A guardrail checks text before it is used. It might screen a user message for prompt injection, an agent's tool call for danger, a model reply for personal data, or a chat message for spam. These are yes or no questions that run on every request, so the answer needs a type and a confidence value. A decision model returns both. Code then allows, blocks or escalates. The examples in this hub run on Jev and other decision models. Some are libraries, such as CryptoOda/typesafe-guard and noelzappy/tripwire. Some are bots, such as backmeupplz/jev_antispam_bot for Telegram. Others are hooks for coding agents, like clownware/bouncer. Before you copy one, check what the policy says and who can edit it, what happens on a low-confidence answer, and whether it blocks or only logs. Check that any test numbers come from data like yours, and who ran them. Several entries are small enough to read in one sitting, which makes them good starting points.
29 entries
Showing 29 of 29
Extension making Jev the decision layer for the Pi coding agent: a measured tool-call gate plus a jev_ask tool. Judges whether an action is destructive, exfiltrates data or exceeds scope, then blocks or warns on calibrated thresholds.
144 starsGate latency ~300ms
Guardrails for the Pi agent built on pi-typesafe. Jev judges irreversible and off-task tool calls, detects stuck loops, checks unverified completion claims and flags low-quality output, steering the agent rather than interrupting the user.
DevMortimerOpenpi-warden on github.com138 starsHolds per 1000 calls 3
A Python evals and guardrails library for agent traces that uses Jev-style decision models instead of an LLM judge, running Jev through TypeSafe or Vercel, or Kev or Laya locally on a Mac. All checks for a trace go out as one request in a few hundred milliseconds.
openlayer-aiOpenjevals on github.com81 starsVariance vs LLM 92-913x
Real-time Discord moderation bot that runs Jev evaluations over message text and metadata in parallel to catch phishing, spam and social engineering, with a progressive escalation ladder.
Security hook for coding agents that risk-scores every tool call with session context (deny/ask/allow), flags prompt injection in tool results and checks skills and plugins. Supports Claude Code, Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP.
Auto mode for the Pi coding agent, which has no permission system of its own. A deterministic layer handles hard denies and your allow and deny patterns, then Jev judges the bash, write and edit calls it escalates and fails closed when it cannot decide. Thresholds come from recorded real-API calibration.
A CLI that scans a codebase's source, config, build and CI files with Jev for hidden or data-stealing behavior, pointing to suspicious files and lines as a second opinion before running unfamiliar code.
A minimal grammY Telegram bot that deletes only the messages Jev is confident are spam.
Decision layer for the Pi coding agent, where Jev answers the closed questions a harness asks dozens of times per session: is this command destructive, did that output leak a key, did the agent verify its claim. Rules live in JSON packs, every answer is recorded, and everything fails open.
Runtime constraints for the Pi coding agent that check every side-effecting tool call against what you actually said before it runs, using your own words as the reason when it blocks a call.
Reproducible comparison of Jev and Claude Haiku 4.5 on 2,000 phishing emails, asking whether an email agent should click the link. Haiku wins on accuracy, 81.3% against 62.6%, while Jev is faster and cheaper, and a logistic regression over Jev's five signal questions reaches 95.1%.
Public HTTP gate running as a Neon Function: Jev inspects the request body, then optionally forwards the same bytes to a caller-chosen HTTPS URL. Endpoints cover prompt injections, unsafe images and unsafe replies, with a companion demo site at safer-with-jev.com.
A single-file input moderation plugin for Mastra agents, running on Jev.
AI SDK middleware and OpenAI-compatible proxy that judges every LLM response before the user sees it, running seven Jev checks in one call of about 100 ms. Policy is YAML, a high-confidence check blocks while a low-confidence one downgrades to a flag, and the author notes there are no accuracy numbers against real Jev yet.
Asks how far written category definitions get you before you need a labeled training set. On a 5,733-email ham, spam and phishing test Jev reached 98.64% against 98.87% for TF-IDF logistic regression. A separate 18,514-email spam run scored 98.3% against 98.4%, and averaging both reached 99.2%.
Proof of concept that identifies Spanish profanity with Jev and replaces the matching word intervals with a beep without changing the audio duration. Word timestamps from an ASR adapter feed parallel Jev evaluations for a Boolean profanity probability and a severity Score, then ffmpeg overlays the beep and writes a JSON audit report.
Two blind security benchmarks for Jev on public corpora: 662 labelled prompt-injection messages and 200 matched vulnerable-code pairs, run through jev-go with raw per-sample output committed. At a plain 0.50 cut the injection run reached 96.5% accuracy, ROC-AUC 0.9927 and p50 325 ms.
A PreToolUse hook for Claude Code that scores every tool call against a YAML policy you own and allows or denies it in about 100ms, with no LLM call in the loop. Runs on Jev today, with local models planned next, and publishes a calibration table.
Measures how well Jev spots real secret credentials in file snippets. Each case is one Noul question and the probability is compared with the expected label, with no regex matching or provider verification. Reports accuracy, AUC, recall, precision, Brier score, review-band counts and latency.
LLM-agnostic guardrails library using Jev to detect prompt injection, jailbreak attempts, PII exposure and credential leaks in one batched request. Not published to PyPI at time of check.
Hackathon project: 200 people versus one agent behind a typed System One action gate that learns from each breach, evaluated with W&B Weave and hardened by a defender loop. Playable at vnmoorthy.github.io/siege.
Moderation for communities and apps that scores every message for spam, scam, harassment and other categories with Jev, with thresholds and actions you set. Ships as Discord, Telegram and Reddit bots plus a CLI, Python and npm packages, an HTTP API and an MCP server.
ohernandezdevOpenohernandezdev/jevmod on github.comA capability kernel that gates every agent tool call: the model gets canaries and placeholders instead of real secrets, and Jev is one of the sensors deciding block, ask, or allow.
Reports using Jev in place of smaller models on a security pipeline, citing over 5x lower cost, faster responses, and much higher accuracy.
Greg Pstrucha (@grichadev)OpenJev inside a security pipeline (X) on x.com83k viewsCost vs prior model 5x lower
A video demo classifies 100 test emails, 50 legitimate and 50 fraudulent, with Jev in 1.42 seconds, routing the 31 cases below 95% confidence to Kimi K3 for a second opinion. The combined pipeline reached 96% accuracy for about $0.07 total.
Hassan (@nutlope)OpenEmail fraud detection with Jev and Kimi (X) on x.com60k viewsJev pass 100 emails, 1.42sCombined accuracy 96/100
Test report using Jev to check each agent action before it executes, reporting most attacks caught with few false blocks and much lower latency than an LLM guard.
meraGPT's own post, following Elvis Saravia's "Building a Custom Harness with Pi and Jev". A Pi agent harness of about 130 lines of JavaScript calls Decider 1 through TypeSafe's JS SDK to pick the model, block shell commands that delete data or use the network, and send unfinished answers back.
Screens LLM inputs and outputs with typed checks so unsafe or off-policy content is caught before it is used.
Moderation playground that screens text in one System One request: parallel Noul probabilities for profanity, hate, sexual content, violence, illegal help, self-harm and spam or jailbreak, plus a severity Score. The verdict comes from policy thresholds in your code, review at 0.35 and action at 0.70.
Nothing matches those filters
Clear a filter to widen the search, or send us the thing you were looking for.
A guardrail sits in the path of a request. It sends the text and a small set of noul questions, such as whether this is an injection attempt, in one batched call. Code reads the probabilities and applies a policy. noelzappy/tripwire runs several checks on each LLM reply before the user sees it, with the policy in YAML. Moderation Guard shows the same idea for profanity, hate and other categories in one request.
Confidence drives the next step. backmeupplz/jev_antispam_bot deletes only the messages Jev is confident are spam. The email fraud detection demo from Hassan routes cases below a confidence cut to a larger model for a second opinion. This two-tier pattern keeps the decision model on the clear cases. Choose the confidence cut by looking at your own mistakes, because a cut that suits one inbox may not suit another.
The limit is false blocks and misses. A guardrail that blocks too much gets switched off. anisselbd/jev-phishing-bench and bitnovus/jev-spam-eval are worth reading because they report where a decision model falls short of the comparison, not only where it wins. Read the failure cases in each, and keep a human review path for anything the model blocks that a user might dispute. Log every block with the question that triggered it.
Entries such as CryptoOda/typesafe-guard and andrelandgraf/safer-with-jev use Jev to flag injection attempts, jailbreaks and personal data in a batched call. Gaurav-Gosain/jev-sec-bench tests it on a public injection corpus. Check results on data close to your own.
Yes. backmeupplz/jev_antispam_bot for Telegram and Jev-Moderation-Bot for Discord run Jev over messages and act when it is confident. Both leave unsure cases alone or send them on.
No. Entries such as clownware/bouncer score tool calls against a policy with no LLM call. Some entries add a larger model only for the cases the decision model is unsure about.
