Lavern: 67 Legal Agent Prompts in One Apache 2.0 Repo

Who Lavern is built for, and why it is not a junior associate

The README is explicit that Lavern is not a product. It describes the repository as a collection of ideas, and says the author built it over six months because the "AI as a junior associate" framing felt like the wrong analogy. That framing decision matters more than it sounds. A junior associate is trusted with a task and returns a draft. Lavern instead models a firm: 59 specialists, 7 workflow-specific orchestrators and 1 generic base orchestrator, all coordinating through a debate protocol with a human approving critical calls.

The intended reader is therefore an engineer or legal-technologist who wants to study or fork an architecture, not a firm looking for a turnkey review tool. The README says as much: it is at least ten things, several of which could be products on their own, and readers are invited to take whichever ones they want. The repository ships 9 workflows, from a single-specialist counsel call to a full adversarial review, and 21 MCP tools covering debate, scoring, verification, grounding, memory, knowledge base and quality checks.

If you want a hosted service that reviews a contract and hands back a redline, this is the wrong repository. If you want to see how citation-enforced debate, fail-closed verification and persistent precedent are wired in TypeScript, it is unusually complete for a side project.

How the debate protocol and three verification layers actually work

Every agent is a system prompt with a role, MCP tool permissions and a slot in the protocol. All 67 run on the same underlying model, Claude or Mistral, so the prompts are not where the engineering sits. The README says the work is the four things wrapped around them.

First, the debate protocol. Agents must cite specific text from the parsed document. A finding without a citation does not enter the board, and an agent challenging another finding must cite text too. That is a hard structural constraint rather than a style instruction, and it is the part most worth copying.

Second, verification, in three independent layers. An evaluator gate drops weak findings, then a red team and blue team debate runs, then a 10-pass pipeline in src/workflows/templates/verification.ts. The passes are context, ux, clarity, structure, accuracy, completeness, risk, formatting, legal_design and delivery, with definitions in src/types/verification.ts. Each layer fails closed independently. Separately, a mechanical grounding verifier in src/mcp/tools/grounding-verifier.ts cross-checks every cited quote against the parsed document by string matching. That is the one check that does not depend on a model agreeing with itself.

Third, human gates: critical findings do not auto-deliver, and the orchestrator waits for an approve or override. Fourth, the precedent board, a SQLite-backed memory across engagements. Recurring findings are reinforced, stale ones decay, and a pattern starts as tentative before being promoted to confirmed once it recurs with consistent verdicts. The README does not document how decay is calculated or what threshold promotes a pattern.

Installing Lavern and running a first engagement

The install script clones the repository, installs backend and frontend dependencies, and leaves you a lavern command. On macOS or Linux the README gives this one-liner:

curl -fsSL lavern.ai/install.sh | sh

On Windows the equivalent is a PowerShell invocation of lavern.ai/install.ps1. If you would rather not pipe a remote script into a shell, the manual path is three commands, and it is the one worth using if you intend to read the source:

git clone https://github.com/AnttiHero/lavern.git
cd lavern
npm install
(cd viz && npm install)

Then start the API server and the dashboard in two terminals. The server defaults to local mode, which the README says needs no API key:

npm run serve:dev          # API server on :3000 (LOCAL MODE, no API key needed)
cd viz && npm run dev      # Dashboard on :5173, hot reload

Open http://localhost:5173. Demo mode runs the dashboard, the Clawern view and the guided tour without a key. To process real engagements, copy .env.example to .env, which happens automatically on first run, and set ANTHROPIC_API_KEY, or MISTRAL_API_KEY for the EU provider. The .env.example file also carries SHEM_MODEL=claude-opus-5 and SHEM_ROUTER_MODEL=claude-sonnet-5, and warns that the bundled Claude Agent SDK resolves the opus, sonnet and haiku aliases to its own release's models unless Lavern injects the pins. If output quality looks inconsistent across agents, that injection is the first thing to check.

Docker is the other route. docker compose up -d builds the image, maps ${SHEM_PORT:-3000} to port 3000, and mounts named volumes for the SQLite database and the audit logs so both survive a restart. A healthcheck polls http://localhost:3000/health every 30 seconds.

Clawern, EU mode, and the one route that leaves the EU boundary

Three modes ship in v0.15.0. Interactive is the dashboard with a live activity feed, where each engagement produces a deliverable plus an audit bundle of structured findings, debate resolutions, verification results and a cost log. Clawern is the autonomous mode: point it at a folder and it processes new documents on a 30-minute heartbeat, accumulates the precedent board across reviews, and pushes findings to Telegram, email or macOS notifications, with a weekly digest, multi-client isolation and hybrid local-plus-frontier processing.

EU mode is the interesting one for anyone with GDPR-bound matters. Setting LAVERN_PROVIDER=mistral routes the orchestrator, agents, debate, verification, briefing analyser, partner consult, agent-builder and Clawern processing through Mistral AI in Paris. The README then states a limitation directly: the Lavern Challenge, a blind document comparison at src/api/routes/challenge.ts, still instantiates the Anthropic client directly and will hit Anthropic even when Mistral is selected. The README's own advice is to avoid that feature if you need a strict EU boundary, and to use claw start --ethical to enforce Mistral-only with a conservative risk posture across the rest of the pipeline.

That is a genuine gap, not a rounding error. A single route that bypasses the provider switch means the boundary is a property of the pipeline rather than of the configuration, and anyone relying on the flag alone would be wrong. The README deserves credit for naming it instead of leaving it to be discovered.

The quality claim behind the 10-pass loop is untested

The README separates two claims carefully. The architecture is real, the code is open, the pipeline runs, the agents debate, the verification loops fire, the precedent board persists and the tests pass. What has not been independently validated is the quality bar: whether all this machinery produces materially better outputs than a well-prompted single LLM on a representative sample of real legal work. There is internal evaluation and no public benchmark.

That is the honest position, and it should shape how you read the 10-pass loop. Ten passes over the same document with the same underlying model is not ten independent checks. The grounding verifier is the exception, because string-matching a quote against the parsed document is a mechanical test. The other passes are model judgements, and passing all ten tells you the output satisfied ten prompts, not that a lawyer would agree with it.

The three-layer structure reduces the chance that one weak finding reaches the deliverable, and the human gate stops critical calls from auto-delivering. Neither substitutes for a benchmark. If your use case depends on measured review quality, you are supplying that evidence yourself, and the repository gives you the harness to do it: 1,677 tests across 105 files, a clean tsc --noEmit on backend and frontend, and an evals directory at the top level.

Licence, dataset provenance, and what upgrades cost

Lavern is Apache-2.0, which permits commercial use, modification and redistribution provided you keep the licence and notices. The repository carries a NOTICE file for a reason. Five seeded legal datasets ship with it, CUAD, MAUD, ACORD, UNFAIR-ToS and LEDGAR, and the README states each is under its own license. ContractNLI was removed because its CC BY-NC-SA 4.0 terms are incompatible with Apache 2.0, and the README tells you to fetch it yourself if you need it. If you redistribute Lavern, or build on the samples, the dataset licences travel with the code even though the code's licence does not cover them. This is not legal advice; read NOTICE and each dataset's terms before shipping anything derived from the samples.

Upgrade cost is real but bounded. The version is 0.15.0, so the interface is still moving, and the CHANGELOG is the place to look before pulling. The Dockerfile pins node:20-slim across three stages and copies .npmrc, which carries legacy-peer-deps=true so a zod@^4 and openai@^4 peer conflict resolves inside the container. That setting is a workaround, and it will need revisiting when those dependencies align. The runtime stage installs python3, make and g++ to build better-sqlite3, so image builds are slower than a pure-JavaScript service and will break if the build toolchain image changes. Persisted state lives in the lavern-data and lavern-logs volumes, which means an upgrade that changes the SQLite schema has to be handled by you; the README does not document a migration path.

Editorial conclusion

Adopt Lavern if you want to read or fork an agentic legal architecture: the debate protocol, the three verification layers and the precedent board are concrete mechanisms you can lift into your own system, and local mode runs without an API key. Do not adopt it as a production contract-review service. The README states plainly that it is not a product, that the quality bar has no public benchmark, and that the Lavern Challenge route still calls Anthropic even when Mistral is selected, so a strict EU boundary excludes that feature. Before committing, run npm run typecheck:all and npm test on your own checkout, and read src/types/verification.ts to see whether the ten passes match the review you actually perform.

Frequently asked questions

Official sources

1. AnttiHero/lavern on GitHub
2. License: Apache-2.0
3. Project website
4. README
5. Releases