Jev Sentinel (Pi)

Three moments in a coding-agent session: before a tool call runs (intent and risk), before the agent reads a tool output (instructions aimed at AI agents), and after a reply finishes (harmful content or relaying injected instructions) — on Pi, Claude Code and Codex CLI.

Jev answers typed questions with probabilities, and plain code maps those to allow, ask you, or warn. On Pi, which has no permission system, it is the gate itself; on Claude Code and Codex it adds a content-aware layer over the prompts you already get.

A flagged output gets a warning placed on top, you get an alert, and every later action needs approval until you run /jev-sentinel reset. Flagged tool calls ask you or warn with Block highlighted, and blocking tells the agent plainly so it tries another way.

Output from .env, key and credential files is withheld, and secret-looking environment variables, NAME=value secrets and Bearer tokens are scrubbed from everything sent to Jev, including the agent's own replies. The README calls this pattern-based, so it reduces leaks rather than guaranteeing none.

If Jev says more context would help, it adds earlier messages, full tool outputs or file contents and asks again, up to 3 rounds, before interrupting you. If Jev errors or no key is set, it fails closed and asks you — it never auto-allows.

Yes. Start a message with * to pin it, and Jev then judges on-task against the pin instead of whatever the chat has drifted to. The extension also protects its own settings: non-read calls touching ~/.pi/agent always get the Block-first warning.

Harshwasan's project, MIT licensed and originally called jev-guard. One set of checks ships three ways: a Pi extension, a Claude Code plugin and a Codex CLI plugin; the README's example runs used gpt-4o-mini as the agent.