jev-runtime-security
Ring Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
Overview
Ring Zero Security (repository jev-runtime-security) enforces runtime security for AI agents in the kernel, at the system call, below the agent and anything it writes, so the agent's reasoning never decides whether an operation is allowed. eBPF and LSM hooks decide file open, create, delete and rename per agent, matching protected files by name and device-inode identity so renames, hardlinks and symlinks hit the same decision.
It discovers coding agents, general agents, editor AI extensions, MCP servers and local model runtimes for every user; refuses secrets and named files to every agent process tree; blocks admin tools, out-of-process scheduling and package installs; can taint processes after web fetches or MCP calls and hold them to an egress allowlist; and records every refusal in a trace keyed by session. Jev is an optional checks provider: per the list summaries, it answers a Choice on tool-call argument risk and a Noul on sensitive-data exposure, and its answer can only make a verdict stricter, never permit what policy denies. The project maps its design to published enterprise agent-security guidance and is not affiliated with TypeSafe.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | How risky are this tool call's arguments? | — |
| Yes / no | Does this operation expose sensitive data? | yes · no |
How it works
- Discover agents and runtimes on the machine
- Enforce file, process and network policy in the kernel per agent
- Optionally ask Jev about argument risk and data exposure
- Model answers can only raise severity
- Record refusals in a session trace
Strengths
- Enforcement the agent cannot argue around
- Identity-based file protection
- Model is advisory and can only tighten verdicts
Caveats
- Linux kernel features (eBPF/LSM) required
- Root-level installation
- Jev checks are optional and external
At a glance
- Type
- Service
- Status
- beta
- Runtime
- Linux kernel (eBPF/LSM) with userspace service
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
AI security: asks Jev a Choice on tool-call argument risk and a Noul on sensitive-data exposure for AI coding agents, where the model answer can only raise severity and the kernel still decides the syscall.
yibie/awesome-jevRing Zero Security: runtime security for AI agents, enforced at the kernel…
wh000wh000/awesome-jev-liveRing Zero Security: runtime security for AI agents, enforced at the kernel layer. Decide what each agent can read, run, install and connect to, and keep a record of every refusal.
hellogumbo/awesome-jevRuntime security for AI agents with policy enforced in the kernel at the system call; Jev is an optional checks provider for risk and exposure decisions.
MrJev/awesome-jev
Frequently asked questions
What role does Jev play?
An optional check on argument risk and data exposure that can only make verdicts stricter.
Can the agent disable enforcement?
No. Enforcement authority is root-only and the agent runs with a read-only token.
Is it affiliated with TypeSafe?
No, and no TypeSafe code or weights are bundled.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScriptClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonClaude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGoOpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScriptPi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
PluginbetaTypeScript