Frequently asked questions
About jes, Jev, and keeping AI agents safe. For setup and API details, see the docs.
What is jes?
jes is an open-source Python library that adds security guardrails to AI agents. It checks the user's message, retrieved text, tool calls, tool results and the model's reply. Each check returns a result: allow or block, the findings that flagged, redacted or blocked something, and onward, the one string to pass to the next step. Install it with pip install jes.
What is Jev?
Jev is TypeSafe's System One decision model for AI agent security, the model that started it all. It classifies instead of generating: it takes the text and a set of typed questions, and returns a probability for each one in a single call. jes uses it as its judge. Pass model="jev-latest", or pin a release such as "jev-1.13.0", and set TYPESAFE_API_KEY.
How does jes stop prompt injection in AI agents?
jes asks Jev whether text tries to override the assistant's instructions, and blocks it when the score crosses your threshold. The injection policy checks user messages, retrieved text and tool calls, and indirect_injection checks retrieved pages and tool results for instructions addressed to an AI. The questions are fixed when you build the guard and never contain the checked text, so an attacker can't rewrite them.
Why use a decision model instead of an LLM judge?
A decision model can't be talked out of its verdict. An LLM judge reads the same poisoned text your agent does, and it can follow the instructions in it. A decision model classifies instead of generating, so hidden instructions have nothing to hijack. It is also faster and costs a fraction of an LLM call.
What does jes check?
jes combines local transforms and judgments. Transforms run in your process: secrets, PII (with Presidio), invisible text, regex, banned substrings, canary tokens, allowed tools and token limits. Judgments ask Jev: prompt injection, indirect injection, goal drift, 14 hazard categories, denied topics, toxicity, and your own questions. Built-in policies add checks such as malicious URLs, bias, gibberish, language and relevance.
Which agent frameworks does jes work with?
jes works with LangChain, LangGraph, the OpenAI Agents SDK, the Claude Agent SDK, FastMCP and plain Python. Each integration uses the framework's own hooks plus one jes call.
Can jes run locally?
Partly, today. Transforms such as secrets, PII, invisible text and regex run in your process. Judgments such as prompt injection go to Jev, hosted by TypeSafe, and Jev only sees the text after secrets and PII are redacted. You can also plug your own backend into model=.
Does jes slow my agent down or cost a lot?
Checks are fast and cheap because Jev is a decision model, not an LLM: TypeSafe prices it at a fraction of an LLM call. Questions that share a model are batched, so one check makes a few requests, not one per question. Transforms such as secrets, PII and regex run locally and cost nothing. That is why you can turn on every guard instead of rationing them.
Is jes free and open source?
Yes. jes is free and open source under the Apache-2.0 license. You can read every guard, fork it and contribute your own.