What is guardrails.md?

An opencode plugin from Berget AI that puts a System One decision model in front of every bash command a coding agent is about to run: it scores the command, blocks dangerous ones, and tells the agent why so it can pick another route.

How does the gate score a command?

A small decision model judges each command in about 100 ms on destructiveness, credential leakage, and the rules in your repository's GUARDRAILS.md. The README's example blocks at destructive=0.98 against a 0.7 threshold.

Where do my repository's rules live?

In a GUARDRAILS.md file at the repo root, which the gate reads for every command. Named exceptions in that file do not override a destructive verdict; an intended destructive command must be run by a human or with the gate disabled.

Which coding agents does the plugin support?

opencode, pi, and Claude Code, per the README. It is an opencode plugin first — the topics list opencode and opencode-plugin — and the block message references restarting opencode with SYSTEMONE_GATE=off.

How do I bypass the gate for one command?

The README says the human can run the command directly, or restart opencode with SYSTEMONE_GATE=off for a session that needs it. The agent itself must not edit GUARDRAILS.md to work around a block.

Which teams is the plugin aimed at?

Two situations: teams working close to production where kubectl, helm, and git push are routine and team policy — not filename patterns — separates routine from incident, and background agents whose input is written by strangers.

Does the digest show installation instructions or benchmarks?

No. The captured README excerpt shows the block message and the beginning of the 'When it helps' section, then truncates before setup, model details, cost, or any measured numbers.

Jev directory

CommunityJev Integrations & Adapters

Guardrails.md

An opencode plugin (also for pi and Claude Code) that puts every bash command in front of a System One decision model before it runs: a small model scores destructiveness, secret leakage, and your repo's GUARDRAILS.md policy and blocks bad calls.

See highlights Open github.com

Stars: 8
Language: TypeScript
License: MIT
Reading time: 2 min
Published by: Community
Author: berget-ai
Last verified: Oct 2026

berget-ai/guardrails-md

Organization repository on GitHub

View on GitHub

opencode plugin: a System One decision model judges every bash command before it runs — destructive / credentials / your guardrails.md policy

Forks: 2
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

Tagscommunity github opencode guardrails safety

Works forJev for Decision gating Jev for Moderation

Used inJev for Software & DevTools Jev for Security & Privacy

Languages: TypeScript
Platforms: CLI
Capabilities: Open source

Highlights

Scores every bash command an agent is about to run in about 100 ms: destructive, credential-leaking, or against your GUARDRAILS.md.
Blocked calls explain themselves: the README example shows 'SystemOne-gate: blocked command — destructive=0.98 > 0.7'.
Named exceptions in GUARDRAILS.md do not override a destructive verdict; a human must run the command or disable the gate.
Restart opencode with SYSTEMONE_GATE=off for a session that needs it; the agent must not edit GUARDRAILS.md to work around a block.
MIT licensed TypeScript from berget-ai: 8 stars, 2 forks, created 2026-10-04, pushed 2026-10-11, topics include ai-safety and systemone.

Watch out

README reviewed 2026-10-17; the digest truncates inside the 'When it helps' section, so the model used, install steps, thresholds, and pricing are not visible. No benchmarks or false-positive rates are stated, and the gate covers bash calls only, not other tool calls.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

X: Agent Handoff Gate: agents verify what they hand off

X: Jev as an LLM guardrail inside Agentgateway

X: Vercel's fx safety reviewer, measured at 18× faster

Reddit: Early experiments wiring Jev into Pi as a safety layer and model router.

From the Jev guides

Original write-ups on what this entry is for.

Decision gates in agent frameworks: what each integration ships

Oct 16, 2026

How Pydantic AI, Mastra, TanStack AI, DSPy, Spring AI, and LiteLLM expose Jev: where the typed decision sits in the loop, what each integration returns, and which big frameworks are only adjacent.

Jev Integrations & Adapters#agents#frameworks#integrations

Read article

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai