Skip to content
Metatext Decide — typed decisions for your agents, with a probability on every answerGet early access
Metatext
Sign Up

Agent Chaperone

MCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.

MCP serverbeta
View on GitHub ↗Live demo ↗

Overview

agent-chaperone is a calibrated firewall for AI agent tool calls. It screens each call before it runs and each result before the agent reads it, combining deterministic rules (allow and deny lists, secret patterns) with a small battery of typed Jev judgments. Every decision is a probability, every threshold sits in a policy file rather than a prompt, and every judgment is logged locally with its numbers. It ships as an MCP proxy plus a hooks adapter for a client's built-in tools.

It starts in shadow mode, blocking nothing, so you read your own log before deciding what to stop. The README is candid: it is not a sandbox, not a replacement for permission prompts, not a guarantee against adaptive attacks, and not local-only, since screened content goes to the model backend after secret redaction. Without a TypeSafe key only the rules run; OpenRouter or AI Gateway models can be used instead but their probabilities are not calibrated.

What the decision model decides

TypeQuestionAnswers
Yes / noShould this tool call be blocked before it runs?(inferred)yes · no
Yes / noDoes this tool result contain instructions or content the agent should not read?(inferred)yes · no

How it works

  1. Intercept a tool call or result via MCP proxy or hook
  2. Apply deterministic rules and redact secret-shaped strings
  3. Ask Jev a battery of typed questions, with session caching
  4. Compare probabilities to thresholds in the policy file
  5. Log the judgment; in shadow mode allow, in enforce mode block when over threshold

Strengths

  • Thresholds live in policy, not prompts
  • Local log of every decision with its numbers
  • Shadow mode for safe rollout
  • Session cache avoids paying twice for identical state

Caveats

  • Not a sandbox and not robust to adaptive attacks, per the README
  • Screened content leaves the machine
  • Non-Jev backends give uncalibrated probabilities

Getting started

npm install -g agent-chaperone, then set TYPESAFE_API_KEY.

At a glance

Type
MCP server
Status
beta
Language
TypeScript
Runtime
MCP proxy + agent hooks (Node)
Has code
yes
Has tests
yes

Use cases and integrations

How curated lists describe it

  • Agent safety: MCP proxy plus hooks that screen a tool call before it runs and a tool result before the agent reads it, with 45 test files behind it.

    yibie/awesome-jev

  • Screens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.

    hellogumbo/awesome-jev

  • MCP proxy that screens a tool call before it runs and the tool result before the agent reads it, combining rules in code with typed judgments. Starts in a shadow mode that blocks nothing.

    MrJev/awesome-jev

Frequently asked questions

Will it block things on day one?

No, it starts in shadow mode and only logs until you switch to enforcement.

What runs without a TypeSafe key?

Only the deterministic rules; judgments record that no model was asked.

Does content leave my machine?

Yes, screened arguments and results go to the model backend after secrets are redacted; screening can be disabled per server.

Related projects

  • agent-guardrail-jev

    Xano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.

    ProjectbetaXanoScript
  • construct-auto-classifier

    Effect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.

    ProjectbetaTypeScript
  • dsh-jev-interceptor

    DeepSeek Harness plugin where Jev classifies risk, irreversibility, task fit and injection for every tool call before it runs.

    PluginbetaTypeScript
  • jev-axi

    Agent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.

    PluginbetaTypeScript
  • jev-firewall

    PreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.

    HookbetaTypeScript
  • jev-guard (leepokai)

    Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.

    LibrarybetaTypeScript