traffic-guard
Zero-dependency HTTP traffic and bot defense gate that can escalate requests to Jev for five typed risk questions.
Overview
traffic-guard is a Node.js module and Python package that decides whether to block incoming web requests. By default it runs entirely in-process with no dependencies, using header wire-order analysis to spot forged user agents, HMAC-signed velocity cookies, an inline proof-of-work challenge, tarpitting and honeypot URLs. The README says this local path runs in under 100 microseconds.
When a TYPESAFE_API_KEY is provided, the gate escalates to jev-latest for semantic evaluation using five parallel typed questions, aimed at long-tail obfuscated attacks such as exploit payloads and bot behavior. It is for web developers who want a drop-in middleware call returning shouldBlock and reasons. The project states that accuracy and latency claims are checked against a bundled dataset, but the excerpt does not list the five questions.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Should this request be blocked as a bot or attack?(inferred) | block · allow |
| Score | What is the risk level of this request?(inferred) | — |
How it works
- Call trafficguard(req) in a request handler.
- Local checks run: header order, velocity tokens, proof-of-work, honeypots.
- With a key, Jev answers five typed questions about the request.
- Return 403 when shouldBlock is true, with reasons.
Strengths
- Zero required dependencies for the local tier.
- Local path is reported at under 100 microseconds.
- Jev tier is optional and adds semantic checks.
- Same API in Node.js and Python.
Caveats
- The five Jev questions are not documented in the excerpt.
- Claims of zero false positives are the author's and should be tested.
- Jev tier adds a network call per escalated request.
Getting started
npm install traffic-guard (or pip install traffic-guard); optionally export TYPESAFE_API_KEY.At a glance
- Type
- Project
- Status
- beta
- Language
- TypeScript, Python
- Runtime
- Node and Python web middleware
- Has code
- yes
Use cases and integrations
How curated lists describe it
High-throughput traffic and attack defense gate for incoming HTTP traffic with zero required dependencies, wire-order header validation, and TypeSafe System One acceleration for bot mitigation, exploit detection, and risk scoring.
logicrw/awesome-jev-projects
Frequently asked questions
What does traffic-guard decide?
Whether an incoming HTTP request should be blocked, with reasons.
Does it need Jev?
No; Jev is an optional tier enabled by setting TYPESAFE_API_KEY.
What runs locally?
Header order checks, HMAC velocity tokens, proof-of-work, tarpitting and honeypot traps.
Related projects
x402 pre-payment risk-check provider combining sanctions lists, phishing feeds and simulation with Jev checks for injected instructions.
ProjectproductionCisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Agent skillproductionPythonReviews agent skills, MCP configs and source with local static checks plus Jev before install, reporting evidence, risk and coverage gaps.
MCP serverbetaPythonEvent-stream layer labelling signups, logins and checkouts as human, AI agent, crawler or bot, with a bad-intent probability.
AppprototypeJavaScriptGallery of small Python demos where Jev answers typed questions on realistic state and explicit policy decides the action or fallback.
AppprototypePythonBlind security benchmarks for Jev on public corpora: prompt-injection detection (96.5% with context) and vulnerable-code detection.
BenchmarkresearchGo