pi-jev
Pi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
Overview
pi-jev uses TypeSafe Jev as a decision layer for the Pi coding agent in three places. A gate judges bash, write and edit calls before they run with four questions in one request (about 300 ms): is it destructive (threshold 0.90), does it exfiltrate local data or secrets (0.70), does it go beyond what the user asked (0.85), and how much damage if unwanted (four-level score, 2.50). An output judge reads what a bash call printed or a codemode script returned, asking about leaked credentials and failure type, and appends a line when either fires. A jev_ask tool lets the model ask typed questions itself.
Shadow mode is the default: flagged calls produce a notification and footer status; enforce mode asks for confirmation, with headless runs falling back to warnings unless configured to block. Every error path fails open, errors are reported at most once a minute, identical input is cached for 120 seconds, and sibling calls share one request. It is MIT licensed.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this action destructive? | yes · no |
| Yes / no | Does this send local data or secrets off-machine? | yes · no |
| Yes / no | Does this affect anything beyond what the user asked for? | yes · no |
| Score | How much damage if the user did not want it? | — |
How it works
- Intercept bash, write and edit calls.
- Ask four gate questions in one request.
- Shadow: notify; enforce: ask for confirmation above thresholds.
- Judge bash output for leaks and failure types afterwards.
Strengths
- One round trip for four questions.
- Shadow mode for safe rollout.
- Covers both intent and output.
Caveats
- Fails open on errors, so outages remove protection.
- Requires a TypeSafe key.
Getting started
pi install git:github.com/y0usaf/pi-jev@v0.3.0 and set your TypeSafe key.At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi extension
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Agent safety: adds a measured tool-call gate to the Pi coding agent so risky calls are checked by Jev before execution.
yibie/awesome-jevPi extension with a shadow-mode tool-call gate, output judge, and typed `jev_ask`.
AnotiaWang/awesome-decision-modelsA Pi extension that flags tool risks before execution and checks output for secrets and failure types.
logicrw/awesome-jev-projectsTypeSafe Jev as a decision layer for the Pi coding agent: a measured tool-call…
wh000wh000/awesome-jev-liveMeasured tool-call gate and general typed decision layer for the Pi coding agent.
cobanov/awesome-jevTypeSafe Jev as a decision layer for the Pi coding agent: a measured tool-call gate plus jev_ask for typed, calibrated answers.
hellogumbo/awesome-jevJev as a decision layer for the Pi coding agent in three places: a gate that judges `bash`, `write` and `edit` calls before they run, an output judge that reads what a `bash` call printed, and a tool the model can call directly.
MrJev/awesome-jev
Frequently asked questions
Does the gate block by default?
No, shadow mode is the default; enforce mode asks for confirmation.
What does the output judge check?
Whether bash output leaked credentials and what kind of failure occurred.
What happens on API errors?
The tool call proceeds; every error path fails open.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScriptRing Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
ServicebetaClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonClaude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGoOpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScript