User repository on GitHub
The kernel the LLM is not allowed to talk to. Capability kernel for untrusted agents — canaries, closed action space, Jev as the sensor.
- Forks
- 1
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
Jev directory
CommunityJev Repos & SDKs
Interlock
A Python capability kernel for untrusted agents that wraps every tool call: detectors, a Jev Noul battery, and policy in code return BLOCK, ASK, or ALLOW, while the LLM holds only canaries and placeholders — real secrets are swapped in at egress for allowlisted hosts.
- Stars
- 0
- Language
- Python
- License
- MIT
- Reading time
- 3 min
- Published by
- Community
- Author
- somoore
- Last verified
- Oct 2026
Highlights
- Call gate() instead of running an app: the kernel sits between the agent's plan and bash, HTTP, write, or send.
- The LLM never holds a real secret: it gets canaries and placeholders, and on ALLOW to an allowlisted host the real key is swapped in at egress.
- Jev scores hazards via a Noul battery while a policy file picks allow, ask, or block; a model that cannot generate text cannot be talked into emitting a secret.
- Claude Code support is a PreToolUse hook in ~/.claude/settings.json running interlock gate --claude-code; stdin is the tool call and exit 2 blocks.
- The repo ships a 38-case regression suite of attacks, benign calls, and hard negatives like authorized destruction — a regression set, not a blind paper.
Quickstart
python
from interlock import Kernel, Vault
kernel = Kernel(Vault.demo())
def run_tool(name, args, goal):
v = kernel.gate(tool=name, args=args, user_goal=goal)
if v.decision == "block":
raise PermissionError(v.reason)
if v.decision == "ask":
return v
return execute(name, kernel.swap_at_egress(args, v.swaps))Watch out
Grounded in the repository README and GitHub metadata reviewed on 2026-10-15; the project has 0 stars and 1 fork and publishes no benchmarks or accuracy figures, and the README marks the Jev sensor as optional, so the default path without it is not documented in the captured excerpt.
Questions about this entry
Short answers drawn from the linked project or page.
A capability kernel for untrusted agents: it wraps every tool call your agent proposes and decides whether bash, HTTP, write, or send actually happens, sitting on the last arrow of plan, tool, execute rather than replacing the agent.
gate() runs detectors, then a Jev Noul battery, then policy in code. Jev scores hazards and the policy file picks BLOCK, ASK, or ALLOW; the README notes that a model which cannot generate text cannot be talked into emitting a secret.
Install with pip install -e ., then create Kernel(Vault.demo()) and call kernel.gate(tool=name, args=args, user_goal=goal). The verdict has a decision field: block raises, ask surfaces to the human, and allow executes with kernel.swap_at_egress.
The model never holds a real secret: it gets canaries and placeholders while real keys live in a vault process. On an ALLOW to an allowlisted host, Interlock swaps the placeholder for the real value at egress, outside the model.
Add a PreToolUse hook with matcher * and the command interlock gate --claude-code to ~/.claude/settings.json. Stdin is the tool call and exit 2 blocks it. The README also shows a canary-instead-of-real-AWS-keys test with a poisoned README.
The README argues launch-week Jev firewalls ask whether a tool call is dangerous after the LLM already decided, with real secrets still in scope. Interlock keeps secrets out of the agent entirely, makes canaries active so off-allowlist use is caught even without an injection, and lets a policy file pick the verdict.
The README marks the Jev sensor optional: export TYPESAFE_API_KEY and use Kernel(..., sensor="jev"). The repo ships a 38-case regression suite covering attacks, benign calls, and hard negatives like authorized destruction, which the README calls a regression set rather than a blind paper.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsX: Jev and Laya on security queries
X: Testing Jev for prompt injection
More Jev resources like this
A pre-action gate for tool-using agents that decides allow, confirm or block with deterministic rules before a neural decider, plus a CDP browser loop whose decider swaps between hosted Jev and a local System One-compatible server through environment variables alone.
Jev Tools & CLIs#community#catalog-import#yibie
Community
pusucip25/local-deciderPython
pusucip25/local-deciderPythonA tuner that trains language models to answer closed-set decisions with a complete probability distribution in one forward pass, using a tokenized multi-class Brier loss so only the correct choice is needed to train.
Jev Repos & SDKs#community#catalog-import#madewithjev
Community
liushiliushi/jevtunerPython
liushiliushi/jevtunerPythonA zero-dependency tool selector that narrows a large pool of agent tools to the relevant few before the LLM call, running offline with TurboQuant or on TypeSafe Jev when a TYPESAFE_API_KEY is set.
Jev Repos & SDKs#community#catalog-import#logicrw
Community
hemanth/tool-pruneJavaScript
hemanth/tool-pruneJavaScriptA safety guardrail for coding agents (Claude Code, Codex, Cursor, Antigravity, Grok) that intercepts shell commands, script executions and file writes before they run. Its neural tier can use Liquid AI d1-3B, CLM, TypeSafe Jev cloud or pure rules; a deterministic tier blocks destructive patterns in under 0.1 ms.
Jev Tools & CLIs#community#github#security
Community
Bl4ckk01/agent-guardrailPython
Bl4ckk01/agent-guardrailPythonA safety gate for AI coding agents that checks every shell command, file write, and file read before it runs and returns ALLOW, ASK, or DENY: most calls are decided locally in under a millisecond, while ambiguous or destructive ones go to TypeSafe's System One model.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
clemensschartmueller/jev-guardGo
clemensschartmueller/jev-guardGoA fork and bridge that runs jkudish/jev-browser fully locally: a local Jev-style engine built on parallel-decisions replaces the hosted API, with Qwen2.5-1.5B-Instruct picking each browser step and a 0.5B model typing search queries, measured on an RTX 2060 SUPER.
Jev Repos & SDKs#community#catalog-import#logicrw
Community
rorshopping/jev-browser-localPython
rorshopping/jev-browser-localPythonFrom the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.