jes 0.0.1

Check every tool call before it runs, and what it returns. With LangChain create_agent middleware:

from langchain.agents import create_agent
from langchain.agents.middleware import wrap_tool_call
from langchain.messages import ToolMessage
from langchain_tavily import TavilySearch
from jes.policies import allowed_tools, indirect_injection, tool_safety

guard = Guard(
    [allowed_tools(["tavily_search"]), tool_safety(threshold=0.5), indirect_injection(threshold=0.5)],
    model="jev-latest",
)

@wrap_tool_call
def guard_tools(request, handler):
    call, prompt = request.tool_call, request.state["messages"][0].content
    checked = guard.check_tool_call(call["name"], call["args"], prompt=prompt)
    if checked.ok:  # the tool is allowed and fits the request
        output = handler(request).content
        checked = guard.check_tool_result(output, name=call["name"], prompt=prompt)
    return ToolMessage(checked.onward, tool_call_id=call["id"])  # a blocked call or poisoned page becomes a refusal

agent = create_agent("anthropic:claude-sonnet-5-5", tools=[TavilySearch(max_results=3)], middleware=[guard_tools])
agent.invoke({"messages": [{"role": "user", "content": "What changed in the EU AI Act this year?"}]})

To also check the input and the response in the same middleware, see examples/13_langchain_agent/jev.py.

Check the question, every retrieved chunk, and the model's response. With a LangChain chat model:

from langchain.chat_models import init_chat_model
from jes.policies import indirect_injection, injection

guard = Guard([injection(threshold=0.5), indirect_injection(threshold=0.5)], model="jev-latest")
llm = init_chat_model("anthropic:claude-sonnet-5-5")

question = guard.check_input("What's our refund policy?")
if question.ok:
    chunks = [guard.check_untrusted(doc.page_content, question=question) for doc in retriever.invoke(question.onward)]
    sources = [chunk for chunk in chunks if chunk.ok]  # drop poisoned pages
    context = "\n\n".join(chunk.onward for chunk in sources)
    response = llm.invoke(f"{context}\n\nQuestion: {question.onward}").text
    answer = guard.check_output(response, prompt=question, sources=sources)  # the judge sees what was asked and retrieved
    print(answer.onward)

Each coding agent exposes different hooks, so jes can check different steps:

¹ A blocked response is replaced on screen; the transcript keeps the original.

OpenCode, OpenClaw and Pi also need the file that uvx jes runner-settings prints.

examples/ is a short course, read top to bottom. Each lesson has a jev.py on hosted Jev and a local.py that runs fully on Ollama with tev1.

What is jes? An open-source (Apache-2.0) Python library that adds guardrails to AI agents. It checks the prompt, retrieved text, tool calls, tool results and the model's response.

How do I protect an AI agent from prompt injection? Check more than the user's message. Most attacks are indirect: hidden in a web page, a file or a tool result. Use indirect_injection on check_untrusted and check_tool_result, and gate tools with allowed_tools and tool_safety.

Why a decision model instead of an LLM-as-judge? An LLM judge reads the attack as part of its own prompt, and the attack can steer its answer. Jev only answers typed questions with probabilities, and the checked text is never part of an instruction. It also classifies instead of generating, so there's no long response to wait on or pay for. That keeps latency and cost low enough to check every step, not just the first prompt. Judgments on the same model share one request, and Guard and AsyncGuard send a check's requests in parallel, so adding guards doesn't add their latencies up.

Does jes send my secrets or personal data to a model? No. secrets and pii run locally first, and judgments only see the redacted text.

Does it cover subagents and skills? In Claude Code, yes. They are tool calls, so the hooks check them, and the hooks also run inside subagents.

jes[pii] (Presidio for the PERSON entity, which also needs a spaCy English model such as en_core_web_sm; the other entities need neither) · jes[secrets] (detect-secrets) · jes[crypto] (encrypted Redactions) · jes[tokens] (tiktoken) · jes[regex] · jes[json]. Python 3.11+.