---
title: "Tools: guardrails for agents (tool-call gates, permission hooks, injection screens, rule checks)"
type: community
source_tier: community
tags: [community, tools, guardrails, hooks, prompt-injection]
created: 2026-09-25
updated: 2026-09-25
confidence: medium
sources:
  - raw/x-repos/clownware__bouncer.md
  - raw/x-repos/rashedInt32__jev-gates.md
  - raw/x-repos/valentynkit__jev-belay.md
  - raw/x-repos/coldteadotai__abide.md
  - raw/x-repos/PanAchy__jevvy.md
  - raw/x-repos/somoore__interlock.md
  - raw/x-repos/y0usaf__pi-jev.md
  - raw/x-repos/jomatsu__pi-jev-auto-mode.md
  - raw/x-repos/jomatsu__pi-jev-auto-mode__docs-calibration.md
  - raw/x-repos/doeixd__jev-pref.md
  - raw/x-repos/valentynkit__jev-commit.md
  - raw/x-repos/eugeniughelbur__jev-engineering.md
  - raw/x-repos/eugeniughelbur__jev-engineering__results-2026-09-20-injection-test.md
  - raw/x-repos/noelzappy__tripwire.md
  - raw/x-repos/Brainwires__jevwire.md
  - raw/x-repos/Brainwires__jevwire__docs-benchmarks.md
  - raw/x-repos/jonathanavis96__jev-kit.md
  - raw/x-repos/jonathanavis96__jev-kit__docs-measurements.md
  - raw/x-repos/0x7067__claude-jev.md
  - raw/x-repos/agent-chaperone__agent-chaperone.md
  - raw/x-repos/agent-chaperone__agent-chaperone__bench-readme.md
  - raw/x-repos/leepokai__jev-guard.md
  - raw/x-repos/buberlo__dsh-jev.md
  - raw/x-repos/buberlo__dsh-jev__docs-benchmark.md
  - raw/x-repos/PerryLink__jevcore.md
  - raw/x-repos/kiwi0719__jev-edge.md
  - raw/x-repos/kiwi0719__jev-edge__bench-report.md
  - raw/x-repos/luantak__is-malicious.md
  - raw/x-repos/andrelandgraf__safer-with-jev.md
  - raw/x-repos/andrelandgraf__safer-with-jev__design.md
  - raw/x-repos/Jimuelle07__Helm.md
  - raw/x-repos/Jimuelle07__Helm__skills-helm-references-dispatch-modes.md
  - raw/x-repos/Nanako0129__lorenzini.md
  - docs/sweep/2026-09-25-mrjev/partc.md
jev_version: "jev-1.13.0"
summary: "Community Jev guardrails for agents and gateways: tool-call gates, permission hooks, injection screens, rule checks on edits, stop and review gates; fail mode and install footprint per row."
---

# Tools: guardrails for agents (tool-call gates, permission hooks, injection screens, rule checks)

> **TL;DR** Community tools that put Jev between an agent and its actions: tool-call gates (P03), injection and content screens (P16, P35), rule checks on edits and stop or review gates (P04, P10). **Unaudited code** that sees your commands, files and often your key; read the fail mode and install footprint before wiring any of it in. Where authors measured, the gate often added latency without better outcomes. Split from [[ideas/tools-and-integrations]] on 2026-09-25 (nothing dropped).

Pattern IDs: [[ideas/patterns]] (P03 lives in [[ideas/patterns-agents]]). Licence MIT unless stated. Numbers: the author's. "Our check" = our 2026-09-25 source and registry vetting (docs/sweep/2026-09-25-mrjev/partc.md), not a raw capture.

**Before you install.** These tools hook every tool call, edit or prompt, so their install footprint matters:
- **A Jev probability can widen permissions.** Jimuelle07/Helm maps `needs_human < 0.30` to "unattended" flags such as Claude Code `--permission-mode bypassPermissions` or Crush `--yolo`, and the author calls every threshold uncalibrated. Only reached through `--execute`. A P03 gate should only ever narrow permissions.
- jev-kit wires a `PreToolUse` hook on every tool (only with `--wire`) and installs default-on timers, including a Claude Code auto-updater; opt-in parts add a shim over `claude` and a tuning loop that commits to its own branch.
- claude-jev fetches a 51 MB ast-grep binary (sha256-pinned) in a detached process; its compaction hook, like jev-pruner's and jevctl's, needs the undocumented `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS`.
- agent-chaperone's plugin installs its npm package on the first screened call when none is global. jev-edge installs with `sudo make install`.
- **jevwire's README says `npx -y jevwire`, but npm had no `jevwire` package on 2026-09-25 (our check): anyone can claim the name. Build from the repo.**
- Fail direction differs: most gates here **fail open** (an outage lets everything through); pi-jev-auto-mode fails closed, and Pi Jev Guard asks the human, or blocks without a UI.

## Tool-call gates and permission hooks (P03)

| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| [Bouncer](https://github.com/clownware/bouncer) (Clownware) | Claude Code `PreToolUse`: 7 Nouls, YAML policy, 15 hard rules first; `observe` default; `bouncer calibrate` gates releases | `claude plugin marketplace add clownware/bouncer`, then `claude plugin install bouncer@bouncer` | 1 · 2026-09-20 · no licence | 104 near-miss fixtures, Brier per question; `cat .env` scored 0.15, so rules own the edges |
| [jevwire](https://github.com/Brainwires/jevwire) (Brainwires) | MCP server, library and Claude Code plugin: hooks on session, prompt, tool and stop events via a local daemon (127.0.0.1:10522); never returns "allow"; may `deny` a call once with a reason the agent can answer | from a checkout (npm name unclaimed, above) | 20 · 2026-09-21 | hooks fail open silently if the daemon is down. Author: 53 candidates per request bunched at 0.84–0.87 and missed the file; at 16 it came first, now the cap. 740 live calls p50 536 ms, ~$0.064 total, 10 trips in 689 gate decisions → [[ideas/failure-reports]]. P04, P17 |
| [jev-kit](https://github.com/jonathanavis96/jev-kit) (jonathanavis96) | rules table first, one Jev question for the ambiguous rest; deny needs confidence ≥ 0.8 and margin ≥ 0.4; tier guard, belay, file search, browser agent | `git clone`, `install/install.sh` (`--wire` edits settings) | 36 · 2026-09-24 | everything fails open. Author: general-risk rule 20/21; 30-session A/B had **zero denies**, so no savings shown; Wikipedia hops 15/18 when named, 0/6 when not → [[ideas/builds-agents]]. P02, P12 |
| [jev-guard](https://github.com/leepokai/jev-guard) (leepokai) | risk Score 0–3 plus approval, user-requested and from-untrusted Nouls per call, with session memory; scans tool results and skill files | `npm i -g jev-guard`; `install` writes hooks into Claude, Codex, Copilot, Gemini, Cursor, pi or OpenCode config | 34 · 2026-09-24 | key file 0600, sent only to TypeSafe or Vercel. Author: ~0.75 s direct from Taiwan, p50 ~580 ms via Vercel over 21 calls; none of 662 installed skills flagged. Its Vercel path differs from the documented base URL (`unverified`). P16, P35 |
| [agent-chaperone](https://github.com/agent-chaperone/agent-chaperone) | screens tool calls before they run and results before the agent reads them: fixed lists plus a Jev question battery; MCP proxy and hooks; `shadow` default | `npm install -g agent-chaperone`; plugin `agent-chaperone@agent-chaperone` | 21 · 2026-09-23 · Apache-2.0 | author, 2026-09-21, 1,947 requests, $0.062: InjecAgent AUC 0.976; BIPIA email recall 0.825 at 0.5 (jev-edge below reports the opposite on BIPIA with other wording); 8 false positives on 68 benign texts about injection → [[ideas/head-to-head-benchmarks]]. P16 |
| [Jevvy](https://github.com/PanAchy/jevvy) (PanAchy) | auto-approves harmless shell asks, else abstains | `npx @jevvy/permissions init` | 15 · 2026-09-21 | 5 providers incl. custom endpoint. **Flag: approving when every Noul probability is at or under its threshold widens permissions, against this page's narrow-only rule (see the Helm warning above).** Mitigations per the README: allow/deny rules stay final, it sees only unresolved shell asks, shipped thresholds calibrated on the author's `eval/commands.json` (custom policies and unverified endpoints not covered). |
| [Interlock](https://github.com/somoore/interlock) (somoore) | `gate()`: detectors → Noul battery → policy code; agent sees only canary secrets | `pip install -e .` | 0 · 2026-09-19 | 38-case regression set, not a benchmark |
| [pi-jev](https://github.com/y0usaf/pi-jev) (y0usaf) | Pi gate on `bash`/`write`/`edit` (four questions, one request, ~300 ms), output judge for leaked secrets and failure class, `jev_ask` | `pi install npm:@y0usaf/pi-jev` | 146 · 2026-09-22 | shadow mode default; **every error fails open**. Not madeye/pi-jev; unscoped npm `pi-jev` is TheoOliveira's ([[ideas/tools-and-integrations]]). P11 |
| [pi-jev-auto-mode](https://github.com/jomatsu/pi-jev-auto-mode) (jomatsu) | deterministic policy first; Jev judges only escalated calls | `pi install npm:pi-jev-auto-mode` | 26 · 2026-09-24 | **fails closed**; 171 offline tests; calibration doc: 13 fixtures (its README says twelve), one sample each, reruns moved some probabilities by ±0.05 |
| [jev-engineering](https://github.com/eugeniughelbur/jev-engineering) (eugeniughelbur) | Claude Code tool-call gate; installs in observe mode | `claude plugin marketplace add eugeniughelbur/jev-engineering`, then `claude plugin install jev-engineering@jev-engineering` | 2 · 2026-09-24 | 300-call injection test: catching every attack needed a 0.8 floor that re-prompted 58% of normal traffic ([[ideas/failure-reports]]) |
| [dsh-jev](https://github.com/buberlo/dsh-jev) (buberlo) | DeepSeek Harness: narrows tools and gates calls (matches task, missing info, breaks a restriction); mock + shadow by default | `dsh plugin --profile <name> add @buberlo/dsh-jev@0.1.4` | 23 · 2026-09-23 | **author's verdict: no better than a rule in the prompt when the model complies, and slower** (prompt rule 0/10 deletions); a weaker model tried 10/10 times and Jev denied all 31 attempts. npm 0.1.2 and 0.1.3 are broken (our check) → [[ideas/failure-reports]]. P08 |
| [jevcore](https://github.com/PerryLink/jevcore) (PerryLink) | core library, DeepSeek Harness plugin and MCP server; offline mock by default, prints what each feature sends before anything leaves | `dsh plugin --profile <profile> add jevcore-dsh`; `npx -y jevcore-mcp` | 31 · 2026-09-24 · Apache-2.0 | a live check caught it sending Score `criteria` as a keyed map; the API needs an ordered array (`verified`, [[concepts/score]]). Claims an audit of 19 DeepSeek Harness Jev plugins found undisclosed egress in guard modules; names none (`unverified`). P07, P17 |
| [Helm](https://github.com/Jimuelle07/Helm) (Jimuelle07) | picks among the coding-agent CLIs you have installed (options built from that list plus `none`); seven questions decide auto / recommend / clarify / escalate; a supervisor asks Jev whether the worker is done | `claude plugin marketplace add Jimuelle07/Helm`, then `claude plugin install helm@helm` | 11 · 2026-09-24 | **warning above: a low `needs_human` can switch on bypass or `--yolo` modes with uncalibrated thresholds.** Author: 2,149 tokens, 0.7 s, $0.00009 per decision (`verified` at $0.042/Mtok). P05, P04 |

Names only: [Pi Jev Guard](https://github.com/zszz3/Pi-Jev-Guide) (zszz3; four questions per action, asks the human once when Jev fails and blocks without a UI; 67 offline tests, never run with a real key; **npm `pi-jev-guard` 0.7.2 is another publisher's**, the repo's 0.2.1 is unpublished; our check).

## Injection and content screens (P16, P35)

| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| [jev-edge](https://github.com/kiwi0719/jev-edge) (kiwi0719) | nginx/OpenResty filter: cheap rules, then a live Jev check (~270–300 ms p50, adaptive 400–1,000 ms timeout, circuit breaker, cache), then an async side path | Docker demo; `sudo make install` | 35 · 2026-09-22 · Apache-2.0 | fail-open. Author: deepset AUC 0.983 with 37.3% missed, 0.996 and 5.3% once the deployment is described; **BIPIA EmailQA 81.5% missed**; untrusted-content flag cut tool-result misses 77.8% → 19.0% → [[ideas/head-to-head-benchmarks]]. No known production use |
| [is-malicious](https://github.com/luantak/is-malicious) (luantak) | scans a repo before you run it: files grouped by directory, all categories in one request, second pass on suspicious lines | `npx is-malicious /path/to/project` | 27 · 2026-09-23 | derives Noul confidence as `2 * \|p - 0.5\|` (Noul has none, `verified`, [[concepts/confidence]]); splits chunks on `max_tokens_exceeded` (`unverified`); skips files over 400,000 bytes. `--base-url` sends all scanned source to that server. No accuracy; 3 fixtures |
| [tripwire](https://github.com/noelzappy/tripwire) (noelzappy) | AI SDK middleware or proxy, 7 checks per LLM reply | `npm i @noelzappy/tripwire` | 2 · 2026-09-18 | **no accuracy vs real Jev yet** |

Warning only, never a route: [safer-with-jev](https://github.com/andrelandgraf/safer-with-jev) (andrelandgraf, no licence) is a public demo API with no caller auth that runs anyone's text through Jev on the owner's key (`/ask-jev`), and can forward approved bodies with the caller's own upstream API key. An open endpoint on one key looks like offering the Services standalone (MCA §2.3(a), our reading, not legal advice); see the Warnings on [[ideas/platforms-and-gateways]].

## Rule checks on edits, stop and review gates (P04, P10)

| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| [claude-jev](https://github.com/0x7067/claude-jev) (0x7067) | rules from CLAUDE.md, AGENTS.md and rule folders judged per edit: block ≥ 0.80, silent < 0.50, second call between; verbatim compaction; prompt router | `claude plugin marketplace add 0x7067/claude-jev`, then `claude plugin install claude-jev@claude-jev` | 18 · 2026-09-25 | author, v0.21.0: 22 of 247 real edits blocked (17 by one repo's comment ban), 17/29 planted violations caught, 0/24 near-misses. **Prompt router mostly failed**: 34.6% on 1,613 prompts; a 3-way taxonomy (58.8%) scored below a constant guess (64.7%) → [[ideas/failure-reports]]. P07, P02 |
| [jev-gates](https://github.com/rashedInt32/jev-gates) | 7 Claude Code gates (rule, scope, intent, done, claims, proof, commit); escalate, never approve | plugin | 0 · 2026-09-20 | P04, P10 |
| [jev-belay](https://github.com/valentynkit/jev-belay) | Stop hook; asks only if files changed and no check passed | plugin | 18 · 2026-09-20 | AUROC 0.976 on 100 stops; 346 ms; $0.00005. P04 |
| [Abide](https://github.com/coldteadotai/abide) (coldteadotai) | one question per AGENTS.md rule per edit; Claude Code, Codex, OpenCode | `npx @coldtea/abide init` | 210 · 2026-09-20 | 93 sessions: 39 edits flagged, 10 confirmed. P10 |
| [jev-pref](https://github.com/doeixd/jev-pref) (doeixd) | AGENTS.md preferences → semantic lint rules on code changes, fed back to the agent | `npx jev-pref setup` | 9 · 2026-09-18 | P10 |
| [jev-commit](https://github.com/valentynkit/jev-commit) (valentynkit) | `commit-msg` hook: five questions on message vs staged diff, one request | pre-commit `rev: v0.1.0` | 13 · 2026-09-19 | warns; stops only a credential on an added line. P10 |
| [lorenzini](https://github.com/Nanako0129/lorenzini) (Nanako0129) | skills that wait for CodeRabbit, Copilot or Codex reviews; silence is never a pass; an 11-incident ledger of past false passes | clone | 17 · 2026-09-25 · no licence | Jev is off by default and shadow-only (`JEV_SHADOW=1`): it may only turn CLEAN into HOLD, never the reverse. Adding "nitpick" to the criteria moved one heading from 0.37 to 0.697 → [[ideas/builder-lessons]]. P42, P11 |

Also a gate: patdown's Claude Code Write/Edit hook ([[ideas/tools-code]]).

## Related

- [[ideas/tools-and-integrations]] — hub: MCP servers, plugins, connectors, agent routing
- [[ideas/patterns-agents]] — P03 tool-call gate, P04 done-checks; [[ideas/patterns-coding-agents]] — P11
- [[ideas/failure-reports]] — gates that added latency or over-denied
- [[ideas/tools-code]] — linters and scanners run from CLI or CI

## Sources

Links inline; raw captures (2026-09-23 to 25) in frontmatter. Names-only lines and "our check" notes rest on our 2026-09-25 vetting at source (docs/sweep/2026-09-25-mrjev/partc.md) where no capture exists.