jes
Open-source agent guardrails that use Jev or LAYA to check prompts, retrieved content, tool calls and outputs for injection and risk.
Overview
jes is a Python guardrail library for AI agents that runs every judgment on a System One decision model such as Jev or LAYA instead of an LLM. Because the model classifies rather than generates, the authors argue injected text cannot talk it out of its verdict. It checks every step of an agent: user input, retrieved pages and files, skills, subagents, tool calls, tool results and responses. Secrets and PII are redacted in-process before any model sees the text.
A Guard is built from policies such as injection, indirect_injection, tool_safety and allowed_tools, each with a threshold you set; there are no magic defaults, and you can pin the model version once tuned. Methods like check_input, check_untrusted, check_tool_call, check_tool_result and check_output return ok and onward, the text to pass on (original, redacted or a block message). It integrates with LangChain create_agent middleware and has a cookbook and lessons. It is Apache-2.0 licensed per the MrJev list.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this text contain a prompt injection or jailbreak?(inferred) | yes · no |
| Yes / no | Is this tool call safe to run?(inferred) | yes · no |
| Yes / no | Does this retrieved content try to redirect the agent?(inferred) | yes · no |
How it works
- Configure a Guard with policies and thresholds
- Redact secrets and PII locally
- Check each agent step with the decision model
- Continue, redact or block based on ok/onward
Strengths
- Classifier-style verdicts resist being argued with
- Covers every step of the agent loop
- Local redaction before any model call
- LangChain middleware integration
Caveats
- Thresholds must be tuned per deployment
- Requires a TypeSafe key or a LAYA endpoint
Getting started
`pip install jes`, `export TYPESAFE_API_KEY=...`, then `Guard([injection(threshold=0.5)], model="jev-latest").check_input(text)`.At a glance
- Type
- Project
- Status
- beta
- Language
- Python
- Runtime
- library (LangChain middleware)
- Has code
- yes
- License
- Apache-2.0
Use cases and integrations
How curated lists describe it
Open-source guardrails for AI agents powered by decision models like Jev;
wh000wh000/awesome-jev-liveOpen-source guardrails for AI agents that check prompts, skills, retrieved content, tool calls and responses for prompt injection with a decision model such as Jev or Laya, with thresholds you set; LangChain integration and lessons. Apache-2.0.
MrJev/awesome-jev
Frequently asked questions
What does jes decide?
Whether inputs, retrieved content, tool calls and outputs are safe, using policy-specific yes/no checks.
Why a decision model instead of an LLM?
It classifies instead of generating, so injected text cannot persuade it.
Are secrets sent to the model?
No. Secrets and PII are redacted in your process first.
Related projects
TypeScript guardrail library plus DeepSeek Harness plugin screening prompts, tool calls, results, responses and claims with Jev.
LibrarybetaTypeScriptLarge catalog of Claude Code agents, commands, hooks and MCPs, listed with community Jev mods for guardrails and subagent models.
CLIproductionJavaScriptMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptXano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptDeepSeek Harness plugin where Jev classifies risk, irreversibility, task fit and injection for every tool call before it runs.
PluginbetaTypeScript