jevg 0.3.0__py3-none-any.whl

jev_guard/__init__.py

@@ -0,0 +1,6 @@
+from .config import Config
+from .findings import Finding, Severity
+from .scanner import scan_path, scan_source
+
+__version__ = "0.3.0"
+__all__ = ["Config", "Finding", "Severity", "scan_path", "scan_source", "__version__"]

jev_guard/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

jev_guard/cli.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+import argparse
+import sys
+
+from . import __version__
+from .findings import Severity
+from .formats import to_json, to_sarif
+from .rules import RULES
+from .scanner import scan_path
+
+_COLORS = {
+    Severity.CRITICAL: "\033[41;97m",
+    Severity.HIGH: "\033[91m",
+    Severity.MEDIUM: "\033[93m",
+    Severity.LOW: "\033[94m",
+    Severity.INFO: "\033[90m",
+}
+_RESET = "\033[0m"
+
+
+def _fmt_text(findings, use_color: bool) -> str:
+    if not findings:
+        return "jev-guard: no findings."
+    lines = []
+    for f in findings:
+        tag = f.severity.name
+        if use_color:
+            tag = f"{_COLORS[f.severity]}{tag}{_RESET}"
+        lines.append(f"{f.file}:{f.line}  [{tag}] {f.code}  {f.message}")
+        lines.append(f"    ↳ {f.remediation}")
+    counts: dict[str, int] = {}
+    for f in findings:
+        counts[f.severity.name] = counts.get(f.severity.name, 0) + 1
+    summary = ", ".join(f"{v} {k.lower()}" for k, v in counts.items())
+    lines.append(f"\n{len(findings)} finding(s): {summary}")
+    return "\n".join(lines)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="jev-guard",
+        description="Audit code that uses Jev / TypeSafe System One models as a guardrail.",
+    )
+    parser.add_argument("--version", action="version", version=f"jev-guard {__version__}")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    scan = sub.add_parser("scan", help="Scan a file or directory.")
+    scan.add_argument("path")
+    scan.add_argument("--format", choices=["text", "json", "sarif"], default="text")
+    scan.add_argument("--min-severity", default="INFO")
+    scan.add_argument("--fail-on", default="HIGH")
+    scan.add_argument("--output", "-o", help="Write report to a file instead of stdout.")
+    scan.add_argument("--no-color", action="store_true")
+
+    sub.add_parser("rules", help="List the rules jev-guard checks.")
+
+    args = parser.parse_args(argv)
+
+    if args.cmd == "rules":
+        for code, (severity, message, remediation) in sorted(RULES.items()):
+            print(f"{code}  [{severity.name}]  {message}")
+            print(f"    {remediation}\n")
+        return 0
+
+    min_sev = Severity.parse(args.min_severity)
+    fail_on = Severity.parse(args.fail_on)
+    findings = [f for f in scan_path(args.path) if f.severity >= min_sev]
+
+    if args.format == "json":
+        report = to_json(findings)
+    elif args.format == "sarif":
+        report = to_sarif(findings, __version__)
+    else:
+        use_color = (not args.no_color) and sys.stdout.isatty() and not args.output
+        report = _fmt_text(findings, use_color)
+
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as fh:
+            fh.write(report + "\n")
+    else:
+        print(report)
+
+    return 1 if any(f.severity >= fail_on for f in findings) else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

jev_guard/config.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import sys
+from dataclasses import dataclass, field
+from pathlib import Path
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover
+    import tomli as tomllib
+
+from .findings import Severity
+
+CONFIG_NAME = ".jev-guard.toml"
+
+
+@dataclass
+class Config:
+    disabled: frozenset[str] = frozenset()
+    severity_overrides: dict[str, Severity] = field(default_factory=dict)
+    extra_dangerous_tools: frozenset[str] = frozenset()
+    extra_import_roots: frozenset[str] = frozenset()
+    extra_guardrail_calls: frozenset[str] = frozenset()
+
+    @classmethod
+    def load(cls, start: str | Path) -> Config:
+        path = _find(Path(start))
+        if path is None:
+            return cls()
+        try:
+            data = tomllib.loads(path.read_text(encoding="utf-8"))
+        except (OSError, tomllib.TOMLDecodeError):
+            return cls()
+        section = data.get("jev-guard", data)
+        overrides = {
+            code.upper(): Severity.parse(name)
+            for code, name in (section.get("severity") or {}).items()
+        }
+        extra = section.get("extra") or {}
+        return cls(
+            disabled=frozenset(c.upper() for c in section.get("disable", [])),
+            severity_overrides=overrides,
+            extra_dangerous_tools=frozenset(extra.get("dangerous_tools", [])),
+            extra_import_roots=frozenset(extra.get("import_roots", [])),
+            extra_guardrail_calls=frozenset(extra.get("guardrail_calls", [])),
+        )
+
+
+def _find(start: Path) -> Path | None:
+    start = start.resolve()
+    directory = start if start.is_dir() else start.parent
+    for candidate in [directory, *directory.parents]:
+        cfg = candidate / CONFIG_NAME
+        if cfg.is_file():
+            return cfg
+    return None

jev_guard/findings.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+from enum import IntEnum
+
+
+class Severity(IntEnum):
+    INFO = 0
+    LOW = 1
+    MEDIUM = 2
+    HIGH = 3
+    CRITICAL = 4
+
+    @classmethod
+    def parse(cls, name: str) -> Severity:
+        return cls[name.strip().upper()]
+
+
+@dataclass(frozen=True)
+class Finding:
+    code: str
+    severity: Severity
+    file: str
+    line: int
+    message: str
+    remediation: str
+
+    def to_dict(self) -> dict:
+        d = asdict(self)
+        d["severity"] = self.severity.name
+        return d

jev_guard/formats.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import json
+
+from .findings import Finding, Severity
+from .rules import RULES
+
+_SARIF_LEVEL = {
+    Severity.CRITICAL: "error",
+    Severity.HIGH: "error",
+    Severity.MEDIUM: "warning",
+    Severity.LOW: "note",
+    Severity.INFO: "note",
+}
+
+_INFO_URI = "https://github.com/ppradyoth/jev-guard"
+
+
+def to_json(findings: list[Finding]) -> str:
+    return json.dumps([f.to_dict() for f in findings], indent=2)
+
+
+def to_sarif(findings: list[Finding], version: str) -> str:
+    rules = [
+        {
+            "id": code,
+            "name": code,
+            "shortDescription": {"text": message},
+            "fullDescription": {"text": remediation},
+            "defaultConfiguration": {"level": _SARIF_LEVEL[severity]},
+            "helpUri": f"{_INFO_URI}/blob/main/GUIDE.md",
+        }
+        for code, (severity, message, remediation) in sorted(RULES.items())
+    ]
+    results = [
+        {
+            "ruleId": f.code,
+            "level": _SARIF_LEVEL[f.severity],
+            "message": {"text": f"{f.message} — {f.remediation}"},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": f.file},
+                        "region": {"startLine": max(f.line, 1)},
+                    }
+                }
+            ],
+        }
+        for f in findings
+    ]
+    doc = {
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "jev-guard",
+                        "version": version,
+                        "informationUri": _INFO_URI,
+                        "rules": rules,
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return json.dumps(doc, indent=2)

jev_guard/rules.py

@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+from .findings import Severity
+
+# Names of tools whose misuse is high-impact. Matched case-insensitively as a
+# substring of a tool string literal (e.g. "python_repl" matches "python").
+DANGEROUS_TOOLS = frozenset({
+    "bash", "shell", "sh", "exec", "execute", "eval", "python", "repl",
+    "run_code", "code_interpreter", "sql", "database", "delete", "drop",
+    "terminal", "subprocess", "os_system", "system", "write_file", "fs_write",
+    "http", "request", "requests", "fetch", "send_email", "email", "transfer",
+})
+
+# kwargs that indicate a caller has configured how the guardrail decides to
+# block, rather than relying on Jev's default point decision.
+THRESHOLD_KWARGS = frozenset({
+    "threshold", "thresholds", "confidence", "min_confidence", "block_threshold",
+    "block_at", "decision_threshold", "review_threshold", "auto_threshold",
+    "escalate_below", "on_low_confidence",
+})
+
+# kwargs whose value is a probability above which the guardrail *blocks*. A high
+# value here means "only block when almost certain" -> most attacks pass.
+BLOCK_KWARGS = frozenset({
+    "threshold", "block_threshold", "block_at", "decision_threshold", "auto_threshold",
+})
+
+# kwargs whose value is a confidence below which the guardrail *escalates*. A low
+# value here means "almost never escalate" -> low-confidence calls silently pass.
+ESCALATE_KWARGS = frozenset({
+    "min_confidence", "escalate_below", "review_threshold", "confidence",
+})
+
+# Variable name fragments suggesting attacker-influenced content.
+UNTRUSTED_HINTS = frozenset({
+    "user", "input", "message", "msg", "content", "payload", "request",
+    "body", "prompt", "query", "tool_output", "tool_result", "external",
+    "untrusted", "email_body", "resume", "ticket", "comment", "webhook",
+})
+
+JEV_IMPORT_ROOTS = frozenset({"langchain_typesafe", "typesafe"})
+
+RULES = {
+    "JG001": (
+        Severity.HIGH,
+        "Jev guardrail gates actions with no configured confidence threshold",
+        "AutoModeMiddleware/classifier blocks on Jev's default decision. "
+        "'Zero hallucinations' is a type guarantee, not a correctness one: a "
+        "confidently-wrong noul still lets a dangerous call through. Set an "
+        "explicit threshold and escalate below it.",
+    ),
+    "JG002": (
+        Severity.CRITICAL,
+        "Dangerous tool exposed to an agent with no Jev guardrail present",
+        "A high-impact tool (bash/sql/http/...) is wired into the agent but no "
+        "AutoModeMiddleware appears in this module. Add a guardrail or remove "
+        "the tool from the autonomous path.",
+    ),
+    "JG003": (
+        Severity.MEDIUM,
+        "Jev decision consumed without checking calibrated confidence",
+        "A .noul/.choice/.score value is used to branch but the module never "
+        "reads a confidence field. Calibration is Jev's entire value; acting on "
+        "the point estimate discards it. Gate the branch on confidence.",
+    ),
+    "JG004": (
+        Severity.MEDIUM,
+        "Untrusted content flows into a Jev guardrail's state",
+        "The `state` argument is built from an attacker-influenceable variable. "
+        "If text in `state` can override the question `instructions`, the "
+        "guardrail is injectable by the very input it inspects. Separate and "
+        "sanitize untrusted state.",
+    ),
+    "JG005": (
+        Severity.INFO,
+        "Jev used as a security control",
+        "Validate block/escalate thresholds against your own adversarial "
+        "workload. Jev's published evals are self-graded on non-adversarial "
+        "distributions; calibration under attack is unproven.",
+    ),
+    "JG006": (
+        Severity.MEDIUM,
+        "Jev guardrail threshold set in an unsafe band",
+        "The block threshold is set so high (or the escalate-below confidence so "
+        "low) that the guardrail only reacts to near-certain danger. Adversarial "
+        "input is designed to sit in the ambiguous middle. Bias the block "
+        "threshold low and escalate generously.",
+    ),
+    "JG007": (
+        Severity.HIGH,
+        "Untrusted content interpolated into a Jev question's instructions",
+        "Attacker-influenceable text is concatenated or formatted into the "
+        "`instructions` of a question. That lets the inspected content rewrite "
+        "the question itself, collapsing the guardrail. Keep instructions static "
+        "and pass untrusted data only as `state`.",
+    ),
+}

jev_guard/scanner.py

@@ -0,0 +1,265 @@
+from __future__ import annotations
+
+import ast
+import io
+import tokenize
+from pathlib import Path
+
+from .config import Config
+from .findings import Finding
+from .rules import (
+    BLOCK_KWARGS,
+    DANGEROUS_TOOLS,
+    ESCALATE_KWARGS,
+    JEV_IMPORT_ROOTS,
+    RULES,
+    THRESHOLD_KWARGS,
+    UNTRUSTED_HINTS,
+)
+
+BASE_GUARDRAIL_CALLS = frozenset({"AutoModeMiddleware", "TypeSafeClassifier"})
+DECISION_ATTRS = frozenset({"noul", "nouls", "choice", "choices", "score", "scores"})
+_SUPPRESS = "jev-guard:"
+
+
+def _call_name(node: ast.Call) -> str | None:
+    func = node.func
+    if isinstance(func, ast.Name):
+        return func.id
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    return None
+
+
+def _string_literals(node: ast.AST) -> list[str]:
+    return [
+        c.value
+        for c in ast.walk(node)
+        if isinstance(c, ast.Constant) and isinstance(c.value, str)
+    ]
+
+
+def _names(node: ast.AST) -> set[str]:
+    return {n.id for n in ast.walk(node) if isinstance(n, ast.Name)}
+
+
+def _name_is_untrusted(name: str) -> bool:
+    low = name.lower()
+    return any(h in low for h in UNTRUSTED_HINTS)
+
+
+class Taint:
+    """Module-level, name-based taint with fixed-point propagation."""
+
+    def __init__(self, tree: ast.AST, dangerous_tools: frozenset[str]):
+        self.dangerous_tools = dangerous_tools
+        self.untrusted: set[str] = set()
+        self.dangerous: set[str] = set()
+        assigns: list[tuple[str, ast.AST]] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if isinstance(target, ast.Name):
+                        assigns.append((target.id, node.value))
+            elif isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+                if node.value is not None:
+                    assigns.append((node.target.id, node.value))
+        for name, _ in assigns:
+            if _name_is_untrusted(name):
+                self.untrusted.add(name)
+        for _ in range(6):
+            changed = False
+            for name, value in assigns:
+                if name not in self.untrusted and self._value_untrusted(value):
+                    self.untrusted.add(name)
+                    changed = True
+                if name not in self.dangerous and self._value_dangerous(value):
+                    self.dangerous.add(name)
+                    changed = True
+            if not changed:
+                break
+
+    def _value_untrusted(self, node: ast.AST) -> bool:
+        for nm in _names(node):
+            if _name_is_untrusted(nm) or nm in self.untrusted:
+                return True
+        return False
+
+    def _value_dangerous(self, node: ast.AST) -> bool:
+        for s in _string_literals(node):
+            low = s.lower()
+            if any(tok in low for tok in self.dangerous_tools):
+                return True
+        return any(nm in self.dangerous for nm in _names(node))
+
+    def refs_untrusted(self, node: ast.AST) -> bool:
+        return self._value_untrusted(node)
+
+    def is_dangerous(self, node: ast.AST) -> bool:
+        return self._value_dangerous(node)
+
+
+def _suppressions(source: str) -> dict[int, object]:
+    out: dict[int, object] = {}
+    try:
+        tokens = tokenize.generate_tokens(io.StringIO(source).readline)
+        for tok in tokens:
+            if tok.type != tokenize.COMMENT or _SUPPRESS not in tok.string:
+                continue
+            body = tok.string.split(_SUPPRESS, 1)[1].strip()
+            if not body.lower().startswith("ignore"):
+                continue
+            rest = body[len("ignore"):].strip()
+            line = tok.start[0]
+            if not rest:
+                out[line] = "ALL"
+            else:
+                out[line] = {c.strip().upper() for c in rest.replace(",", " ").split()}
+    except (tokenize.TokenError, IndentationError):
+        pass
+    return out
+
+
+def _numeric(node: ast.AST) -> float | None:
+    if isinstance(node, ast.Constant) and isinstance(node.value, (int, float)):
+        return float(node.value)
+    return None
+
+
+def _finding(code: str, file: str, line: int, config: Config) -> Finding:
+    severity, message, remediation = RULES[code]
+    severity = config.severity_overrides.get(code, severity)
+    return Finding(code, severity, file, line, message, remediation)
+
+
+def _state_values(call: ast.Call) -> list[ast.AST]:
+    vals: list[ast.AST] = []
+    for kw in call.keywords:
+        if kw.arg == "state":
+            vals.append(kw.value)
+    for arg in call.args:
+        if isinstance(arg, ast.Dict):
+            for key, val in zip(arg.keys, arg.values, strict=False):
+                if isinstance(key, ast.Constant) and key.value == "state":
+                    vals.append(val)
+    return vals
+
+
+def _instruction_values(tree: ast.AST) -> list[ast.AST]:
+    vals: list[ast.AST] = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call):
+            for kw in node.keywords:
+                if kw.arg == "instructions":
+                    vals.append(kw.value)
+        if isinstance(node, ast.Dict):
+            for key, val in zip(node.keys, node.values, strict=False):
+                if isinstance(key, ast.Constant) and key.value == "instructions":
+                    vals.append(val)
+    return vals
+
+
+def scan_source(source: str, filename: str, config: Config | None = None) -> list[Finding]:
+    config = config or Config()
+    try:
+        tree = ast.parse(source)
+    except SyntaxError:
+        return []
+
+    import_roots = JEV_IMPORT_ROOTS | config.extra_import_roots
+    uses_jev = any(
+        isinstance(n, (ast.Import, ast.ImportFrom))
+        and (
+            any(a.name.split(".")[0] in import_roots for a in n.names)
+            or (getattr(n, "module", "") or "").split(".")[0] in import_roots
+        )
+        for n in ast.walk(tree)
+    )
+    if not uses_jev:
+        return []
+
+    dangerous_tools = DANGEROUS_TOOLS | config.extra_dangerous_tools
+    guardrail_calls = BASE_GUARDRAIL_CALLS | config.extra_guardrail_calls
+    state_calls = guardrail_calls | {"invoke"}
+    taint = Taint(tree, dangerous_tools)
+
+    calls = [n for n in ast.walk(tree) if isinstance(n, ast.Call)]
+    has_automode = any(_call_name(c) == "AutoModeMiddleware" for c in calls)
+    reads_confidence = any(
+        isinstance(n, ast.Attribute) and "confidence" in n.attr.lower()
+        for n in ast.walk(tree)
+    ) or any(kw.arg in THRESHOLD_KWARGS for c in calls for kw in c.keywords if kw.arg)
+
+    findings: list[Finding] = []
+    guarded = False
+
+    def emit(code: str, line: int) -> None:
+        findings.append(_finding(code, filename, line, config))
+
+    for call in calls:
+        name = _call_name(call)
+        kwargs = {kw.arg for kw in call.keywords if kw.arg}
+
+        if name in guardrail_calls:
+            guarded = True
+            emit("JG005", call.lineno)
+            if not (kwargs & THRESHOLD_KWARGS):
+                emit("JG001", call.lineno)
+            for kw in call.keywords:
+                val = _numeric(kw.value)
+                if val is None:
+                    continue
+                if kw.arg in BLOCK_KWARGS and val > 0.7:
+                    emit("JG006", call.lineno)
+                elif kw.arg in ESCALATE_KWARGS and val < 0.3:
+                    emit("JG006", call.lineno)
+
+        if name in state_calls:
+            for value in _state_values(call):
+                if taint.refs_untrusted(value):
+                    emit("JG004", call.lineno)
+                    break
+
+        if name in {"create_agent", "ToolNode"}:
+            for kw in call.keywords:
+                if kw.arg == "tools" and taint.is_dangerous(kw.value) and not has_automode:
+                    emit("JG002", call.lineno)
+
+    for value in _instruction_values(tree):
+        if taint.refs_untrusted(value):
+            emit("JG007", value.lineno if hasattr(value, "lineno") else 1)
+
+    if guarded:
+        decisions = [
+            n
+            for n in ast.walk(tree)
+            if isinstance(n, ast.Attribute) and n.attr in DECISION_ATTRS
+        ]
+        if decisions and not reads_confidence:
+            emit("JG003", decisions[0].lineno)
+
+    suppress = _suppressions(source)
+    result = []
+    seen: set[tuple[str, int]] = set()
+    for f in findings:
+        if f.code in config.disabled or (f.code, f.line) in seen:
+            continue
+        rule = suppress.get(f.line)
+        if rule == "ALL" or (isinstance(rule, set) and f.code in rule):
+            continue
+        seen.add((f.code, f.line))
+        result.append(f)
+    return sorted(result, key=lambda f: (-f.severity, f.line, f.code))
+
+
+def scan_path(path: str | Path, config: Config | None = None) -> list[Finding]:
+    p = Path(path)
+    config = config or Config.load(p)
+    files = [p] if p.is_file() else sorted(p.rglob("*.py"))
+    findings: list[Finding] = []
+    for f in files:
+        try:
+            findings.extend(scan_source(f.read_text(encoding="utf-8"), str(f), config))
+        except (UnicodeDecodeError, OSError):
+            continue
+    return findings

jevg-0.3.0.dist-info/METADATA

@@ -0,0 +1,149 @@
+Metadata-Version: 2.5
+Name: jevg
+Version: 0.3.0
+Summary: Static auditor for code that uses Jev / TypeSafe System One models as a security guardrail.
+Project-URL: Homepage, https://github.com/ppradyoth/jev-guard
+Project-URL: Issues, https://github.com/ppradyoth/jev-guard/issues
+Author: Pradyoth P.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-security,guardrail,jev,llm,red-team,static-analysis,typesafe
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# jev-guard
+
+[![ci](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml) [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) ![python](https://img.shields.io/badge/python-3.10%2B-blue)
+
+**A static code scanner (SAST-style linter).** It reads your Python source and flags insecure usage of [Jev / TypeSafe "System One" models](https://typesafe.ai) when they're used as a security guardrail.
+
+> jev-guard is **not** a guardrail and it does **not** run at runtime, call the model, or touch the network. It is a build-time analysis tool — think `ruff`/`bandit`, scoped to Jev guardrail patterns. It tells you where your guardrail *code* is misconfigured; it does not do any guarding itself.
+
+**Thesis: type-safe is not the same as correct.** Jev can't emit a type error and it can't hallucinate a field — but "no hallucination" is a guarantee about *shape*, not about *truth*. A guardrail that returns a confidently wrong `noul: 0.02` for a `rm -rf /` still lets the call through. If you gate `bash` on that number, the type safety bought you nothing.
+
+`jev-guard` scans your code for the ways a Jev-based guardrail fails open. It runs entirely offline — it reads your source, not the model — so it needs no API key and costs nothing.
+
+## Why this exists
+
+Two things shipped in September 2026:
+
+- TypeSafe released **Jev**, marketed for "score, judge, verify, guardrail, and detect jailbreaks."
+- LangChain shipped **`AutoModeMiddleware`**, which uses Jev to classify tool calls as dangerous and block them before they run — the classifier pattern that used to live inside the closed-source parts of Claude Code / Codex / Cursor, now open to every agent.
+
+The documented example is literally `AutoModeMiddleware(tools=["bash"])` — a shell gate with **no threshold set**, relying on the model's default point decision. That is the exact shape `jev-guard` was built to catch.
+
+## Install
+
+```bash
+pip install jevg           # PyPI package name (the CLI command is still `jev-guard`)
+# or, from source:
+git clone https://github.com/ppradyoth/jev-guard && cd jev-guard
+pip install -e .
+```
+
+## Use
+
+```bash
+jev-guard scan path/to/agent.py        # scan a file
+jev-guard scan src/                     # scan a tree
+jev-guard scan src/ --format json       # machine-readable
+jev-guard scan src/ --fail-on HIGH      # CI gate (default): exit 1 on HIGH+
+jev-guard rules                         # list what it checks
+```
+
+Exit code is non-zero when any finding is at or above `--fail-on`, so it drops straight into CI:
+
+```yaml
+- run: jev-guard scan src/ --fail-on HIGH
+```
+
+## In CI (GitHub Action)
+
+```yaml
+- uses: ppradyoth/jev-guard@v0.3.0
+  with:
+    path: src/
+    fail-on: HIGH
+```
+
+Surface findings in the **Security** tab by emitting SARIF and uploading it —
+see [`examples/github-workflow.yml`](examples/github-workflow.yml).
+
+## Pre-commit
+
+```yaml
+repos:
+  - repo: https://github.com/ppradyoth/jev-guard
+    rev: v0.3.0
+    hooks:
+      - id: jev-guard
+```
+
+## What it flags
+
+| Code  | Severity | What |
+|-------|----------|------|
+| JG001 | HIGH     | Jev guardrail gates actions with no configured confidence threshold (blocks on the model default). |
+| JG002 | CRITICAL | A dangerous tool (`bash`/`sql`/`http`/...) is wired into an agent with no `AutoModeMiddleware` present. |
+| JG003 | MEDIUM   | A `.noul`/`.choice`/`.score` decision is used to branch without ever reading a confidence field. |
+| JG004 | MEDIUM   | Attacker-influenceable content flows straight into a guardrail's `state` (injection surface). |
+| JG005 | INFO     | Jev is being used as a security control — reminder to validate thresholds against your own adversarial data. |
+| JG006 | MEDIUM   | Threshold set in an unsafe band (blocks only near-certain danger / almost never escalates). |
+| JG007 | HIGH     | Untrusted content interpolated into a question's `instructions` — the inspected text can rewrite the question. |
+
+Full rationale and remediation for each: [`GUIDE.md`](GUIDE.md).
+
+## Example
+
+```
+$ jev-guard scan examples/vulnerable_agent.py
+examples/vulnerable_agent.py:5  [HIGH] JG001  Jev guardrail gates actions with no configured confidence threshold
+    ↳ Set an explicit threshold and escalate below it.
+examples/vulnerable_agent.py:11 [MEDIUM] JG004  Untrusted content flows into a Jev guardrail's state
+    ↳ Separate and sanitize untrusted state.
+...
+```
+
+## Configuration
+
+Drop a `.jev-guard.toml` at your repo root (jev-guard walks up to find it):
+
+```toml
+[jev-guard]
+disable = ["JG005"]            # rules to silence entirely
+
+[jev-guard.severity]
+JG004 = "HIGH"                 # bump a rule's severity
+
+[jev-guard.extra]
+dangerous_tools = ["wire_transfer", "post_tweet"]   # your own high-impact tools
+import_roots    = ["my_typesafe_wrapper"]           # if you wrap the SDK
+guardrail_calls = ["MyGuardrail"]                   # your own guardrail factory
+```
+
+Silence a single line inline:
+
+```python
+guardrail = AutoModeMiddleware(tools=["bash"])  # jev-guard: ignore JG001
+another = AutoModeMiddleware(tools=["bash"])     # jev-guard: ignore
+```
+
+jev-guard follows assignments, so indirection is caught — `tools = ["bash"]; create_agent(tools=tools)` and `s = user_msg; classifier.invoke({"state": s})` both flag.
+
+## Scope and honesty
+
+This is a **heuristic linter, not a prover.** It reads Python, matches the LangChain `langchain_typesafe` surface, and reasons about obvious patterns. It will miss guardrails assembled dynamically, wrapped in your own abstractions, or written in another language, and it can raise false positives on safe code that names a variable `user_config`. It does not test the model, measure real calibration, or prove exploitability. It tells you *where to look*, not *that you're owned*.
+
+For what it can and can't do, and when to reach for something else, read [`GUIDE.md`](GUIDE.md).
+
+## License
+
+MIT. Not affiliated with TypeSafe AI or LangChain.

jevg-0.3.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+jev_guard/__init__.py,sha256=fwXLFrF1cmwtdRr4UZbaQrZbhvXJsSn7XDzEuXV2LIo,221
+jev_guard/__main__.py,sha256=MHKZ_ae3fSLGTLUUMOx15fWdeOnJSHhq-zslRP5F5Lc,79
+jev_guard/cli.py,sha256=BkLOL9i48Q7MWWZPnSdGuxHD1t2Yp3Eeo3cJQObrTHs,2943
+jev_guard/config.py,sha256=it4bw7G-k-DaxQuaSV3yHZwuCcyYSl8sBegUn0GEihs,1803
+jev_guard/findings.py,sha256=krM4aN6Pa7Ta020gE62rpVTltRUlzEnaO6zSSBwuwJs,563
+jev_guard/formats.py,sha256=SR-EQzrbWcu4w-LXlUGCChuSCai_k5BbWAFKFIOs6Dk,1914
+jev_guard/rules.py,sha256=A2xnrzoUTblOt_XkwU1N7jDWd2Vl_BJxsCUgtkZwsMI,4470
+jev_guard/scanner.py,sha256=jNVIuCNpxyLaR8mHyQeu_7VEUz5eziAyWgBPPzezEFc,9085
+jevg-0.3.0.dist-info/METADATA,sha256=yVCTIbsx4lkQD48WYc09SCVQ13Hxv5kGOufRd2rZaAE,6825
+jevg-0.3.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+jevg-0.3.0.dist-info/entry_points.txt,sha256=p98gYqrf_bLmgrkOYR8O_spMA0rr_Op3jvGrmHk_obo,75
+jevg-0.3.0.dist-info/licenses/LICENSE,sha256=fVWa5FEmGkZW3a53KYp_Cu7H-_9Jt1Y0QGD88m8hUSw,1068
+jevg-0.3.0.dist-info/RECORD,,

jevg-0.3.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

jevg-0.3.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+jev-guard = jev_guard.cli:main
+jevg = jev_guard.cli:main

jevg-0.3.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pradyoth P.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.