jamjet-labs/jamjet

**The action-control plane for AI agents.** One policy file. One audit trail. Across hooks, guardrails, MCP gateways, SDKs, and custom runtimes.
jamjet.dev · Quickstart · Docs · Examples · Blog · Discord
---
> *Write the safety policy once. Run it everywhere your agents can act.*
JamJet sits underneath your agent (Claude Code, OpenAI Agents SDK, MCP clients, LangChain, CrewAI, ADK, Spring AI, custom code) and enforces what prompts cannot:
- 🛡️ **Block unsafe tool calls** at runtime: database deletes, payments, file writes
- ✋ **Pause for human approval** on risky actions, durably
- 💸 **Cap cost** per agent, per run, per project
- 📒 **Record an audit trail** that survives a regulator's review
- ⏪ **Replay or resume** crashed runs from the last checkpoint
**Keep your agent framework. Add JamJet where tool calls need control.**
See it in 60 seconds
No API key. No Docker. No cloud account. The model is mocked; the enforcement path is real. Three more demos run the same way:
Works alongside **Claude Code · OpenAI Agents SDK · MCP clients · LangChain · CrewAI · ADK · Spring AI · LangChain4j**.
On the JVM: one dependency
Spring AI and LangChain4j teams get the same layer without writing glue code. The Spring Boot starter auto-injects JamJet advisors into your ChatClient: every call becomes durable and audited, with no changes to your application code.
Crash recovery, event sourcing, and a REST endpoint to approve or reject held actions. Falls back gracefully if the runtime is unreachable.
Prefer no sidecar at all? **JamJet Java Runtime** embeds durable execution directly in your JVM process: Java 21, no Docker, **8.9× faster** than calling out to a REST sidecar (benchmark and launch post). Works with Spring AI, LangChain4j, and Google ADK.
→ See a Spring Boot agent survive kill -9 mid-run in **examples/loan-underwriter-agent**: resumes from disk checkpoints, gates disbursement on human approval, emits a signed receipt bundle.
The same policy, everywhere
Every agent toolchain is inventing its own safety layer. JamJet gives you one policy file and one audit trail across all of them.
| Adapter | Install | Host |
|---|---|---|
| @jamjet/claude-code-hook | npm i -g @jamjet/claude-code-hook | Claude Code PreToolUse hook |
| @jamjet/mcp-shim | npx -y @jamjet/mcp-shim ... | Any MCP client (Claude Desktop, Cursor, …) |
| @jamjet/openai-guardrail | npm i @jamjet/openai-guardrail | OpenAI Agents SDK tool guardrail (TS) |
| jamjet.integrations.openai_guardrail | pip install jamjet | OpenAI Agents SDK tool guardrail (Python) |
| jamjet | pip install jamjet | Python SDK + runtime |
| dev.jamjet:jamjet-spring-boot-starter | Maven / Gradle | Spring AI ChatClient advisors |
| @jamjet/cloud | npm i @jamjet/cloud | TypeScript SDK + shared engine |
| @jamjet/cli | npm i -g @jamjet/cli | Unified jamjet audit show / jamjet approve |
All adapters load the same policy.yaml. All emit conformant audit JSONL to ~/.jamjet/audit/. Run jamjet audit show to tail every decision across every adapter in one chronological view.
JamJet does not replace the hook points these platforms give you. It makes them do more: Claude Code's PreToolUse hook gets a real policy engine, approval flow, and audit trail, and the same rules carry unchanged to OpenAI Agents SDK, MCP clients, Spring AI, and your own Python or TypeScript code.
One policy, every adapter
Drop this file in ~/.jamjet/. Every adapter listed above uses it automatically.
> Prompts are not a security boundary. The runtime is.
→ Read **When AI Deletes the Database** for why this is a runtime architecture problem, not a model problem.
→ See the deeper **durability demo at jamjet.dev/demo** for what happens when an agent crashes mid-tool-call.