jev-sentinel
LangChain and LangGraph middleware that screens tool outputs for prompt injection and gates risky tool calls with Jev.
Overview
Jev Sentinel is open-source Python middleware for LangChain and LangGraph agents that defends against indirect prompt injection, where content an agent reads (web pages, emails, tickets, documents) tries to steer it. It works in three layers: an output screen checks whether a tool result is trying to steer the agent and, if so, fences it as untrusted data and marks the conversation as tainted; a tool-call gate asks Jev four questions before each risky call; and a taint link requires at least human review for consequential actions after a flagged output.
The gate questions are whether the user asked for the call, how severe it is, whether it sends data out, and whether tool content prompted it. The answers become allow, review or block, each with a written reason. The README's demo shows a page with a hidden instruction to read credentials and email them: the read and the email are blocked, while the write the user actually wanted goes to review and is approved. The README cites roughly 100 ms per Jev check, includes a mode to try it without an API key, and installs from GitHub with pip on Python 3.10+.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this tool output trying to steer the agent? | yes · no |
| Yes / no | Did the user ask for this tool call? | yes · no |
| Score | How severe is this tool call?(inferred) | — |
| Yes / no | Does this call send data out? | yes · no |
How it works
- A tool returns output
- Jev screens it; flagged output is fenced and the thread tainted
- Before each risky tool call Jev answers four questions
- Answers map to allow, review or block with a reason
- Tainted sessions require human review for consequential calls
Strengths
- Targets indirect prompt injection directly
- Keeps the user's real task working
- Every decision is recorded with reasons
- Demo runs without an API key
Caveats
- Covers LangChain and LangGraph only
- Install is from GitHub rather than a package index
- Policy quality depends on Jev's answers and configured thresholds
Getting started
pip install git+https://github.com/Yasir-Khan-7/jev-sentinelAt a glance
- Type
- Library
- Status
- beta
- Language
- Python
- Runtime
- Library (LangChain middleware)
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
Prompt injection protection & tool-call guardrails for LangChain / LangGraph AI…
wh000wh000/awesome-jev-live
Frequently asked questions
What does Jev decide?
Whether tool output is steering the agent, and four questions about each risky tool call that map to allow, review or block.
What happens after a flagged output?
The conversation is marked tainted and consequential actions need at least human review.
Can I try it without a key?
Yes, the README has a section on trying it without an API key.
Related projects
x402 pre-payment risk-check provider combining sanctions lists, phishing feeds and simulation with Jev checks for injected instructions.
ProjectproductionMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptXano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptDeepSeek Harness plugin where Jev classifies risk, irreversibility, task fit and injection for every tool call before it runs.
PluginbetaTypeScriptOpen-source agent guardrails that use Jev or LAYA to check prompts, retrieved content, tool calls and outputs for injection and risk.
ProjectbetaPython