Skip to content
Metatext Decide — typed decisions for your agents, with a probability on every answerGet early access
Metatext
Sign Up
Agent guardrails

Is this action safe? A PreToolUse decision with a probability, not a prompt.

The jevwire and jev-mcp projects turned Jev into Claude Code hooks: every proposed bash command, diff or deploy is judged by a handful of noul questions before it runs. The pattern is right; the dependency on a hosted API for a security decision is the part teams push back on.

Get early access See the benchmark

In development — the benchmark numbers on this page are measured; the Decide-1 model is in training.

The problem

Prompted guardrails are prose

“Is this safe?” to a chat model returns an essay and no threshold. You cannot set a policy on an essay.

The judge sees your commands

A hosted guardrail receives every command your agent proposes, including the ones with paths, hostnames and secrets in them.

Latency compounds

A guardrail that costs a second per tool call turns a 200-call session into three extra minutes.

How it works with Decide
  1. 1

    Define the policy as questions

    destructive? writes to a production system? touches credentials? violates a repo rule? outside the task? Each a noul with its own criteria.

  2. 2

    Score the blast radius

    A score 0–3 (none / local / shared / production) turns the answer into a routing decision: allow, confirm, block.

  3. 3

    Tune on your own decisions

    The approvals and rejections your team already makes are labels. A few hundred of them make the guardrail yours.

# One batched request per tool call; every answer carries a probability
questions = {
  "destructive":  {"type": "noul", "instructions": "Deletes, drops or force-pushes."},
  "production":   {"type": "noul", "instructions": "Targets a production system."},
  "credentials":  {"type": "noul", "instructions": "Reads or writes secrets."},
  "blast_radius": {"type": "score", "instructions": "How far could this reach?",
                   "criteria": ["none", "this repo", "shared service", "production"]},
}
decision = "block" if any(a.noul > 0.85 for a in nouls) else \
           "confirm" if any(a.noul > 0.5 for a in nouls) else "allow"
  • Noul — a calibrated yes/no probability
  • Score — a position on your ordered rubric
  • Choice — pick one option, a probability on each
Something you can check

Community threshold practice (oflight.co.jp, jevwire): hold for human approval when any noul exceeds 0.5, block above ~0.85, and override to block when severity reaches the top level.

Numbers about Jev are its authors' or the cited source's; numbers from the benchmark are ours, on one harness, with the raw JSON published. Full table.

Get early access — and tell us which decision you'd hand over first

We're building Metatext Decide with the first teams that use it. Leave your email, answer as much as you like, and say yes to a short interview if you want a say in what ships.

  • Early access to Decide as it opens up
  • A 20-minute interview if you want one — research, not a pitch
  • The benchmark harness and raw results, today
  • No spam — early-access updates only
Where do decisions happen in your stack today?
What kind of decisions?
Have you tried Jev?
What stops you using a hosted decision API?
Would you pay?
Open to a 20-minute interview?

Research, not a pitch — we want to hear how you decide today.

Early-access updates only. No spam, unsubscribe any time.

Questions

Can it detect prompt injection?
As a noul question over the content, yes — the RAG-filtering page shows an injected passage scored 0.99 in a community test. It is a classifier, not a proof; keep it in front of a human for high-blast-radius actions.
Does it work with Codex, Cursor or Pi?
Anything with a hook or middleware point. The request is HTTP.

Related