JEV Gateway — PII/PHI Guardrails for Coding Agents

Local data-access controls for Codex, Claude Code and other MCP agents. Review text and images before they enter agent context, withhold protected records, and let the agent continue through local computation. Built for personally identifiable information (PII) and protected health information (PHI) workflows. Inference only; no training.

Quick start · Connect your agent · How it works · Results · Agent skill

Current scope: a research prototype with strict source controls. The contextual reviewer still over-blocks permitted data, especially images; it is not validated as a general PHI detector. The completed results report both withholding and permitted-view access.

Quick start: no GPU required

Requires Python 3.10+ on POSIX. Install from source; the core has no external Python dependencies, and the MCP extra provides the tool server.

git clone https://github.com/d0ng231/jev-gtw.git
cd jev-gtw
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -e '.[mcp]'

jev-gtw check --config examples/gateway.json
jev-gtw read --config examples/gateway.json setup
jev-gtw read --config examples/gateway.json records

The demo uses exact public grants and protected-source rules, so no model server is needed. Probe execution is disabled until a sandbox is configured.

Related MCP server: Codex Jev

Connect Codex or Claude Code

From the checkout above, install the skill into this demo project:

python tools/install_skill.py --target both --project .

Register the server in the client you use. These commands resolve the executable and configuration to absolute paths, so the server can start from another directory.

Codex

codex mcp add jev_gtw -- "$PWD/.venv/bin/jev-gtw" serve --config "$PWD/examples/gateway.json"

Claude Code

claude mcp add --transport stdio --scope user jev_gtw -- "$PWD/.venv/bin/jev-gtw" serve --config "$PWD/examples/gateway.json"

Start the agent in this project and invoke $jev-gtw in Codex or /jev-gtw in Claude Code. To use the skill in another task repository, pass that directory to --project instead. The installer refuses to overwrite an existing skill. Server registration changes the selected client's MCP settings.

Try: “Use the JEV gateway to read the public setup and check whether the records can be viewed. If they must stay local, explain the permitted next step.”

The integration guide covers the local inspector, Docker/Apptainer configuration, custom harness API and deployment boundary.

How a view is released

flowchart TD
    request["Nonempty view + trusted task context"] --> policy{"Source access?"}
    policy -->|"local or deny"| withheld["Withhold view; local processing or hold"]
    policy -->|"approved"| snapshot{"Complete, valid and exact hash match?"}
    snapshot -->|"Yes"| shown["Validate and show exact admitted bytes"]
    snapshot -->|"No"| withheld
    policy -->|"contextual"| checks{"Complete, supported and no sensitive text signal?"}
    checks -->|"No"| withheld
    checks -->|"Yes"| model["Local 0.8B JEV: one typed question"]
    model --> score{"Valid permission score at least 0.98?"}
    score -->|"Yes"| shown
    score -->|"No or inspection error"| withheld

The default hybrid inspector asks about disclosure risk for text and permission for images, retaining the 0.98 release threshold. Unicode and encoded identifiers receive bounded checks before inference.

Redaction is not an automatic release path. A transformed view still needs its own review. The 0.98 threshold is not a calibrated 98% safety guarantee. Complete empty observations can pass without a model call when source policy allows. See the architecture for exact source-cap and validation behavior.

Continue a task without displaying its records

For contextual model review, install the official StartLux runtime in a GPU environment and run bash tools/serve_inspector.sh; it downloads the pinned 0.8B checkpoint. Set TMPDIR to private scratch first. For local probes, configure a sandbox as described in the setup guide.

Deployment boundary: protected storage and operator configuration must be inaccessible through the agent's other tools. This skill guides use of the provided MCP routes; it does not automatically intercept native shell/read/image tools, other servers or direct chat uploads.

What has been tested

No training or weight updates. The latest completed evaluation includes real 0.8B inference, before/after comparisons and actual coding-model MCP workflows.

The agent tasks cover CSV repair/joins, JSONL, SQLite, FHIR, HL7, clinical category counts and PNG processing. They use the official MCP client and SingularityCE with only gateway tools exposed. These are authored tasks, not native Codex/Claude sessions or standard coding-benchmark scores.

Rechecked against the raw records. All 10,728 final decisions replayed unchanged with saved scores. Four Qwen episodes hit the turn limit despite creating correct artifacts; six later probes incorrectly expected previous outputs in a fresh workspace. The tool now states that isolation explicitly. Receipt storage is capped at 4,096 hashes and rejects evicted receipts. These are offline verification and implementation fixes; the coding models were not rerun. Original experiment evidence remains unchanged. See the audit.

Failures changed the design. The new text question released eight credential screenshots when applied to images; that image variant was rejected. A 0.95 threshold replay released one prohibited regression view, so the default remains 0.98. Over-blocking remains substantial, especially for contextual images.

Exact repeated requests measured 30.31 ms → 0.47 ms warm median latency in a serial cache microbenchmark, with 1 model call for 41 requests instead of 41. This is a repeated-input result, not general workload latency. The new cohort used 3,514 model calls versus 3,771 before; six-worker warm latency was about 78 ms p50 / 150 ms p95 on one A100.

Full methods, datasets and limitations · HTML report — download and open locally · Machine-readable evidence.

Reproduce

python -m pip install -e '.[dev]'
python -B -m unittest discover -s tests -v
python tools/fetch_public_examples.py --out /path/to/new-public-sources
python tools/make_scenarios.py --out /path/to/new-scenarios \
  --public /path/to/new-public-sources/examples.json
python tools/evaluate.py --cases /path/to/new-scenarios/test.json \
  --out /path/to/new-results --url http://127.0.0.1:8090

Use a new directory for every evaluation. The synthetic fixtures are policy controls, not a clinical PHI benchmark. External source rows, research traces, credentials and model weights are excluded. tools/smoke_sandbox.py exercises an operator-configured container with fictional inputs. No training scripts are included.

License

Gateway code: MIT. Default StartLux model weights: CC BY-NC 4.0, separately licensed. The model is not an unrestricted commercial dependency. See NOTICE.