jevrail

Input and output guardrails for LangGraph agents. Jev scores each check and returns a probability. jevrail applies your thresholds and decides whether to allow, block, redact, or flag.

Jev does not write the refusal. One call per stage asks every enabled check.

Install

pip install jevrail
pip install "jevrail[langgraph,typesafe]"

Set TYPESAFE_API_KEY before a live agent runs. Tests and the decision engine accept a stand-in classifier, so the package does not call TypeSafe unless you use the default one.

Place the guard where you need it

Checks you leave out do not run. The default policy guards user input and the model answer. Tool calls and tool results stay off until you list them.

from jevrail import GuardPolicy, JevRail, guard

policy = GuardPolicy(
    stages={
        "input": ["prompt_injection", "jailbreak", "content_safety"],
        "output": ["content_safety", "pii", "secrets", "system_prompt_leak"],
        # "tool_call": ["excessive_agency"],
        # "tool_result": ["indirect_injection"],
    },
    thresholds={"prompt_injection": 0.7, "pii": 0.8},
    actions={"pii": "redact", "prompt_injection": "block"},
    on_block="refuse",   # refuse | raise
    fail_mode="closed",  # closed | open
)

create_agent middleware:

from langchain.agents import create_agent

agent = create_agent(model, tools=tools, middleware=[JevRail(policy)])

A compiled graph, checked on the way in and on the way out:

app = guard(compiled, policy)
app.invoke({"messages": [{"role": "user", "content": "Hello"}]})

A custom graph, on the edges you choose:

from jevrail import input_guard, output_guard

graph.add_node("input_guard", input_guard(policy))
graph.add_node("output_guard", output_guard(policy))

import jevrail.auto is optional. It patches create_agent and messages-based StateGraph.compile using JEVRAIL_POLICY when that variable points at a YAML file. Import it before you build the agent.

What each stage can check

denied_tools blocks a tool by name on the tool-call stage without a Jev call.

Emails, SSNs, card numbers, API keys, and private keys are masked by a local scanner. Jev says a secret is present. The scanner finds the span. If Jev flags PII or a secret and the scanner finds no span, the action becomes a block.

If the TypeSafe API fails, fail_mode="closed" blocks the turn. fail_mode="open" lets it through.

Publish

Do not create an empty project on PyPI. The name is claimed by the first upload.

1. Register at pypi.org and test.pypi.org and turn on 2FA.
2. uv build or python -m build.
3. twine upload --repository testpypi dist/* and install it in a clean virtualenv.
4. twine upload dist/* to create the jevrail project.

Development

pip install -e ".[dev,typesafe]"
pytest