ringzerosec/jev-runtime-security
User repository on GitHub
- Forks
- 1
- Last pushed
- Updated Oct 2026
Repo stats from the GitHub API, cached Oct 2026.
CommunityJev Tools & CLIs
Ring Zero Security
Kernel-enforced runtime security for AI agents with eBPF/LSM: policy decides file, exec, package-install and MCP operations at the syscall, while Jev can run as an optional checks provider whose verdict can only raise severity. The Jev checks layer is off by default.
- Stars
- 11
- Language
- Rust
- Published by
- Community
- Last verified
- Oct 2026
About this project
Runtime security for AI agents. Policy is enforced in the kernel, at the system call — below the agent, and below anything the agent writes. The agent's reasoning never gets a vote in whether an operation is allowed. OpenAI's Agent security in the enterprise states the problem plainly: A credential is not authorization. Access to a system doesn't establish that a given action in it was authorized. Context is untrusted. A repo, a web page, a tool result can each instruct the agent — and any of them can redirect it.
Quoted from the project's README. Read the full README.
Highlights
- Enforcement lives in the kernel at the syscall, below the agent and below anything the agent writes; models never decide the syscall.
- Jev can score events or artifacts as an optional checks provider, but its verdict can only make an outcome stricter, never looser.
- Protected files are matched by basename and (device, inode), so a rename, hardlink or symlink hits the same decision.
- Requires Linux kernel 6.4+ with CONFIG_BPF_LSM=y, bpf in /sys/kernel/security/lsm and BTF at /sys/kernel/btf/vmlinux.
- MCP gateway hides switched-off tools from the agent and holds newly appearing servers until they are approved.
Watch out
Licensing is split: Apache-2.0 except the GPL/ directory, which is GPL-2.0 for the BPF LSM programs. The README lists limitations including process-name-based agent detection, and Jev checks are off unless enabled.
Questions about this entry
Short answers drawn from the linked project or page.
No. Enforcement is deterministic and the kernel decides the syscall; the checks layer can make a verdict stricter but never looser, and the README states plainly that a probability is not an authorization.
A Linux kernel 6.4+ built with CONFIG_BPF_LSM=y, bpf listed in /sys/kernel/security/lsm and BTF at /sys/kernel/btf/vmlinux. SUPPORT.md provides a three-command self-check and the quick start installs from a .deb package.
Open, create, delete and rename of a protected file; admin tools, work started outside the agent, and package installs; programs and hosts outside an agent's approved list when its profile is Block; and direct connections to a remote MCP server Ring Zero manages. Other exec, outbound connections, DNS, sends, ptrace, mount and kill are recorded rather than refused.
Protected files are matched by basename and by device and inode, so a rename, a hardlink or a symlink hits the same decision, and a refusal records the file's full path. Agents also run as your developer with a read-only token, cannot run sudo, su or pkexec, and cannot answer the polkit prompt that a policy change asks for.
rz mcp adopt routes agents' remote MCP servers through Ring Zero. A switched-off tool disappears from the agent's tool list and calls to it are refused, the kernel blocks agents from connecting to the server directly so editing the config back does not help, and a server that appears later is held until you approve it, noticed within about ten seconds.
Agent detection is by process name, so a renamed binary is not enforced; a cached sudo timestamp can expose the root token; v1 does not cover raw-disk reads or snapshots; MCP tool control is for remote HTTP servers, with local stdio servers governed as processes; and python -m pip install is caught a moment after it starts. Install the amd64 or arm64 .deb, run rz status, then examples/boundary-demo.sh to watch a denial. The Jev checks layer is off by default.
It is off by default, and an untouched install sends nothing off the machine. When enabled, a model runs only async, scoring the event stream after the fact, or precomputed, scoring an artifact once at write time and storing one bit the kernel later reads. Either way it can make a verdict stricter, never looser.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsHacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsX: Secret detection with Jev, tested
More Jev resources like this
8GitHub stars
Supervisor for unattended coding agents: it tracks cross-turn state and asks one batched Jev Choice whether a trajectory should continue, pause or escalate, while deterministic code owns dangerous-command blocking, budget caps and Ed25519-signed receipts.
Jev Tools & CLIs#community#guardrails#safety
Community
VeridicalTech/EdwardPython
VeridicalTech/EdwardPython0GitHub stars
OpenClaw plugin that checks every outgoing agent message against its destination channel tier, running local key-format and term rules and then five Jev Noul questions in one call through OpenClaw's decisionModel, which can point at hosted Jev or a local Kev.
Jev Tools & CLIs#community#openclaw#guardrails
0GitHub stars
A Claude Code PreToolUse hook that blocks known key formats locally and sends only masked unknown high-entropy strings to Jev for a Noul judgment, blocking at 0.80 and asking the human from 0.30 or whenever Jev is unavailable.
Jev Tools & CLIs#community#security#claude-code
2.6kGitHub stars
Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.
Jev Tools & CLIs#community#security#agent-skills
Community
cisco-ai-defense/skill-scannerPython
cisco-ai-defense/skill-scannerPython0GitHub stars
OpenAI-compatible /v1/chat/completions proxy that answers an agent host's approval-guardian call with APPROVE, DENY or ESCALATE. Jev answers one Choice question with a calibrated distribution; missing keys, timeouts and malformed answers all fail closed to ESCALATE.
Jev Tools & CLIs#community#agent-safety#guardrails
Community
oppih/approval-judge-bridgePython
oppih/approval-judge-bridgePython20.4kGitHub stars
Rust coding-agent harness (MIT, ~20k stars) whose crates/jcode-base/src/jev.rs is a typed TypeSafe Jev decision transport, used for memory pruning (memory_jev.rs), browser navigation (browser_jev.rs), and voice routing (voice_intent.rs) with separate provider selectors per purpose.
Jev Tools & CLIs#community#rust#coding-agent
Community
1jehuang/jcodeRust
1jehuang/jcodeRustFrom the Jev guides
Original write-ups on what this entry is for.
The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.
Jev Tools & CLIs#gateway#vercel#cloudflare
Read article
Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.
Jev Tools & CLIs#open-models#local#onnx
Read article
Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.
Jev Tools & CLIs#classification#email#security
Read article
From the Jev community
Posts from builders shipping with Jev right now.