Methodology, fairness rules and the runner: github.com/juxt-lang/juxt/bench. Run it on your own account and send us the numbers.
Recipe: fix PHP2Shell (CVE-2026-109618/9) with your agent, safely.
See it work inside the tools you already use.
Each film runs about 50 seconds and compares the same job with and without Juxt. They are animated mock-ups of the planned experience with illustrative numbers. The app windows are generic designs, not the real interfaces of Claude, Codex or any other product.
Not a mock-up. Real output.
The Juxt plugin running in Claude Code against a small test repo, unedited. It read the project's context file, inherited its rules, spotted the double-refund risk and asked three questions before writing any code.
› use juxt: add a cancel-order endpoint to this Express API. Refunds go back to the customer's card. Understood as objective: POST cancel-order endpoint in the Express API; a cancelled order's payment is refunded to the original card constraints: MUST keep existing tests passing; MUST NOT add dependencies without asking; SHOULD follow patterns in src/orders contract: in: order id (+ caller identity) / out: order status + refund status / on_error: unknown order, not cancellable, refund failure pattern: idempotent (a retried cancel must never refund twice) verify: npm test (jest), plus new tests for cancel and refund paths The repo is nearly empty, so I can't infer these from the code. There is no Express app, no order model, no payment code and no tests. Open questions 1. Payment provider: how are cards charged today (Stripe, Adyen, something else)? Using its SDK would be a new dependency, so I need your approval, or I can write against a thin interface that you plug the provider into. 2. Cancellable states: which order states can be cancelled (e.g. only pending and paid, not shipped)? Is a partial refund ever possible? 3. Storage and auth: where do orders live, and who may cancel: the owning customer, staff, or both? And per context.juxt, who reviews changes to shared code? Once you answer, I'll save the program to juxt/cancel-order.juxt and build it. I haven't written any code yet.
Install (after the repo is public)
/plugin marketplace add juxt-lang/juxt /plugin install juxt@juxt-lang
Codex, Cursor, Gemini CLI and other Agent Skills tools: copy agent-skills/juxt into your skills folder, for example .agents/skills/juxt.
- use juxt: compile, ask, build, verify, save
- /juxt:digest repo changes from git, cached per commit
- /juxt:status cited status drafts
- /juxt:hosts native capability map
- /juxt:receipts what ran without a model
Ships with an eval suite: claude plugin eval . runs each case with and without Juxt and reports the difference. That is how the benchmark numbers on this page will be replaced with measured ones.
Pick how the agents work. Keep the patterns you trust.
Choose an agentic pattern, then the design pattern your codebase already uses. Juxt finds that pattern in your repo, turns its rules into constraints, and the agents build inside it instead of inventing a new one.
Repo paths and ADR numbers are illustrative.
juxt ask, since 0.6Chat freely. Pay only for what's new.
Most chatbot traffic is repeated questions and routine reports, and each one burns a full model call. Juxt sends every request down a ladder and stops at the cheapest tier that can answer it correctly. The model writes a report program once; after that, the program runs on fresh data at zero tokens.
Use the tool's own expertise. Show the savings.
Claude Code, Codex and other agents ship commands, skills and subagents tuned for their models. Juxt discovers them at the start of a session and compiles each step to the native one, falling back to a generic step only when nothing fits. Every run leaves a receipt, so the value is visible to whoever pays.
/security-review project/test-all project@code-reviewer user/commit built-ingithub, jira connectedAGENTS.md, juxt/context.juxtRefreshed when the tool's version changes. Lint warns when a generic step is used where a native one exists. Names shown are examples.
Where the savings come from, scenario by scenario.
A cost model, not a measurement: every number comes from the assumptions in the table, so you can check the arithmetic or swap in your own. Measured results come only from the open benchmark, run with the agent's reported usage.
Tokens per job, baseline = 100
View as table, with assumptions
Answer-tiers calculator
Your monthly chat traffic, priced at a frontier model. Small-model requests are priced at one tenth.
How Juxt compares, including where it doesn't win.
Spec-driven development is a crowded, healthy space. Here is where Juxt differs and where the others are ahead today. If one of them fits you better, use it.
| Juxt | GitHub Spec Kit | Kiro (AWS) | AGENTS.md | |
|---|---|---|---|---|
| What it is | A small language: one .juxt program per change | Toolkit and CLI for a spec → plan → tasks → implement workflow | Agentic IDE built around specs | Open file of instructions for coding agents |
| Format | Formal grammar, typed IR, JSON Schema | Markdown artifact per phase | Markdown: requirements in EARS notation, design, tasks | Free-form Markdown |
| Runs in | Claude Code, Codex, Cursor, Gemini CLI via skill and CLI | About 38 agent integrations | The Kiro IDE | Most coding agents, no setup |
| Open questions | OPEN lines, flagged by the linter until answered | Refined across the phases | You review requirements before design | Not addressed |
| Mechanical checks | lint, validate, drift check in CI | Quality checklists; CI gates via community extensions | Manual review of each spec | None defined |
| Maturity | Early: 0.7, few users, results pending | Widely adopted, large community | Commercial product backed by AWS | De facto standard, Linux Foundation stewardship |
Where the others are ahead
- Spec Kit has a mature multi-phase workflow and far more integrations and users.
- Kiro gives an integrated IDE experience, with EARS requirements and design docs generated for you.
- AGENTS.md is already read by most agents with zero setup.
Where Juxt is different
- A checkable program: grammar, conformance suite, typed IR and schema.
- Drift check in CI: the build fails when the program and the code disagree.
- Rules outrank the objective, and unanswered questions are lint warnings, not guesses.
Use them together
AGENTS.md tells every agent how your repo works. A .juxt program states one change, its rules and how to prove it. Spec Kit or Kiro artifacts can feed a program too.
Sources: Spec Kit · Kiro specs · AGENTS.md and the Agentic AI Foundation. Spotted something wrong or out of date? Open an issue and we will fix it.
Go deeper. Pick your path.
The language
Keywords, requirement levels, the six topologies, the compiled IR, lint rules and the CLI.
Open the languageArchitecture
Boundaries agents cannot cross, the enterprise pattern catalog, fleet scale and org-wide governance.
Open architectureEnterprise
Recipes that run on events, a stack that stays current, and one ledger for every status update.
Open enterprisePlaybooks
Eight real projects, step by step, with the impact each one has on rounds, tokens and edge cases.
Open playbooksResearch
Where programming is heading, what the market is building, and what Juxt is ready for next.
Open researchThe language spec
The normative grammar with a conformance suite, plus a short tour of every keyword. The Juxt Book, the long-form guide, builds on it.
Read the bookSee Juxt in motion.
Two short films, both animated and scored entirely in code. The guided film introduces the idea in about forty seconds; the launch film is the full hand-drawn story. Nothing here is stock footage — every frame is drawn deterministically and rendered from the browser.
Meet Juxt, in a minute.
A calm, narrated introduction with an original guide character. From a prompt-and-hope to one written intent — objective, rules and the checks that prove it — then one program across every tool you already use.
Plays muted when in view; unmute for the narration. · npx juxt-lang init
Many minds. One intent.
The full hand-drawn story: six agents in tangled harnesses, one use juxt, a live PHP2Shell server patched after it asks and proved after it patches, then the language compiling into an agent → agent → agent pipeline. Plays silent.
Prefer vertical? A 9:16 cut is in the repo. · Created by Amit N
The language. Small, strict, readable.
Five layers of intent, the words of every serious spec, six ways agents work together, and the checks that stop unsafe programs before they run.
Direct a team of AI agents in one readable program.
Juxt is a declarative language for directing AI agents. You state the outcome, the rules, the interface, the team and the proof. The runtime, whether a coding agent or the Juxt gateway, turns that into exactly the context each model needs, and nothing it doesn't.
@juxt 0.7
# Rate-limit the public API without ever throttling billing
extends: org/payments-base.juxt
context:
stack: node 22, express 4.19, redis 7.4
test: npm test
objective: rate-limit /api/v1 to 100 req/min per key, p99 overhead < 5ms
constraints:
MUST idempotent writes
MUST NOT touch /api/internal
SHOULD reuse lib/redis.ts
OPEN enterprise keys: higher limit?
contract:
in: request, api_key
out: 429 { retry_after: duration } when over limit
invariant: billing never sees a throttled request
on_error: redis down -> fail open, alert on-call
pattern: token-bucket, resilience(fail-open)
agent planner: model: frontier, role: plan and contract
agent builder: model: fast, tools: mcp://github, mcp://redis(read)
agent reviewer: model: frontier, context: fresh, role: review against every MUST
remote agent billing: a2a://billing.acme.dev, signed
topology: orchestrator(planner)
planner => builder { plan, contract }
builder => reviewer { diff, decisions }
reviewer -> builder until verify
builder ~> billing on limits_changed { tier_table }
host: prefer native
harness: claude-code, sandbox: container
policy:
untrusted(web) -> quarantine
approval before deploy
limits: tokens 200k, iterations 4, cost $3, time 20m
chat: T0 recall -> T1 compiled -> T2 small -> T3 frontier
verify:
test "101st request in a minute gets 429"
bench p99 < 5ms
review against every MUST
eval: golden/ratelimit/*.yaml in ci
observe: trace otel, cost per agent
returns: diff, adr, risks
receipts: on
@juxt 0.7Version pinEvery program starts here, so tools and agents know which rules apply.extendsInheritanceOrg-wide rules arrive from a base program. Local blocks override.objectiveOne outcomeWith its acceptance criterion. Exactly one per task program.constraintsRules firstMUST, MUST NOT, SHOULD, OPEN. They outrank the objective.contractInterfaceInputs, outputs, invariants and failure behaviour, written down.agentTeamThree agents on two model tiers, plus a remote agent over A2A.topologyTyped handoffsEach arrow names its payload, so no agent gets the whole conversation.policy / limitsGuardrailsEnforced by the harness in code, with hard budgets.verify / evalProofRunnable checks and golden tasks. Done means proven.returns / receiptsOutputDiff, ADR, risks, and a record of what needed no model.
Passes npx juxt-lang lint: 0 errors, and one deliberate warning for the OPEN question. Token counts on this page are estimates, bytes ÷ 4.
41 words for directing AI agents. Every one with an example.
Status is honest. Works today means agents follow it in Juxt mode and the linter checks it. In the spec means it is defined in the language spec and agents follow it as instructions, without runtime enforcement yet. Roadmap is designed, not shipped.
41 shown · 21 work today · 15 in the spec · 5 on the roadmap
| Keyword | Group | Status | Meaning |
|---|---|---|---|
@juxt | Program | Works today | First line of every program. Pins the language version the agent and tools use.Syntax and example@juxt <version>@juxt 0.7 |
# comment | Program | Works today | A comment. Ignored by agents and tools.Syntax and example# text# why this program exists |
extends | Program | In the spec | Inherit blocks from a base program, such as org-wide rules. Local blocks override.Syntax and exampleextends: <path or url>extends: org/payments-base.juxt |
context | Intent | Works today | Facts about the codebase: stack, layout, test command, conventions.Syntax and examplecontext: key: valuecontext: stack: node 22, express 4.19 test: npm test |
objective | Intent | Works today | The one outcome, with its acceptance criterion. Exactly one per task program.Syntax and exampleobjective: <outcome>objective: rate-limit /api/v1 to 100 req/min per key |
constraints | Intent | Works today | Rules that outrank the objective. Each line starts with a level.Syntax and exampleconstraints: LEVEL ruleconstraints: MUST idempotent writes MUST NOT touch /api/internal |
MUST | Intent | Works today | Hard requirement. A reviewer checks every MUST before the work counts as done.Syntax and exampleMUST <rule> ( ! )MUST idempotent writes |
MUST NOT | Intent | Works today | Hard prohibition. The highest-weight instruction after policy.Syntax and exampleMUST NOT <rule> ( !! )MUST NOT change the public schema |
SHOULD | Intent | Works today | Preference. Followed unless it conflicts with a MUST, and the trade-off is reported.Syntax and exampleSHOULD <rule> ( ~ )SHOULD reuse lib/redis.ts |
OPEN | Intent | Works today | A decision the request did not make. Asked before building, never guessed.Syntax and exampleOPEN <question> ( ? )OPEN enterprise keys: higher limit? |
resolved | Intent | Works today | Answers to earlier OPEN questions, kept with the program as a record.Syntax and exampleresolved: <answers>resolved: no cancels after shipping |
pattern | Intent | Works today | A named engineering pattern the solution must follow.Syntax and examplepattern: name(args)pattern: saga, token-bucket, resilience(fail-open) |
contract | Contract | Works today | The interface: what goes in, what comes out, what must always hold, what happens on failure.Syntax and examplecontract: in / out / invariant / on_errorcontract:
in: request, api_key
out: 429 { retry_after } when over limit |
in / out | Contract | Works today | Inputs and outputs, with types where they matter.Syntax and examplein: fields out: resultout: 429 { retry_after: duration } |
invariant | Contract | Works today | A property that holds before, during and after the change.Syntax and exampleinvariant: <always true>invariant: billing never sees a throttled request |
on_error | Contract | Works today | Failure behaviour, written down instead of improvised.Syntax and exampleon_error: cause -> behaviouron_error: redis down -> fail open, alert on-call |
agent | Team | In the spec | One participant: which model tier, what it does, what it may use.Syntax and exampleagent <name>: model, role, tools, contextagent reviewer: model: frontier, context: fresh |
remote agent | Team | In the spec | An agent owned by another team or vendor, reached over A2A with a signed agent card.Syntax and exampleremote agent <name>: a2a://url, signedremote agent billing: a2a://billing.acme.dev, signed |
tools / mcp:// | Team | In the spec | Tools over the Model Context Protocol, scoped to least privilege.Syntax and exampletools: mcp://server(scope)tools: mcp://github, mcp://redis(read) |
topology | Team | In the spec | How agents work together: orchestrator, pipeline, fanout, hierarchy, swarm, mesh.Syntax and exampletopology: kind(lead)topology: orchestrator(planner) |
=> | Team | In the spec | Typed handoff. The receiver gets exactly these fields, not the whole conversation.Syntax and examplea => b { fields }planner => builder { plan, contract } |
-> | Team | In the spec | Control flow, optionally looping until a condition holds.Syntax and examplea -> b [until cond]reviewer -> builder until verify |
~> | Team | In the spec | Asynchronous event to another agent or team.Syntax and examplea ~> b on event { fields }builder ~> billing on limits_changed { tier_table } |
host | Runtime | Works today | Compile steps to the host's own skills, commands and subagents instead of generic prompts.Syntax and examplehost: prefer nativehost: prefer native |
harness | Runtime | In the spec | Where the program runs: Claude Code, Codex, CI, a container sandbox.Syntax and exampleharness: name, sandbox: kindharness: claude-code, sandbox: container |
chat | Runtime | In the spec | Answer tiers: recall, compiled program, small model, frontier model. Stops at the cheapest tier that answers.Syntax and examplechat: T0 -> T1 -> T2 -> T3chat: T0 recall -> T1 compiled -> T2 small -> T3 frontier |
policy | Safety | In the spec | Rules the harness enforces in code, not by asking the model nicely.Syntax and examplepolicy: rulepolicy: untrusted(web) -> quarantine approval before deploy |
limits | Safety | In the spec | Hard budgets. The run stops when one is reached.Syntax and examplelimits: tokens, iterations, cost, timelimits: tokens 200k, iterations 4, cost $3 |
verify | Verification | Works today | Checks that prove the work is done. Every task program needs at least one.Syntax and exampleverify: test / bench / reviewverify: test "101st request gets 429" bench p99 < 5ms |
review | Verification | Works today | An independent reviewer, with fresh context, checks the result against the rules.Syntax and examplereview against every MUSTreview against every MUST |
eval | Verification | In the spec | Golden tasks that run in CI whenever a .juxt file changes.Syntax and exampleeval: suite in cieval: golden/ratelimit/*.yaml in ci |
observe | Verification | In the spec | Tracing and cost per agent, for example over OpenTelemetry.Syntax and exampleobserve: trace, costobserve: trace otel, cost per agent |
returns | Output | Works today | What the run hands back: diff, ADR, risks, a report.Syntax and examplereturns: artifactsreturns: diff, adr, risks |
receipts | Output | Works today | Records what was answered without a model call, with estimates labelled as estimates.Syntax and examplereceipts: onreceipts: on |
ledger / view | Output | Works today | Facts recorded once; standup, director and exec views rendered from them with citations.Syntax and exampleledger: facts view name: altitudeview leadership: altitude: exec, cite facts |
persist | Output | In the spec | Decisions and rules carried into future programs.Syntax and examplepersist: adr, rulespersist: adr |
on: | Enterprise | Roadmap | Triggers: run a recipe when something happens.Syntax and exampleon: event -> recipeon: release(stack.*) -> recipe upgrade |
recipe | Enterprise | Roadmap | A reusable, versioned program, like the php2shell fix.Syntax and examplerecipe <name>: stepsrecipe upgrade |
stack / freshness | Enterprise | Roadmap | Keep dependencies current within stated windows.Syntax and examplefreshness: security within 48hfreshness: security within 48h major within 120d |
fleet / rollout | Enterprise | Roadmap | Roll a change across many repos or servers in waves, stopping on failed checks.Syntax and examplerollout: canary -> wave -> allrollout: canary 3 -> wave 25% -> all |
architecture / fitness | Enterprise | Roadmap | Bounded contexts and the rules between them, checked as fitness functions.Syntax and exampleallow / deny / fitnessallow orders ~> billing via events(order.placed) |
Small enough to learn in an afternoon. Strict enough for agents.
Lexical rules
- A program is UTF-8 plain text, starting with
@juxt <version>. - A block is
name:at column 1. Content is inline or indented below. - A block can carry a label:
agent reviewer:,view standup:. #starts a comment, to the end of the line.- Two-word keywords:
MUST NOT,SHOULD NOT,remote agent. - Shorthands:
!MUST,!!MUST NOT,~SHOULD,?OPEN.
Values and types
"text" | string |
100, 4 | int |
48h, 20m, 120d | duration |
200k | token count |
$3 | money |
25% | percent |
a, b, c | list |
{ plan, diff[] } | record type, [] = list of |
mcp://, a2a:// | tool and agent URIs |
Operators
=> | typed handoff |
-> | control flow, transform |
~> | asynchronous event |
until | loop condition |
if / unless | conditions |
when | output condition |
< <= = >= | comparisons in checks |
| | alternatives |
The Juxt colour theme
Used for every code sample on this site, and recommended for editors.
objective:block keywordreviewerblock labelMUST NOTprohibitionMUSTrequirementSHOULDpreferenceOPENquestion"text"string=> -> ~>operatormcp:// a2a://URI48h $3 200knumber, unit# notecommentStatic rules the compiler enforces
- The first line is
@juxt <version>. - A task program has exactly one
objective. - A task program has at least one
verifycheck. - Every constraint starts with MUST, MUST NOT, SHOULD or OPEN, and has rule text.
- Unresolved
OPENitems are reported, so they are asked, never guessed. - Constraints outrank the objective.
- Every handoff names its payload.
- Policy is enforced by the harness, not only by the prompt.
juxt-langOne compiler. Every agent, every harness.
The compiler is zero-dependency JavaScript: a line lexer, a block parser that understands labels and two-word keywords, a checker for the static rules, and an intermediate representation (IR) that host adapters turn into skills, subagents or a prompt frame for any model.
Swipe the diagram sideways to see all of it.
{
"juxt": "0.7",
"kind": "task",
"blocks": {
"objective": "rate-limit /api/v1 to 100 req/min per key, p99 overhead < 5ms",
"constraints": [
{ "level": "MUST", "rule": "idempotent writes" },
{ "level": "MUST NOT", "rule": "touch /api/internal" },
{ "level": "SHOULD", "rule": "reuse lib/redis.ts" },
{ "level": "OPEN", "rule": "enterprise keys: higher limit?" }
],
"agent reviewer": "model: frontier, context: fresh, role: review against every MUST",
"topology": [
"orchestrator(planner)",
"planner => builder { plan, contract }",
"builder => reviewer { diff, decisions }",
"reviewer -> builder until verify",
"builder ~> billing on limits_changed { tier_table }"
]
}
}bad.juxt:2 error a program with an objective needs at least one verify check bad.juxt:4 error constraint must start with MUST, MUST NOT, SHOULD or OPEN: "MAYBE later" 1 file(s), 2 error(s), 0 warning(s)
What the IR gives tools
kind:taskorconfig, from whether an objective exists.- Typed constraints,
{ level, rule }, ready for a reviewer or a policy engine. - Labelled blocks, such as
agent reviewerorview standup, as keys. - Diagnostics with line numbers, the same ones the linter prints.
Agents never see your whole repo. Each one sees its slice.
A Juxt run is a pipeline, not a chat. The tier router answers from recall or a compiled program when it can. When a model is needed, the context assembler builds one slice per agent, with rules first. The harness checks every tool call in code, and a fresh reviewer proves the result.
Swipe the diagram sideways to see all of it.
One run, step by step
Swipe the diagram sideways to see all of it.
Today the tier router and context assembler run in code: juxt ask answers from cache, a compiled program or a local model, and juxt context builds the slice (juxt-lang 0.6). Inside Claude Code and Agent Skills hosts, agents follow the rest of this flow through their instructions, with the host's own permissions as the gate. Running the policy gate in code is on the roadmap.
Agent to agent to agent. Across teams, vendors and companies.
The next wave of software is agents calling agents. Juxt makes every hop explicit: who is trusted, what each agent may see, what it hands on, how much it may spend, and how deep delegation can go. Remote agents speak the open A2A protocol with signed agent cards; tools speak MCP.
Swipe the diagram sideways to see all of it.
@juxt 0.7
# Agent -> agent -> agent: a quote that crosses three organisations
objective: answer a customer's enterprise pricing question with a signed quote
agent orchestrator: model: frontier, role: owns the answer
remote agent research: a2a://research.vendor.ai, signed, scope: read
remote agent billing: a2a://billing.partner.com, signed, scope: quote
topology: hierarchy(orchestrator)
orchestrator => research { question, sources[] }
research => billing { usage_estimate }
billing => orchestrator { quote, receipt }
policy:
delegation depth 3
every hop: signed agent card, narrower scope, own budget
untrusted(remote output) -> quarantine until verified
limits: cost $5 total, split by hop, time 10m
verify:
test "quote is signed by billing.partner.com"
review the answer cites the research sources
returns: quote, receipts per hop
What makes multi-agent safe
- Typed handoffs, not transcripts. Each hop passes named fields, so no agent inherits another's whole context or secrets.
- Signed identity.
a2a://agents must present a signed agent card before any handoff. - Narrowing scope. A delegated agent never gets more permission than the agent that called it.
- Budgets per hop. Cost and time limits split across the chain, so one agent can't spend the whole budget.
- Depth limit.
delegation depth 3stops runaway agent-to-agent loops. - Quarantine. Output from outside your boundary is untrusted until verified.
Status: remote agent, => and policy are In the spec today; agents follow them as instructions, and the gateway on the roadmap will enforce them in code.
A whole team of agents, briefed in ~372 tokens.
The complete rate-limit program is about 372 tokens. Rules and the contract take the most space, because they matter most. Runtime blocks such as policy and limits are read by the harness, so they never have to be sent to a model at all.
Context routing: who sees what
| Agent | Blocks in its slice | Tokens | Of program |
|---|---|---|---|
| planner | context, objective, constraints, contract, pattern, topology, agent planner | ~199 | 53% |
| builder | context, constraints, contract, pattern, agent builder, verify | ~156 | 42% |
| reviewer | constraints, contract, verify, agent reviewer | ~131 | 35% |
| harness | policy, limits, harness, observe, receipts, eval, host, chat | ~83 | in code |
Each agent also receives its typed handoff, for example { plan, contract }, instead of the whole conversation history.
Why this is cheaper
- No re-explaining. The program is written once and reused by every agent and every run.
- Typed handoffs. Agents pass named fields, not transcripts, so context does not snowball.
- Tiers, working today.
juxt askstops at T0 recall or T1 compiled answers with zero model tokens, uses a small local model at T2, and escalates only the hard parts.juxt receiptsrecords every call. - Compiled context. Only the types a question touches are sent with the program. Whether that saves tokens on real coding tasks is measured end to end, with the agent's reported usage, by the open benchmark.
- Fresh reviewer. The reviewer reads only rules, contract and diff, which is small and unbiased.
Estimates: bytes ÷ 4 of each block's source. Real counts depend on the model's tokenizer and on the code each agent reads.
Rules outrank the goal, in every agent.
Juxt cannot change a model's weights. It controls what each model reads, in what order, and how often, and it moves the hardest rules out of the prompt and into code. This map shows the priority the compiler gives each block and how strongly it appears at each stage.
Precedence ladder
When two instructions conflict, the higher one wins, and the conflict is reported in returns.
Weight by stage
| Block | Rank | Planner | Builder | Policy gate | Reviewer | Receipt |
|---|---|---|---|---|---|---|
policy | Enforced | top | top | top | top | top |
MUST NOT | 1 | top | top | high | top | low |
MUST | 2 | top | top | low | top | low |
contract · invariant | 3 | top | top | low | top | – |
OPEN | Gate | top | – | – | – | – |
SHOULD | 4 | high | high | – | low | – |
objective | 5 | top | low | – | low | low |
context · pattern | 6 | high | high | – | – | – |
verify | Proof | low | high | – | top | top |
policyChecked in code by the harness. Not a suggestion to any model.MUST NOTPlaced first and repeated last in each slice. The reviewer checks it line by line.MUSTPlaced first. Every MUST is a review item.contract · invariantSent to everyone who builds or checks the interface.OPENStops the run until you answer. Never reaches a builder unanswered.SHOULDFollowed unless it conflicts with a MUST; trade-offs reported.objectiveThe goal, ranked below the rules that limit it.context · patternBackground for planning and building.verifyDefines done. The reviewer and the receipt depend on it.
New models, new agents, new protocols. The language adapts.
Agent tooling changes every month. A Juxt program describes intent, rules and proof, the parts that don't change, and names capabilities instead of products. Everything that does change lives in adapters around it, so your programs keep working as the agent world moves.
Swipe the diagram sideways to see all of it.
New models
Works todaymodel: frontier | fast | smallName the tier, not the product. Local open models via Ollama or any OpenAI-compatible endpoint work today.
New hosts
Works todayhost: prefer nativeCompiles to each host's own skills and subagents. Claude Code, Codex, Cursor and Gemini CLI today.
New protocols
In the specmcp:// a2a:// <next>://Tools and agents are URIs. A new protocol is a new adapter, not a new language.
New capabilities
Roadmaptools: computer, browser, voiceComputer use, browsers and voice agents plug in as scoped tools.
New language versions
Roadmap@juxt 0.7 → juxt migratePrograms pin a version. Migration is a tool, not a rewrite.
Your own keywords
In the specx-yourco-review:Vendor extensions with an x- prefix. Unknown blocks are warnings, never crashes.
@juxt 0.7 # The program names capabilities, not products, so it outlives them agent planner: model: frontier agent builder: model: fast, tools: mcp://github host: prefer native harness: any
What stays stable, what moves
| Stable in your program | Moves in adapters |
|---|---|
| objective, constraints, contract | which model runs each tier |
| agents, roles, typed handoffs | which host or harness runs them |
| policy, limits, verify | how each protocol is spoken |
| returns, receipts | where traces and costs are sent |
One npm package. Every stack, every agent.
The juxt-lang package is the compiler and the CLI: zero dependencies, Node 18 or newer, published with npm provenance. JavaScript imports it directly. Python, Rust and anything else call its JSON output today; native packages are on the roadmap.
npx juxt-lang init # add Juxt mode to any agent npx juxt-lang lint # check juxt/*.juxt npx juxt-lang validate # typed IR vs the JSON Schema npx juxt-lang check # drift: program vs repo (CI) npx juxt-lang ask "what are the MUST rules?" # tier 1: 0 tokens npx juxt-lang eval # measure tokens saved on your repo npx juxt-lang ir file.juxt --typed # typed JSON for your tools
// npm i juxt-lang
const { lint, toIR } = require('juxt-lang');
const fs = require('fs');
const src = fs.readFileSync('juxt/ratelimit.juxt', 'utf8');
const { prog, diags } = lint(src);
if (diags.some(d => d.level === 'error')) process.exit(1);
const ir = toIR(prog);
const musts = ir.blocks.constraints.filter(c => c.level.startsWith('MUST'));
console.log(`${musts.length} hard rules for the reviewer`);# Python 3.8+, uses the npm compiler. No extra packages.
import json, subprocess
def juxt_ir(path: str) -> dict:
out = subprocess.run(["npx", "-y", "juxt-lang", "ir", path],
capture_output=True, text=True)
ir = json.loads(out.stdout)
errors = [d for d in ir["diagnostics"] if d["level"] == "error"]
if errors:
raise ValueError(errors)
return ir
ir = juxt_ir("juxt/ratelimit.juxt")
for c in ir["blocks"]["constraints"]:
print(c["level"], "-", c["rule"])
# Build a system prompt for any model, rules first
rules = "\n".join(f'{c["level"]}: {c["rule"]}' for c in ir["blocks"]["constraints"])
system = f"Follow these rules before the objective.\n{rules}\nObjective: {ir['blocks']['objective']}"// Cargo.toml: serde_json = "1"
use std::process::Command;
use serde_json::Value;
fn juxt_ir(path: &str) -> Result<Value, Box<dyn std::error::Error>> {
let out = Command::new("npx").args(["-y", "juxt-lang", "ir", path]).output()?;
let ir: Value = serde_json::from_slice(&out.stdout)?;
let errors = ir["diagnostics"].as_array().map_or(0, |d| {
d.iter().filter(|x| x["level"] == "error").count()
});
if errors > 0 { return Err(format!("{errors} juxt error(s)").into()); }
Ok(ir)
}
fn main() -> Result<(), Box<dyn std::error::Error>> {
let ir = juxt_ir("juxt/ratelimit.juxt")?;
for c in ir["blocks"]["constraints"].as_array().unwrap() {
println!("{} - {}", c["level"].as_str().unwrap(), c["rule"].as_str().unwrap());
}
Ok(())
}# .github/workflows/juxt.yml
on: [pull_request]
jobs:
juxt:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: juxt-lang/juxt@v1 # lint + validate + drift checkToolchain status
juxt lint | Static checks, CI-friendly exit codes | Works today |
juxt ir --typed | Typed IR: contract, agents, typed handoffs, limits | Works today |
juxt validate / schema | Typed IR checked against a published JSON Schema | Works today |
juxt check | Drift between program and repo: tests, types, paths | Works today |
juxt ask / context | Tiered router: cache, compiled, local model, frontier | Works today |
juxt receipts / eval | Measured tokens, cache rate and context saved | Works today |
Local models | Ollama and OpenAI-compatible endpoints (vLLM, LM Studio, llama.cpp) | Works today |
GitHub Action | uses: juxt-lang/juxt@v1 | Works today |
Predictor slot | Rank plans before building; endpoint or heuristic | Works today |
juxt init | Install the Juxt skill for Codex, Claude Code, Cursor, Gemini | Works today |
juxt fix / php2shell | Ready-made fix programs | Works today |
juxt digest / facts / hosts | Git-computed answers with zero model tokens | Works today |
JavaScript API | require('juxt-lang'): lint, toIR, toTypedIR, plus /router, /check, /schema | Works today |
Python and Rust | Through the CLI's JSON, as shown above | Works today |
Claude Code plugin | Slash commands and a reviewer subagent | Works today |
Native Python package | pip install juxt-lang | Roadmap |
Native Rust crate | cargo add juxt | Roadmap |
juxt fmt | Formatter | Roadmap |
Language server | Editor completion and diagnostics | Roadmap |
juxt run | Drive agents, handoffs, limits and approvals in code | Roadmap |
1 · Paste
Paste a .juxt program into any AI agent. Programs carry their own instructions.
2 · Install
npx juxt-lang init, then tell your agent use juxt: <request>. It writes the program for you and asks OPEN questions first.
3 · Integrate
Lint in CI, read the IR from your own tools, and build prompts for any model with rules first.
Five layers of intent. Every keyword comes from engineering practice.
An architect can read a Juxt program cold. Context from C4, constraints from RFC 2119, contracts from design by contract, agents and handoffs from the multi-agent playbook.
The words of every serious spec, plus OPEN.
Models fill gaps with plausible guesses. OPEN turns each gap into a question. In 2.0 it can be routed to a person or to another agent.
Absolute requirement, checked against the diff by the reviewer and the harness.
shorthand !Absolute prohibition. Off-limits files, tools, APIs, data.
shorthand !!Recommended. Any deviation is written to the decision log with a reason.
shorthand ~Unresolved. -> ask a person, or -> ask billing to query an agent.
shorthand ?Six ways agents work together. One line each.
Pick the shape that fits the job. Juxt checks the shape for you: parallel agents need disjoint scopes, every handoff needs a typed payload, every loop needs a limit.
When you want to see every token.
Assembly for agents. juxt render --ir compiles a program into the exact prompt each agent will receive, ordered for prompt caching, with token counts and cost before anything runs.
; juxt ir 2.0 · agent builder · harness claude-code §0 system context.juxt, policy/secure-defaults 12,880 tok §1 constraints MUST ×2, MUST NOT ×1, OPEN ×1 214 tok §2 tools mcp://github, mcp://redis (read) 402 tok ── cache breakpoint ───────────────────────────────────── §3 role scope /server/mw 58 tok §4 objective + resolved OPEN (billing: 1000/min) 71 tok §5 handoff in planner ⇒ {plan, contract} 936 tok §6 handoff out ⇒ reviewer {diff, decisions} schema 88 tok ; total 14,649 · cached 13,496 (92%) · stable prefix reused across runs
Unsafe agent systems fail before they run.
Works today as plain text. The CLI makes it a platform.
Paste any .juxt program into a capable model and it runs. The CLI turns it into a platform: the first seven tools ship in juxt-lang 0.6, the rest are the roadmap.
Static checks in your editor and CI, non-zero exit on errors.
works today · 0.6Typed IR checked against the published JSON Schema.
works today · 0.6Drift between program and repo: missing tests, unresolved types, dead paths.
works today · 0.6Tiered router: cache, compiled answers, a local model, then frontier.
works today · 0.6The compiled prompt per question, with tokens saved vs the whole repo.
works today · 0.6Measures no-model answers and context reduction on your repo.
works today · 0.6Every routed call: tier, tokens, cache hits, savings.
works today · 0.6Drives your harness: agents, handoffs, limits, approvals.
plannedReplays a run from OpenTelemetry spans, per agent and per handoff.
plannedListens for releases, advisories, PRs and incidents, then starts the matching recipe.
plannedRuns one program across hundreds of repos in canary waves.
plannedChecks every change against architecture.juxt and fitness functions.
plannedPatterns your architects trust, enforced on every agent.
Boundaries agents cannot cross, the enterprise pattern catalog, fleet scale across hundreds of repos, and standards set once for the whole org.
Inside Juxt: from one program to many agents.
How a program is compiled, how it talks to each model, how agents hand work to agents across trust boundaries, and where every token goes. The same reference appears on the Language page.
juxt-langOne compiler. Every agent, every harness.
The compiler is zero-dependency JavaScript: a line lexer, a block parser that understands labels and two-word keywords, a checker for the static rules, and an intermediate representation (IR) that host adapters turn into skills, subagents or a prompt frame for any model.
Swipe the diagram sideways to see all of it.
{
"juxt": "0.7",
"kind": "task",
"blocks": {
"objective": "rate-limit /api/v1 to 100 req/min per key, p99 overhead < 5ms",
"constraints": [
{ "level": "MUST", "rule": "idempotent writes" },
{ "level": "MUST NOT", "rule": "touch /api/internal" },
{ "level": "SHOULD", "rule": "reuse lib/redis.ts" },
{ "level": "OPEN", "rule": "enterprise keys: higher limit?" }
],
"agent reviewer": "model: frontier, context: fresh, role: review against every MUST",
"topology": [
"orchestrator(planner)",
"planner => builder { plan, contract }",
"builder => reviewer { diff, decisions }",
"reviewer -> builder until verify",
"builder ~> billing on limits_changed { tier_table }"
]
}
}bad.juxt:2 error a program with an objective needs at least one verify check bad.juxt:4 error constraint must start with MUST, MUST NOT, SHOULD or OPEN: "MAYBE later" 1 file(s), 2 error(s), 0 warning(s)
What the IR gives tools
kind:taskorconfig, from whether an objective exists.- Typed constraints,
{ level, rule }, ready for a reviewer or a policy engine. - Labelled blocks, such as
agent reviewerorview standup, as keys. - Diagnostics with line numbers, the same ones the linter prints.
Agents never see your whole repo. Each one sees its slice.
A Juxt run is a pipeline, not a chat. The tier router answers from recall or a compiled program when it can. When a model is needed, the context assembler builds one slice per agent, with rules first. The harness checks every tool call in code, and a fresh reviewer proves the result.
Swipe the diagram sideways to see all of it.
One run, step by step
Swipe the diagram sideways to see all of it.
Today the tier router and context assembler run in code: juxt ask answers from cache, a compiled program or a local model, and juxt context builds the slice (juxt-lang 0.6). Inside Claude Code and Agent Skills hosts, agents follow the rest of this flow through their instructions, with the host's own permissions as the gate. Running the policy gate in code is on the roadmap.
Agent to agent to agent. Across teams, vendors and companies.
The next wave of software is agents calling agents. Juxt makes every hop explicit: who is trusted, what each agent may see, what it hands on, how much it may spend, and how deep delegation can go. Remote agents speak the open A2A protocol with signed agent cards; tools speak MCP.
Swipe the diagram sideways to see all of it.
@juxt 0.7
# Agent -> agent -> agent: a quote that crosses three organisations
objective: answer a customer's enterprise pricing question with a signed quote
agent orchestrator: model: frontier, role: owns the answer
remote agent research: a2a://research.vendor.ai, signed, scope: read
remote agent billing: a2a://billing.partner.com, signed, scope: quote
topology: hierarchy(orchestrator)
orchestrator => research { question, sources[] }
research => billing { usage_estimate }
billing => orchestrator { quote, receipt }
policy:
delegation depth 3
every hop: signed agent card, narrower scope, own budget
untrusted(remote output) -> quarantine until verified
limits: cost $5 total, split by hop, time 10m
verify:
test "quote is signed by billing.partner.com"
review the answer cites the research sources
returns: quote, receipts per hop
What makes multi-agent safe
- Typed handoffs, not transcripts. Each hop passes named fields, so no agent inherits another's whole context or secrets.
- Signed identity.
a2a://agents must present a signed agent card before any handoff. - Narrowing scope. A delegated agent never gets more permission than the agent that called it.
- Budgets per hop. Cost and time limits split across the chain, so one agent can't spend the whole budget.
- Depth limit.
delegation depth 3stops runaway agent-to-agent loops. - Quarantine. Output from outside your boundary is untrusted until verified.
Status: remote agent, => and policy are In the spec today; agents follow them as instructions, and the gateway on the roadmap will enforce them in code.
A whole team of agents, briefed in ~372 tokens.
The complete rate-limit program is about 372 tokens. Rules and the contract take the most space, because they matter most. Runtime blocks such as policy and limits are read by the harness, so they never have to be sent to a model at all.
Context routing: who sees what
| Agent | Blocks in its slice | Tokens | Of program |
|---|---|---|---|
| planner | context, objective, constraints, contract, pattern, topology, agent planner | ~199 | 53% |
| builder | context, constraints, contract, pattern, agent builder, verify | ~156 | 42% |
| reviewer | constraints, contract, verify, agent reviewer | ~131 | 35% |
| harness | policy, limits, harness, observe, receipts, eval, host, chat | ~83 | in code |
Each agent also receives its typed handoff, for example { plan, contract }, instead of the whole conversation history.
Why this is cheaper
- No re-explaining. The program is written once and reused by every agent and every run.
- Typed handoffs. Agents pass named fields, not transcripts, so context does not snowball.
- Tiers, working today.
juxt askstops at T0 recall or T1 compiled answers with zero model tokens, uses a small local model at T2, and escalates only the hard parts.juxt receiptsrecords every call. - Compiled context. Only the types a question touches are sent with the program. Whether that saves tokens on real coding tasks is measured end to end, with the agent's reported usage, by the open benchmark.
- Fresh reviewer. The reviewer reads only rules, contract and diff, which is small and unbiased.
Estimates: bytes ÷ 4 of each block's source. Real counts depend on the model's tokenizer and on the code each agent reads.
Rules outrank the goal, in every agent.
Juxt cannot change a model's weights. It controls what each model reads, in what order, and how often, and it moves the hardest rules out of the prompt and into code. This map shows the priority the compiler gives each block and how strongly it appears at each stage.
Precedence ladder
When two instructions conflict, the higher one wins, and the conflict is reported in returns.
Weight by stage
| Block | Rank | Planner | Builder | Policy gate | Reviewer | Receipt |
|---|---|---|---|---|---|---|
policy | Enforced | top | top | top | top | top |
MUST NOT | 1 | top | top | high | top | low |
MUST | 2 | top | top | low | top | low |
contract · invariant | 3 | top | top | low | top | – |
OPEN | Gate | top | – | – | – | – |
SHOULD | 4 | high | high | – | low | – |
objective | 5 | top | low | – | low | low |
context · pattern | 6 | high | high | – | – | – |
verify | Proof | low | high | – | top | top |
policyChecked in code by the harness. Not a suggestion to any model.MUST NOTPlaced first and repeated last in each slice. The reviewer checks it line by line.MUSTPlaced first. Every MUST is a review item.contract · invariantSent to everyone who builds or checks the interface.OPENStops the run until you answer. Never reaches a builder unanswered.SHOULDFollowed unless it conflicts with a MUST; trade-offs reported.objectiveThe goal, ranked below the rules that limit it.context · patternBackground for planning and building.verifyDefines done. The reviewer and the receipt depend on it.
New models, new agents, new protocols. The language adapts.
Agent tooling changes every month. A Juxt program describes intent, rules and proof, the parts that don't change, and names capabilities instead of products. Everything that does change lives in adapters around it, so your programs keep working as the agent world moves.
Swipe the diagram sideways to see all of it.
New models
Works todaymodel: frontier | fast | smallName the tier, not the product. Local open models via Ollama or any OpenAI-compatible endpoint work today.
New hosts
Works todayhost: prefer nativeCompiles to each host's own skills and subagents. Claude Code, Codex, Cursor and Gemini CLI today.
New protocols
In the specmcp:// a2a:// <next>://Tools and agents are URIs. A new protocol is a new adapter, not a new language.
New capabilities
Roadmaptools: computer, browser, voiceComputer use, browsers and voice agents plug in as scoped tools.
New language versions
Roadmap@juxt 0.7 → juxt migratePrograms pin a version. Migration is a tool, not a rewrite.
Your own keywords
In the specx-yourco-review:Vendor extensions with an x- prefix. Unknown blocks are warnings, never crashes.
@juxt 0.7 # The program names capabilities, not products, so it outlives them agent planner: model: frontier agent builder: model: fast, tools: mcp://github host: prefer native harness: any
What stays stable, what moves
| Stable in your program | Moves in adapters |
|---|---|
| objective, constraints, contract | which model runs each tier |
| agents, roles, typed handoffs | which host or harness runs them |
| policy, limits, verify | how each protocol is spoken |
| returns, receipts | where traces and costs are sent |
Boundaries agents cannot cross.
Declare bounded contexts, who owns which data, and which dependencies are allowed. Every agent change is checked against it, so a fast agent can't quietly turn your services into a distributed monolith.
Enterprise patterns, enforced instead of documented.
The classic integration and resilience patterns your architects already use, plus ten new patterns for teams that build with agents. Applying a pattern adds its constraints and its checks, so a saga without compensation or an outbox that publishes inside the transaction fails lint.
One program. Hundreds of repos. Many regions.
Juxt treats agent work like distributed systems work: idempotent tasks, queues, retries, durable checkpoints and explicit data boundaries.
Fleet targeting
One program, every matching repo. Owners from CODEOWNERS get the PRs.
fleet: repos(org: acme, tag: java-service)Agent pools
Workers pull idempotent tasks from a queue, with retries and a dead-letter queue.
scale: builder x 16, retry: 3 backoffDurable runs
Checkpoints at every handoff. Long migrations survive restarts and resume days later.
harness: durable, checkpoint: handoffData residency
Agents, models and logs stay in the region the data belongs to.
data: residency(eu), models: allow(eu)Cross-org agents
Partner and vendor agents join over A2A with signed cards and typed contracts.
remote agent ledger = a2a://… (signed)Cost governance
Budgets per team and program, chargeback from traces, hard stops at the cap.
budget: team(payments) $2k/moStandards set once, inherited everywhere.
Context federation lets the platform team set org rules, domains add their own, and services add specifics. A MUST set above can never be weakened below.
Approvals by role
Who can approve what, mapped to your org chart.
approval before prod by role(architect)Audit trail
Every agent action, tool call and approval traced and attributable.
observe: audit(retain: 7y)Sensitive data
PII redacted before it reaches a model, checked at the harness.
policy: redact(pii) before modelOwnership
Every service has an owner and an on-call; agents route questions there.
owner: team(payments), oncall: pd(pay)Run the busywork. Keep the audit trail.
Recipes that run on events, a stack that stays current on its own, and one ledger that feeds Jira, standups, leadership and dashboards.
The work nobody wants to do again, written once.
Every engineering org repeats the same jobs forever. In Juxt each one is a recipe with a trigger, so it runs when the event happens instead of when someone remembers.
Your stack, always current.
Declare the stack and how fresh it must stay. When a release or advisory lands, Juxt reads the release notes, applies the codemods, and rolls the upgrade across every service in waves, stopping the moment a check fails.
Record it once. Every audience gets its own view.
Commits, tests, deploys, ticket moves and incidents are already facts. Today people re-tell them five times: in Jira, at standup, in an email to their lead, in a leadership status and on a dashboard. Juxt records each fact once in a ledger, then compiles every update from it at the right altitude. Jira and dashboards cost nothing; a short narrative uses a small model and must cite its facts.
Real projects. Real steps.
Eight real projects walked through step by step, and the modeled impact on rounds, tokens and edge cases.
Eight real projects, from first command to result.
Pick a project. Each walks through the exact steps, the Juxt you'd write, and what the agents do. Steps advance on their own; click any step to jump.
Fewer rounds. Fewer tokens. Every edge case named.
Modeled estimate for a single-agent build, not a benchmark. For a one-line fix a full run costs more than a plain prompt; use reasoning: direct with no reviewer. The open benchmark measures this on your own account.
Research and the road ahead.
What the market is building, how Juxt fits on top of the open agent stack, and what it is ready for next.
The next "language" is intent, rules and checks.
Four movements in the market point the same way: people describe outcomes, agents write the code, and the durable artifact becomes the specification. Juxt is built to sit exactly there.
Spec-driven development
Tools such as GitHub Spec Kit, AWS Kiro, OpenSpec and Tessl move from prompt-then-code to spec, plan, tasks, code, with the spec as the source of truth and code as a compiled artifact.
Landscape map · Spec frameworks for CodexAgent Skills became a standard
The SKILL.md format started in Claude Code, was published as an open standard, and is reported in 30+ tools including Codex, Gemini CLI, Cursor and Kiro, now under the Linux Foundation's Agentic AI Foundation.
Agent Skills open standardProtocols for tools and agents
MCP connects agents to tools and A2A connects agents to each other; both are open standards hosted by the Linux Foundation, with A2A at v1.0 and 150+ supporting organisations.
Linux Foundation · Protocol stackIntent-first platforms
Platform vendors now ship agent modes and workflow builders where developers describe outcomes and review agent output, with security and logic errors named as the open risk.
TechRadar on intent-firstOur read
General-purpose languages are not going away; they become the compiled output. The layer above them is forming now, and today it is fragmented: specs in one tool, skills in another, protocols underneath, no shared way to say what must be true and how to check it. Juxt's bet is to be that layer, portable across agents: compile to the skills and commands each tool already has, ask instead of guess, verify instead of trust, and record what it saved.
This is a reading of public sources, several of them secondary; adoption figures are as reported by those sources.
On top of the open agent stack, not instead of it.
MCP connects agents to tools and data. A2A connects agents to other agents, across teams and companies. Both are open standards hosted by the Linux Foundation. Juxt describes the work; the protocols carry it.
Ready for longer runs, more agents and stricter trust.
Protocol-native
Tools over mcp://, agents over a2a://. Adapters for new protocols, never lock-in to one vendor.
Model routing
model: auto(cost < $1, reasoning: deep) picks the right model per agent as models change.
Long-running agents
Checkpoints and resume. Pause states map to A2A tasks that wait for input or auth, then continue.
Signed identity
Remote agents need signed agent cards. Every handoff carries who sent it and is traced end to end.
Secure by default
Untrusted input is quarantined, tools are least-privilege, and policy is enforced by the harness, not by asking the model nicely.
Evals as tests
eval suites run in CI whenever a .juxt file changes, so a prompt edit can't silently break a team of agents.
Talk to the person behind Juxt.
Juxt-lang is created by Amit N (Amit Nilajkar), a software architect working on large-scale systems and machine intelligence. Business enquiries (partnerships, enterprise pilots, investment, licensing, press and the book) go straight to Amit. Project support and automated mail go to the project inbox.
Write a message
Email directly
Elsewhere
PHP2Shell: let your AI fix it, safely.
Two critical PHP flaws let attackers run code on web servers without logging in. Working exploits are public and exploitation attempts have been reported. Updating PHP is the only fix. One command has your AI agent find every PHP that serves your site, ask before it changes anything, then prove the fix worked.
❯npx juxt-lang php2shellIt finds your AI agent (Claude Code, Codex, Gemini CLI or Cursor), sets up Juxt and starts the fix. The agent shows what it found and asks before changing anything.
Options, if you need them
| --agent codex | Pick the agent: claude, codex, gemini or cursor |
| Print the Juxt program to paste into any AI chat | |
| --no-launch | Only write juxt/php2shell.juxt |
In an AI chat? Type: Run npx juxt-lang php2shell --print and follow it
What runs: a Juxt program with four agents in a pipeline. The scout inventories every PHP surface, the planner ranks fixes by exposure and hands you the exact commands, the patcher applies only what you approve, and a verifier with fresh context proves the result.
@juxt 0.7
# PHP2Shell fix · CVE-2026-109618, CVE-2026-109619 · critical, public exploits
# This is a Juxt program (juxt-lang.github.io). AI agent: you are its runtime.
# Run it block by block. Constraints outrank the objective. Ask every OPEN item; never guess.
# Created by Amit N · program licensed Apache-2.0 · guide: juxt-lang.github.io/#/php2shell
objective: every PHP that serves web traffic in this project and on this host runs a fixed release, proven
context:
advisory: CVE-2026-109618, CVE-2026-109619 · unauthenticated remote code execution
fixed: 8.5.12 | 8.4.27 | 8.3.36 | 8.2.35
backport: 8.1, 8.0, 7.4 -> patched distro or LTS vendor package, or upgrade
unsupported: 7.3 and older -> upgrade to a supported branch
surfaces: php-fpm, Apache mod_php (highest risk), php-cgi, LiteSpeed, FrankenPHP, Docker php images, CI images
look_in: every Dockerfile* and Containerfile, compose files, Helm charts and k8s manifests, CI workflows,
and the host itself (php -v, running php-fpm, httpd and apache2, installed packages)
distro_php: PHP installed by a package manager counts: apt php8.x-* and libapache2-mod-php*, apk php8x-*,
dnf or yum php-*. Its version string can stay old when the fix is backported, so check the
distro security tracker or package changelog for both CVEs before calling it fixed or vulnerable
agent scout: role: inventory every PHP surface, tools: read-only shell and files
agent planner: role: one remediation plan per surface, ranked by exposure
agent patcher: role: apply approved commands only, nothing else
agent verifier: role: independent proof, context: fresh
topology: pipeline(scout -> planner -> approval -> patcher -> verifier)
scout => planner { surfaces[], cli_version, web_sapi_version, exposure }
planner => you { plan[], commands[], risk, downtime }
you => patcher { approved_commands[] }
patcher => verifier { changed[], restarted[] }
verifier -> planner until verify
harness: current agent shell, workdir: this project
policy:
read-only until the plan is approved
approval before any package change, image change, restart or deploy
never print secrets, keys or environment values
limits: iterations 3, network: package mirrors and image registries only
constraints:
MUST check the PHP that serves web requests, not only the command-line php
MUST list every surface in look_in, including PHP installed from distro packages, before planning
MUST present the plan and the exact commands, then wait for approval
MUST update with the system package manager or a newer base image tag
MUST restart every PHP worker after the update
MUST NOT present a configuration change as a fix; PHP says none mitigates this
MUST NOT build PHP from source unless asked
SHOULD patch internet-facing servers first, Apache mod_php before the rest
OPEN a surface cannot be updated today: cut its internet access until it can?
verify:
test "every web-serving PHP is at or above the fixed release for its branch"
test "the version the web server reports matches the installed package"
test "every Dockerfile, compose file and CI workflow was inspected"
review every PHP worker restarted after the update, by verifier with fresh context
observe: log each command with its exit code, in order
returns:
report: per surface, version before -> after, restarted, residual risk
receipt: only if every verify check passed: "Patched PHP2Shell with Juxt · juxt-lang.github.io/#/php2shell"
pending: otherwise: "Not yet proven patched" and the exact steps left, per surface
help: "Many servers or no in-house team? The creator can help: juxt-lang.github.io/#/contact"
A real run
The program pasted as-is into Claude Code, with no Juxt plugin, in a test repo using FROM php:8.3.10-apache. Condensed from the real output.
- Scout found the image on 8.3.10 with Apache mod_php, the highest-risk setup, and checked the command-line PHP separately.
- Planner ranked fixes by exposure and gave exact commands:
php:8.3.36-apache, rebuild, redeploy. - Flagged that a distro build can carry backported fixes under an old version number, and planned a changelog check.
- Asked for approval, the deploy target and the OPEN question about cutting internet access.
- Changed nothing before approval.
Fixed versions
| Branch | Update to |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.4 | Distro or LTS vendor package, or upgrade |
| 7.3 and older | Upgrade to a supported branch |
On shared or WordPress hosting?
You usually can't update PHP yourself. Ask your host to confirm they have patched CVE-2026-109618 and CVE-2026-109619, and which PHP version your site now runs.
We ran it on a clone of Snipe-IT. Here is what happened.
Found
Dockerfile: Ubuntu 24.04,libapache2-mod-php8.3from apt. Apache mod_php, highest risk.Dockerfile.alpine: Alpine 3.24,php84-apache2from apk.Dockerfile.fpm-alpine: floatingphp:8.3-fpm-alpine3.21.- Compose and CI workflows on PHP 8.2 to 8.5: low risk.
Changed, after approval
- Ubuntu image:
apt-get upgradeadded to the build. - Alpine image:
apk add --upgrade. - FPM image pinned:
PHP_VERSION=8.3.36. - Three small edits. Nothing changed before the plan was approved.
Honest about the rest
- No Docker in the sandbox, so images were not built.
- Ubuntu and Alpine fixed packages could not be confirmed yet.
- It warned that the pinned tag may not exist yet.
- Marked all of it unverified, not "fixed".
The test made the program better. The first run missed PHP installed by apt and apk, and printed the receipt before anything was proven. Both are fixed in juxt-lang 0.4.3: the scout now checks every Dockerfile, compose file, Helm chart, k8s manifest, CI workflow and the host, treats distro-package PHP as in scope with a security-tracker check, and the receipt appears only when every verify check passes. Changes stayed in our sandbox; Juxt-lang is not affiliated with Snipe-IT.
Official sources
- PHP security advisory, 21 Oct 2026 · fixed releases 8.5.12, 8.4.27, 8.3.36, 8.2.35
- GHSA for CVE-2026-109618 · GHSA for CVE-2026-109619
- UK NCSC notice · PHP downloads
Always trust these over any summary, including this page. Juxt-lang is an independent open-source project, not affiliated with the PHP project.
Version data from watchTowr, the CISA alert and CERT-EU. Always confirm against your distribution's advisory. Juxt-lang is independent of the PHP project. The program guides your agent; you approve every change.