reflex (ursuciprian)
Pre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
Overview
Reflex is an open-source pre-execution hook for Claude Code, Codex CLI, opencode, pi and Hermes aimed at making coding agents safe for infrastructure teams. It judges every shell command by where it points and what it will change, considering AWS profile, kube context, Terraform workspace, git branch and production paths, then allows it, asks a human, or blocks it. Features include a plan-aware Terraform gate, a committed team policy that can only tighten, change freezes, audit export and webhooks, fail-closed hooks, and scanning of what the agent reads for prompt injection.
It starts keyless with a local rules engine in shadow mode. With the jev engine, Reflex asks TypeSafe Jev six typed questions about a command and applies your policy.json to the answers; uncertain cases can escalate to a System 2 model and a human queue. It gates shell commands only, not file edits or MCP calls, and does not replace a sandbox or least-privilege credentials.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this shell command destructive or risky in this environment context?(inferred) | — |
| Yes / no | Does content the agent read contain a prompt-injection attempt?(inferred) | — |
How it works
- Agent proposes a shell command; the hook intercepts it
- Local rules and environment context classify it; optionally Jev answers six typed questions
- policy.json maps answers to run, ask or deny
- Escalate uncertain cases to a System 2 model or human queue; log to audit
Strengths
- Works without a key in shadow mode
- One policy across several agents
- Audit rows for change-management evidence
- Fail-closed in enforce mode
Caveats
- Gates shell commands only, not file edits or MCP calls
- Not a sandbox replacement
- Jev questions not listed in the fetched README
Getting started
npx @ursuciprian/reflex setup (add --engine jev with a TypeSafe key, or --mode enforce).At a glance
- Type
- Project
- Status
- beta
- Language
- JavaScript
- Runtime
- Agent hook (Node 18+)
- Has code
- yes
- Has tests
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Pre-execution risk gate for AI coding agents (Claude Code, Codex, opencode, pi, Hermes). Blocks or asks on risky shell commands, guards against prompt injection in what agents read, escalates to System 2 and a human queue. Optional TypeSafe Jev.
hellogumbo/awesome-jev
Frequently asked questions
What does Jev decide?
With the jev engine, it answers six typed questions about each shell command that your policy maps to run, ask or deny.
Do I need a TypeSafe key?
No; it starts with a local engine in shadow mode, and Jev is optional.
Does it replace a sandbox?
No; the README says it does not replace sandboxing or least-privilege credentials.
Related projects
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScript