agent-guardrail-jev
Xano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
Overview
Agent Guardrail with Jev is a Xano backend template that acts as an approval layer for AI agents. Before running a tool, an agent posts the proposed call to /guard/tool-call. Xano records it, asks Jev three typed questions and turns the probabilities into a decision with a routing rule you control: confident-safe calls run, confident-dangerous calls are blocked, and anything uncertain, destructive or off-request waits in a review queue.
It targets teams whose agents can look up orders, issue refunds, export data or delete records, where prompt injection or ambiguous requests can cause harm. One POST to TypeSafe sends the agent, user request and proposed call as state with a Choice verdict and two Nouls. If Jev is unreachable or unconfigured, the guardrail fails closed. Reviewers decide in a single-file console, every decision is logged, and agents poll for the outcome.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this run without a human? | safe · needs_review · dangerous |
| Yes / no | Is this call destructive? | yes · no |
| Yes / no | Does this call match what the user actually asked for? | yes · no |
How it works
- Authenticate the agent by key
- Record the proposal as pending_review
- Ask Jev the three questions in one call
- Route: allow confident-safe, block confident-dangerous, queue the rest
- Human reviews queued calls; agent polls for the outcome
Strengths
- Fails closed on errors or missing key
- Thresholds in a routing rule you control
- Full audit log and review console
Caveats
- Tied to the Xano platform
- Needs a TypeSafe key
- No licence stated
At a glance
- Type
- Project
- Status
- beta
- Language
- XanoScript
- Runtime
- Xano backend
- Has code
- yes
Use cases and integrations
How curated lists describe it
AI agent tool-call guardrail for Xano: Jev (TypeSafe AI) judges each call;
wh000wh000/awesome-jev-live
Frequently asked questions
What happens if Jev is down?
The guardrail fails closed and the call waits for a person.
What three questions are asked?
A verdict (safe, needs_review, dangerous), whether it is destructive, and whether it matches the request.
Who reviews held calls?
Humans in the included single-file review console.
Related projects
MCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptDeepSeek Harness plugin where Jev classifies risk, irreversibility, task fit and injection for every tool call before it runs.
PluginbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScript