Jev-Moderation-Bot and the Edge-Safety Toolkit

Guardrails don't all sit in the same place. Some run inside the agent, checking tool calls before they execute. Some run at the network edge, screening requests before they ever reach a backend. Some run inside a community platform, moderating what users post to each other. Three small, independent projects show what a typed decision model looks like at each of those layers: a Discord moderation bot, an nginx/OpenResty request filter, and a shell-permission gate for coding agents.

None of these are large projects — star counts here run from 15 to 41 — and none claim to be production-hardened. What they show well is the shape of the idea repeated at different scales. For the browser and gateway version of this pattern, see jev-guard, jev-mcp and Safer with Jev; for the underlying model, see what Jev is.

Key Takeaways

• Jev-Moderation-Bot scores Discord messages on scam, spam, and toxicity risk, and fails open — if the API is unreachable, messages pass through rather than getting blocked.
• jev-edge reports the strongest accuracy numbers of the three: 0.994–0.997 AUC on public prompt-injection datasets, though only in a three-layer design where most traffic never reaches Jev at all.
• jevvy only asks Jev about permission requests your agent hasn't already resolved — existing allow/deny rules stay final, and it abstains rather than guessing when unsure.
• All three explicitly fail open by default. If TypeSafe's API is down, none of them block by default — they let the action through and log it.
• Evidence quality varies. jev-edge documents accuracy against named public datasets; Jev-Moderation-Bot and jevvy rely mostly on the authors' own descriptions of intended behavior.

Jev-Moderation-Bot: scoring what gets posted

Jev-Moderation-Bot (MIT, 41 stars as of September 2026, /skills/jev-moderation-bot-brainstormity) filters Discord messages in real time for scam links and spam, and can escalate repeat offenders automatically through a progressive discipline system — warnings, then timeouts, then bans. A /profile command lets moderators send a member's recent message sample and infraction history to TypeSafe's API for a broader read on scam risk, spam likelihood, toxicity, and helpfulness.

Two design details are worth noting. The bot caches 10–100 recent messages per user in SQLite for profiling, which is useful context for the model but also a retention decision moderators should be aware of. And it includes what the README calls "dynamic false-flag learning" — pardoned messages feed back into future evaluation, though how much that actually shifts scoring isn't quantified publicly. Like the other two projects here, it fails open: if TypeSafe's API is unreachable, messages go through unmoderated rather than getting held.

jev-edge: admission control before the backend ever sees a request

jev-edge (Apache-2.0, 23 stars, /skills/jev-edge-kiwi0719) runs inside nginx, OpenResty, or Apache APISIX, filtering requests before they reach an LLM-backed application. It's explicitly built for SREs and platform engineers rather than agent authors — the existing wave of Jev guardrails runs on a developer's machine; this one runs at the gateway, judging external traffic instead.

Its three-layer design is the interesting part. L1 is local pattern matching — unwatched paths and non-text bodies pass here, adding about 20 microseconds. L2 calls Jev synchronously for ambiguous cases, at roughly 270–300ms p50. L3 runs async and never blocks the response, feeding a reputation system and alerts instead. The point of the layering is that most traffic — normal, unambiguous requests — never pays the cost of the API call at all.

On accuracy, jev-edge reports numbers against named public datasets rather than only its own examples: 0.996 AUC on Deepset's injection dataset (0.8% false positives, 5.3% misses), 0.994 AUC on a Chinese instruction-override set (0% false positives, 9.3% misses), and 0.997 AUC on held-out tool results with untrusted content enabled (0.1% false positives, 19.0% misses). Those are meaningfully better-documented claims than most projects in this series make, though the author is explicit that the project is an "Independent project" and "a client of their API," not affiliated with TypeSafe AI, and that no production deployments are known yet — "run in monitor mode first" is the README's own advice.

jevvy: staying out of the way of decisions already made

jevvy (MIT, 15 stars, /skills/jevvy-panachy) is narrower by design. Its main component, Jevvy Permissions, only looks at shell permission requests a coding agent's own allow/deny rules haven't already resolved. It scores four risk dimensions — potential for harm, exposure of sensitive data, execution of untrusted code, and obscured behavior — and auto-approves only if every check passes; otherwise it abstains and leaves the agent's normal permission flow untouched. It supports OpenCode v2 and Claude Code.

The project is honest about the limits of its own evidence: calibration is checked against a shipped test file (eval/commands.json), and the README says custom policies beyond that file are "not covered by this evidence." That's a smaller, more defensible claim than some of its peers make, even if it means less has actually been tested.

What to do next

1. Match the layer to the risk you're actually worried about. A Discord bot doesn't need edge filtering, and an internal agent tool doesn't need Discord-style user profiling.
2. Check the fail-open default before you deploy any of these. All three let actions through if TypeSafe's API is down — decide whether that's acceptable for your case, or whether you need a fail-closed configuration.
3. Weight jev-edge's numbers appropriately. They're the best-documented in this group because they're tested against named public datasets, but a 19% miss rate on held-out tool results with untrusted content is still a real gap, not a solved problem.
4. Start in monitor or advisory mode for all three, and read how to evaluate Jev projects honestly before trusting any of them to act automatically. The wider set of security projects is at the Awesome Jev radar.