Can leakguard keep everything on my machine?

Yes. It never calls a judge itself; it asks OpenClaw's decisionModel, which you can point at a local Kev server or CPU ONNX classifiers. Your local term lists always stay on your machine.

How does it handle the same sentence in different channels?

Destinations are assigned public, shared or private tiers with per-category policies, so the same update can be allowed in a private ops channel and blocked or held for a channel shared with a vendor.

What happens when the decision model is unavailable?

The plugin fails closed. It never throws and stops waiting after deadlineMs, 12 seconds by default, holding the message back itself. If the judge cannot answer, the onError setting defaults to block, and a reply already on its way has no one to ask.

Is leakguard a defence against deliberate exfiltration?

No. It is text-only and explicitly not a security boundary against deliberate exfiltration. It catches content that is true and useful but reaching the wrong readers, such as a client name or credential location in a channel shared with a vendor.

Which questions does the decision model actually answer?

Five yes/no questions about the text in one batched call: does it contain a credential, say where credentials are kept, name a client, reveal internal infrastructure, or disclose confidential business information? Long messages are split and every part is judged.

How did it score on the authors' evaluation set?

On a synthetic set of 56 leaks and 57 ordinary messages, rules plus hosted Jev missed 0 leaks, including 30 that a regex cannot see, with 4 false alarms. Rules alone missed 54% of leaks; the README calls the set small and self-written.

Can I override what each destination tier blocks?

Yes. Each destination has a tier whose policy maps categories to block, ask or allow, and the policy object overrides any cell. A per-category threshold can replace the flat 0.5, and destination matches can use wildcards, with first match winning.

CommunityJev Tools & CLIs

Openclaw Jev Leakguard

OpenClaw plugin that checks every outgoing agent message against its destination channel tier, running local key-format and term rules and then five Jev Noul questions in one call through OpenClaw's decisionModel, which can point at hosted Jev or a local Kev.

See highlights

Open github.com

Stars: 0
Language: JavaScript
License: MIT
Published by: Community
Last verified: Oct 2026

yousan/openclaw-jev-leakguard

User repository on GitHub

View on GitHub

Jev × OpenClaw: stop your agent from posting client names, credentials and internal details to the wrong channel. Judged by Jev — or by Kev on your own machine.

Forks: 0
Last pushed: Updated Sep 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

Your OpenClaw agent is about to post in a channel. Jev reads the message and where it's going, and stops it if a client name, a credential or an internal hostname is about to reach the wrong readers. 日本語 · MIT · works with OpenClaw 2026.9.6+ · judged by your decisionModel: hosted Jev, or Kev on your own machine.

Quoted from the project's README. Read the full README.

Tagscommunity openclaw guardrails security

Works forJev for Verification Jev for Decision gating

Used inJev for Security & Privacy Jev for Software & DevTools

Languages: JavaScript
Capabilities: Open sourceSelf-hostedRequires API key

Highlights

Judges message content together with destination tier: public, shared or private channel policies
Five Jev Noul questions in one call: credential, credential location, client name, internal infra, confidential info
Local key-format and term list rules run first and are never sent to a hosted judge
With hosted Jev it missed 0 of 56 synthetic leaks, 30 invisible to regex, with 4 false alarms on 57 ordinary messages
223 ms p50 with hosted Jev; can use a local Kev server or CPU-only ONNX classifiers instead

Watch out

MIT license. Text-only and explicitly not a security boundary against deliberate exfiltration. The evaluation is a small self-written synthetic set, and hosted Jev sends message text to TypeSafe.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

YouTube: Kubernetes admission control with a decision model, fail-closed.

Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.

2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker News

Hacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.

sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker News

X: Agent Handoff Gate: agents verify what they hand off

Related terms

Glossary definitions related to this entry.

Guardrail

More Jev resources like this

approval-judge-bridge

OpenAI-compatible /v1/chat/completions proxy that answers an agent host's approval-guardian call with APPROVE, DENY or ESCALATE. Jev answers one Choice question with a calibrated distribution; missing keys, timeouts and malformed answers all fail closed to ESCALATE.

Jev Tools & CLIs#community#agent-safety#guardrails

Community

oppih/approval-judge-bridgePython

DeepSeek Harness Jev Plugin

203

Native DeepSeek Harness (DSH) plugin that uses Jev or Luna Decisions as a System One judgment layer across 12 separately configurable features: skill selection, file ranking, drift reminders, completion checks, goal supervision, corrections, log admission and workspace approvals. All features ship disabled by default.

Jev Tools & CLIs#community#deepseek#plugin

Community

luobosibing2/dsh-jev-pluginJavaScript

dsh-jev-interceptor

A DeepSeek Harness plugin where Jev Choice and Noul checks gate every non-read-only tool call - deny confident high-risk calls, escalate ambiguous ones, auto-approve clearly granted reversible ones - and optionally score session messages so valuable context survives instead of being dropped oldest-first.

Jev Tools & CLIs#community#plugin#guardrails

Community

AskTheWay/dsh-jev-interceptorTypeScript

Ring Zero Security

Kernel-enforced runtime security for AI agents with eBPF/LSM: policy decides file, exec, package-install and MCP operations at the syscall, while Jev can run as an optional checks provider whose verdict can only raise severity. The Jev checks layer is off by default.

Jev Tools & CLIs#community#security#ebpf

Community

ringzerosec/jev-runtime-securityRust

Edward

Supervisor for unattended coding agents: it tracks cross-turn state and asks one batched Jev Choice whether a trajectory should continue, pause or escalate, while deterministic code owns dangerous-command blocking, budget caps and Ed25519-signed receipts.

Jev Tools & CLIs#community#guardrails#safety

Community

VeridicalTech/EdwardPython

Skill Scanner

2.6k

Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.

Jev Tools & CLIs#community#security#agent-skills

Community

cisco-ai-defense/skill-scannerPython

From the Jev guides

Original write-ups on what this entry is for.

Guardrails and Prompt Injection: Hardening the Typed Answer

Oct 12, 2026

A decision model cannot be talked into generating text, but the label is still a target. Why narrow, literal questions resist injection and why keeping the act in code is the real backstop.

Jev Practices & Patterns#guardrails#security#prompt-injection

Read article

Jev on the Gateways: Vercel, Workers AI, and OpenRouter

Oct 12, 2026

The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.

Jev Tools & CLIs#gateway#vercel#cloudflare

Read article

Exporting Decision Models: GGUF, ONNX, and Device Runtimes

Oct 10, 2026

Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.

Jev Tools & CLIs#open-models#local#onnx

Read article

Back to all resources

From the Jev community

Posts from builders shipping with Jev right now.

Follow @typesafeai