$ cat ~/map/pi-jev-sentinel.md

pi-jev-sentinel

Guards pi tool calls, tool outputs, and replies with Jev-scored risk, injection checks, and secret scrubbing — never auto-allows.

extensions✓ Sep 20

Run pi install git:github.com/harshwasan/pi-jev-sentinel, then export TYPESAFE_API_KEY before starting pi; to try it without installing, run pi -e git:github.com/harshwasan/pi-jev-sentinel.

## TL;DR

A pi extension that screens every step of a run with TypeSafe Jev: tool calls for intent and risk before they run, tool outputs for instructions aimed at AI agents before the agent reads them, and finished replies for harmful or relayed injected content — with secrets scrubbed from everything sent and a fail-closed ask-you default.

## Key points

• $Three screening points: before a tool call runs it is judged for intent (on task, off task, injected, needs more context) and risk; before the agent reads a tool output the output is checked for instructions aimed at AI agents, benign or suspicious; after a reply finishes it is checked for harmful content and relaying injected instructions, with unsupported-claims and skipped-work checks optional.
• $A fixed decision ladder, first match wins: high risk or majority-injected warns with Block highlighted, the middle band asks you after re-checking with more context when Jev says it would help, clearly safe on-task calls run, and anything undecided asks — Jev never sees the thresholds, and every decision is logged with its probabilities.
• $Taint and trust: after a flagged output, every action needs your approval until /jev-sentinel reset; outputs from trustedPaths (AGENTS.md, CLAUDE.md, .pi/ relative to the project root) are never screened, and nothing outside the project is trusted.
• $Secret scrubbing is pattern-based: secret-looking files are withheld by name, and their values — plus environment variables whose names contain KEY, TOKEN, SECRET, PASSW, CREDENTIAL, or AUTH, NAME=value lines with such names, and Bearer tokens — are scrubbed from everything sent to Jev, including the agent's own replies; the README frames this as reducing leaks rather than guaranteeing none, and values shorter than 8 characters are not scrubbed.
• $Fails closed and protects itself: a Jev error or a missing key asks you instead of auto-allowing, and any tool call other than a read that touches ~/.pi/agent or the decision log gets the Block-first warning whatever Jev says.
• $The same checks run outside pi as hooks for Claude Code and Codex CLI, with documented differences: the output check runs after the tool instead of before it, ask means the host's own approval prompt, and an allowed action returns nothing so existing permission rules still apply.

## FAQ

## References

• README ↗

Last updated: Sep 20, 2026