Is this just another blocker that interrupts me on every command?

Mostly the opposite: pi-warden steers the agent and pulls you in only when something cannot be undone. In a replay of 18,075 recorded calls, 0.1% were held at the current 0.9 threshold, against 0.27% at the old 0.7 one.

Does it do anything useful without a paid TypeSafe key?

Yes, the offline parts. A built-in pattern holds destructive commands (force push, reset --hard, rm -rf on a path outside scratch, DROP) with no key and no request. The guards that ask Jev need a key and /warden enable; without one their offline halves still run.

What leaves my machine, and what gets stored locally?

With judgments enabled, redacted samples of judged calls go to Jev. The learning-from-holds store is local: it keeps each judged call with its Pi session id, prunes non-hold judge data after 90 days, holds after 365, and nothing in that store is sent.

Are those hold rates from a real deployment or one machine?

One machine, and the README says so. The 18,075-call replay and the field figures (1,168 sessions over sixteen days across the maintainer's own projects) are recorded sessions, explicitly not a promise for your traffic.

How do I install and turn on pi-warden?

Run pi install npm:pi-warden, then /warden enable with a TypeSafe key and /warden init to write a starter pi-warden.md. It is MIT-licensed, needs Pi 0.85 or newer, and the offline guards still run without a key.

How loudly does it interrupt me?

Most guards steer the agent instead of you, and a steer budget caps non-critical steers at three per run with the rest going to the trace. You are pulled in only when something cannot be undone, and a judge cooldown pauses Jev requests after repeated failures.

What happens to a destructive command?

A built-in offline pattern holds force pushes, reset --hard, rm -rf outside scratch, and DROP with no key at all. With Jev on, a call scored 0.9 or more as irreversible is held and 0.5 to 0.9 only warns. A recursive delete of the agent's own scratch warns instead of holding.

Jev directory

CommunityJev Tools & CLIs

Pi Warden

Pi extension that supervises a coding agent with Jev judgments: it holds risky tool calls, checks writes against project Markdown rules, and feeds most issues back to the agent as a steer instead of interrupting you. The conscience is beta and off by default.

See highlights Open github.com

Stars: 170
Language: TypeScript
License: MIT
Reading time: 3 min
Published by: Community
Author: DevMortimer
Last verified: Sep 2026

DevMortimer/pi-warden

User repository on GitHub

View on GitHub

Guardrails for Pi that steer instead of interrupt: enforces your project rules on every write, holds only hard-to-undo actions (3 per 1,000 calls, measured on real sessions), catches unverified "done" claims and stuck loops, and trims tool output. Built on pi-typesafe.

Forks: 31
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

Your coding agent says "done". It didn't run the tests. pi-warden catches it, and the agent fixes it without you. 1,168 sessions · 419 risky actions stopped before they ran · 76% of fake "done"s turned into real test runs. Sixteen days of the maintainer's real use across all their projects, not just this one, 2026-09-16 to 2026-10-01. Method and noise: field report. Then /warden enable (paste a TypeSafe key) and /warden init (writes a starter pi-warden.md). That's it. No key? The offline guards still run.

Quoted from the project's README. Read the full README.

Tagscommunity typescript guardrails security coding-agent agents

Works forJev for Code Jev for Tool calling Jev for Decision gating

Used inJev for Security & Privacy

Highlights

Watches bash, write, and edit calls and holds irreversible actions before they run.
The rules guard judges writes against project Markdown rules and quotes the broken rule.
In 150 paired agent runs the control violated the tested rule 6 times; with Warden, 0.
Across 18,075 guarded calls the action hold fired 48 times, or 3 holds per 1,000 calls.
Runs offline without a key with pattern, runaway, sensitive-path, and credential guards.

Quickstart

bash

pi install npm:pi-warden
# then run /warden enable and /warden init inside Pi

Watch out

MIT-licensed. Needs Pi 0.85+ and Node 22.19+; judgments need a TypeSafe or OpenRouter key, the conscience is beta and off by default, and the action guard is calibrated on one user's 17k calls while other guards use synthetic cases.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

X: Vercel's fx safety reviewer, measured at 18× faster

Reddit: Early experiments wiring Jev into Pi as a safety layer and model router.

X: Decision outputs in Grep

YouTube: Kubernetes admission control with a decision model, fail-closed.

From the Jev guides

Original write-ups on what this entry is for.

MCP tool routing: Jev in front of the tool call

Oct 16, 2026

Tool menus can outgrow the context that reads them. The catalog's Jev-based routers and gates narrow the list: benchmarked tool search, per-tool scoring, fail-closed approvals, and WebMCP in the browser.

Jev Agents & MCP#mcp#tool-routing#agents

Read article

Guardrails and Prompt Injection: Hardening the Typed Answer

Oct 12, 2026

A decision model cannot be talked into generating text, but the label is still a target. Why narrow, literal questions resist injection and why keeping the act in code is the real backstop.

Jev Practices & Patterns#guardrails#security#prompt-injection

Read article

Putting Jev in the Coding Loop: MCP Servers, Gates, and Skills

Sep 14, 2026

The fastest-growing corner of the Jev ecosystem is coding agents. A tour of the MCP servers, tool-call gates, context pruners, and skill rankers built for that loop.

Jev Tools & CLIs#agents#mcp#coding-agent

Read article

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai

Pi Warden

About this project

Highlights

Quickstart

Questions about this entry

Is this just another blocker that interrupts me on every command?

Does it do anything useful without a paid TypeSafe key?

What leaves my machine, and what gets stored locally?

Are those hold rates from a real deployment or one machine?

How do I install and turn on pi-warden?

How loudly does it interrupt me?

What happens to a destructive command?

Reactions & coverage

Related terms

More Jev resources like this

From the Jev guides

From the Jev AI model community