pi-jev-sentinel
Jev Sentinel: guard for Pi, Claude Code and Codex that checks tool calls, tool outputs and replies, failing closed.
Overview
Jev Sentinel is a guard for coding agents built on Jev, with one set of checks for three hosts: a Pi extension and plugins for Claude Code and Codex CLI. Before a tool call runs, it judges intent (on task, off task, injected or needs more context) and risk from safe to harmful on a 0-2 score, and asks you or warns with Block highlighted. Before the agent reads tool output, it checks whether the content contains instructions aimed at AI agents and whether they are benign or suspicious; suspicious content gets a warning and all later actions need approval until reset. After a reply, it flags harmful content or relayed injections, optionally unsupported claims or skipped work.
When unsure, it adds more context and asks again up to three times. Secrets from .env, keys and credential files are withheld and secret-looking values scrubbed before anything is sent, which the README says reduces but does not guarantee leaks. A message starting with * pins the task. It fails closed and protects its own settings. On Pi, which has no permission system, it is the gate.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Is this tool call on task, off task, injected, or does it need more context? | on task · off task · injected · needs more context |
| Score | Risk of this tool call | safe · needs approval · harmful |
| Yes / no | Does this tool output contain suspicious instructions for AI agents? | yes · no |
How it works
- Before each tool call, judge intent and risk.
- Before reading output, scan for injected instructions.
- After replies, flag harmful content or relayed injections.
- Ask or warn; fail closed on errors.
Strengths
- Covers actions, inputs and outputs.
- Works on Pi, Claude Code and Codex.
- Secret scrubbing before sending.
Caveats
- Pattern-based scrubbing is not a guarantee.
- Fail-closed may interrupt when the API is down.
Getting started
Install the Pi extension or the Claude Code / Codex plugin and set your TypeSafe key.At a glance
- Type
- Plugin
- Status
- beta
- Language
- TypeScript
- Runtime
- Pi extension, Claude Code and Codex plugin
- Has code
- yes
Use cases and integrations
How curated lists describe it
Pi coding-agent extension: TypeSafe Jev checks for tool calls, tool outputs and replies (prompt injection, approvals, secret scrubbing, task pinning).
hellogumbo/awesome-jev
Frequently asked questions
What happens if Jev is unavailable?
It fails closed and asks you; it never auto-allows.
Does it detect prompt injection in files?
Yes, it scans tool outputs for instructions aimed at AI agents.
Which agents does it support?
Pi, Claude Code and Codex CLI.
Related projects
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptPre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptCoding-agent tools on Jev with public benchmarks: a strict command gate, a code-review router Action, and use cases.
MCP serverbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptSafety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScript