Is this a sandbox, or can something still do damage behind its back?

Not a sandbox, and the README says it plainly: it cannot stop a server from doing something the call did not describe, so pair it with OS-level isolation. It is also not a guarantee, since the underlying model does not treat its input as hostile by default and adaptive attacks written against it will get through.

Does my code leave the machine when screening runs?

Yes. Screening sends the arguments and results being screened to the configured model backend. Secret-shaped strings are redacted first, which is best effort rather than a promise, and you can turn screening off per server for content that has to stay local.

Why does it start in shadow mode instead of blocking on day one?

So you calibrate before it can stop your work. Shadow screens everything, blocks nothing, and logs what it would have done with a would have held it marker. Read that log, move the threshold rather than the mode when you disagree with a call, and only then set mode: enforce.

Can I trust those AUC numbers, and what do they leave out?

Partly. The published battery on jev-1.13.0 was 1,947 requests costing $0.062, with AUC 0.976 on 1,394 InjecAgent responses and 0.993 on 100 hand-labeled tool calls. policy_violation, off_task and description_steers are not in the published scores, and screening is a filter rather than a security boundary.

What are the three screening modes?

shadow (the default) screens everything and blocks nothing; enforce holds a call for approval, blocks what the policy denies, and withholds instruction-like results; strict does the same and also stops when a screen could not run at all.

What license is it and how do I install it?

Apache-2.0. Install with npm install -g agent-chaperone, or add the Claude Code plugin from the agent-chaperone marketplace. Screening needs TYPESAFE_API_KEY in the environment.

What happens when a call is held?

It does not run and the agent is told a person is deciding. Inspect it with agent-chaperone show and release it with agent-chaperone approve ; the token names one specific call, is spent when used, and expires.

Jev directory

CommunityJev Agents & MCP

Agent Chaperone

An MCP proxy and hooks adapter that screens an agent's tool calls before they run and the tool results before the agent reads them, with thresholds in a policy file.

See highlights Open github.com

Stars: 22
Language: TypeScript
License: APACHE-2.0
Reading time: 3 min
Published by: Community
Author: agent-chaperone
Last verified: Sep 2026

agent-chaperone/agent-chaperone

Organization repository on GitHub

View on GitHub

Screens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.

Forks: 4
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

About this project

agent-chaperone screens an AI agent's tool calls before they run, and the tool results those calls return before the agent reads them. Every decision comes back as a probability, every threshold lives in a policy file rather than a prompt, and every judgment is written to a local log with the numbers that produced it. It starts in shadow mode, which blocks nothing. You read your own log first and decide what you would have wanted stopped.

Quoted from the project's README. Read the full README.

Tagscommunity mcp security guardrails

Works forJev for Moderation Jev for Decision gating Jev for Tool calling

Used inJev for Security & Privacy Jev for Software & DevTools

Languages: TypeScript
Platforms: MCP CLI
Capabilities: Open sourceRequires API key

Highlights

Screens tool calls before they run and tool results before the agent reads them. The default mode is shadow, which blocks nothing.
Enforce holds or blocks from the policy. Strict also stops when a screen cannot run at all.
On jev-1.13.0, 21 September 2026, the battery was 1,947 requests and cost $0.062.
InjecAgent tool responses: AUC 0.976 on 1,394 items. Hand-labeled tool calls: AUC 0.993 on 100 calls.
A screened call averages 754 input tokens. A call the allow or deny list settles never reaches the model.

Quickstart

bash

agent-chaperone log

Watch out

Apache-2.0. Screening sends arguments and results to the configured model. policy_violation, off_task, and description_steers are not in the published scores. The README says adaptive attacks written against the tool will get through.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

Hacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.

sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker News

YouTube: Kubernetes admission control with a decision model, fail-closed.

X: Jev in front of the HeyGen MCP

Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.

2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker News

From the Jev guides

Original write-ups on what this entry is for.

Adversarial robustness: black-box attacks and JevAdvBench

Oct 23, 2026

What black-box attacks actually do to a typed decision model, what JevAdvBench measures, and where a probability output helps or hurts.

Jev Practices & Patterns#security#adversarial#benchmarks

Read article

Policy trees and approval gates for tool-using agents

Oct 22, 2026

Jev-Guard-style policy trees turn approval into an editable artifact. How to model scopes, audit decisions, and fail closed without blocking the agent.

Jev Practices & Patterns#security#agents#authorization

Read article

Decision hijacking: option manipulation and state poisoning

Oct 22, 2026

A typed answer can be steered by the options and the state, not only by a prompt. How program-level hijacking works and how to design against it.

Jev Practices & Patterns#security#hijacking#state

Read article

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai

Agent Chaperone

About this project

Highlights

Quickstart

Questions about this entry

Is this a sandbox, or can something still do damage behind its back?

Does my code leave the machine when screening runs?

Why does it start in shadow mode instead of blocking on day one?

Can I trust those AUC numbers, and what do they leave out?

What are the three screening modes?

What license is it and how do I install it?

What happens when a call is held?

Reactions & coverage

Related terms

More Jev resources like this

From the Jev guides

From the Jev AI model community