agi-jev-containment
Hackathon agent monitor that scores chains of sandboxed agent actions with Jev and escalates through a fixed L1-L5 containment ladder.
Overview
AGI Jev Detection (dashboard name AngryRobot) is a local observability and response stack for sandboxed LLM agents, built for HackSpain 2026 with FastAPI, React/Vite and Neo4j. It ingests tool events from a Docker-sandboxed agent, redacts secrets, writes an append-only JSONL tape and classifies a chain of actions rather than a single tool call.
Jev scores intent, which is fused with Sentinel rules and SafetyDrift signals; then a deterministic gate sets an escalate-only incident level from 0 to 5. L1 and L2 record, L3 tags and continues, L4 contains one agent and voice-pages on-call, and L5 (cutting the environment) waits for a human. A model never pulls the plug. It targets covert exfiltration, forged tools and lateral movement, with Neo4j graph forensics and a live dashboard. The demo works with no keys, running Jev in degraded mode.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Score | How malicious is the intent behind this chain of agent actions?(inferred) | — |
How it works
- Ingest tool events from the sandboxed agent and redact secrets
- Append to a JSONL tape and the Neo4j graph
- Score intent with Jev and fuse with Sentinel and SafetyDrift
- Deterministic gate sets an escalate-only level 0-5
- Contain or page on-call; L5 needs a human
Strengths
- Chain-level detection, not single calls
- Model output never triggers the kill switch alone
- Runs fully in containers; demo needs no keys
Caveats
- Hackathon project with documented gaps (INCONSISTENCIES.md)
- No licence stated
Getting started
cp .env_template .env && make build (Docker Compose v2 and GNU make required)At a glance
- Type
- App
- Status
- prototype
- Language
- Python
- Runtime
- Docker Compose (FastAPI, React/Vite, Neo4j)
- Has code
- yes
Use cases and integrations
How curated lists describe it
\*\*Open-source AI agent monitoring, malicious-agent detection, and escalate-only containment\*\* for sandboxed LLM agents. Local HackSpain 2026 stack (AngryRobot dashboard): FastAPI, React/Vite, Neo4j. Classifies a \*chain of actions\*, not a single tool call. A model never pulls the plug.
logicrw/awesome-jev-projectsAGI JEV Detection — local AI agent monitor: chain-level malicious-agent detection (TypeSafe Jev + Sentinel), escalate-only L1–L5 containment, Neo4j forensics, AngryRobot dashboard. HackSpain 2026.
hellogumbo/awesome-jev
Frequently asked questions
Can Jev shut down an agent?
No, a deterministic gate sets the level and L5 waits for a human.
Does it need API keys?
No for the demo; Jev runs degraded without a key.
What does it detect?
Malicious chains like covert exfiltration, forged tools and lateral movement.
Related projects
Supervisor for unattended coding agents: one batched Jev Choice over the trajectory decides continue, pause or escalate.
ProjectbetaPythonLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptPython guardrail with a Streamlit dashboard that sends agent tool calls to Jev and allows, blocks or asks for clarification.
AppprototypePythonReference Telltale analyzer extension that asks Jev typed questions from configurable guard packs about coding-agent actions.
PluginprototypeRust- jev-usecases★ 22
Collection of production-shaped Python harnesses implementing most of TypeSafe's listed Jev decisions with confidence-gated logic.
ProjectbetaPython Cognitive control layer for OpenCode that uses Jev to compute GO, DELIBERATE, VERIFY or BLOCK for agent actions, observing by default.
ProjectbetaTypeScript