{
"markdown": "\n\n
⚡ JamJet
\n\n**The action-control plane for AI agents.** One policy file. One audit trail. Across hooks, guardrails, MCP gateways, SDKs, and custom runtimes.\n\n[](https://glama.ai/mcp/servers/jamjet-labs/jamjet)\n[](https://github.com/jamjet-labs/jamjet/actions)\n[](https://pypi.org/project/jamjet)\n[](https://central.sonatype.com/artifact/dev.jamjet/jamjet-runtime-core)\n[](https://crates.io/crates/jamjet-policy)\n[](LICENSE)\n[](https://discord.gg/SAYnEj86fr)\n\n[jamjet.dev](https://jamjet.dev) · [Quickstart](https://jamjet.dev/quickstart) · [Docs](https://jamjet.dev/concepts) · [Examples](https://jamjet.dev/examples) · [Blog](https://jamjet.dev/blog) · [Discord](https://discord.gg/SAYnEj86fr)\n\n[](https://codespaces.new/jamjet-labs/jamjet?quickstart=1)\n[](https://gitpod.io/#https://github.com/jamjet-labs/jamjet)\n\n\n\n---\n\n> *Write the safety policy once. Run it everywhere your agents can act.*\n\nJamJet sits underneath your agent (Claude Code, OpenAI Agents SDK, MCP clients, LangChain, CrewAI, ADK, Spring AI, custom code) and enforces what prompts cannot:\n\n- 🛡️ **Block unsafe tool calls** at runtime: database deletes, payments, file writes\n- ✋ **Pause for human approval** on risky actions, durably\n- 💸 **Cap cost** per agent, per run, per project\n- 📒 **Record an audit trail** that survives a regulator's review\n- ⏪ **Replay or resume** crashed runs from the last checkpoint\n\n**Keep your agent framework. Add JamJet where tool calls need control.**\n\n\n\n## See it in 60 seconds\n\n```bash\npip install jamjet\njamjet demo unsafe-tool-call\n```\n\nNo API key. No Docker. No cloud account. The model is mocked; the enforcement path is real. Three more demos run the same way:\n\n```bash\njamjet demo approval # pause-for-approval flow\njamjet demo budget-cap # $0.05 cost cap\njamjet demo mcp-tool-policy # MCP-shaped policy (preview of JamJet Gateway)\n```\n\nWorks alongside **Claude Code · OpenAI Agents SDK · MCP clients · LangChain · CrewAI · ADK · Spring AI · LangChain4j**.\n\n## On the JVM: one dependency\n\nSpring AI and LangChain4j teams get the same layer without writing glue code. The Spring Boot starter auto-injects JamJet advisors into your `ChatClient`: every call becomes durable and audited, with no changes to your application code.\n\n```xml\n\n dev.jamjet\n jamjet-spring-boot-starter\n 0.1.0\n\n```\n\n```properties\nspring.jamjet.runtime-url=http://localhost:7700\nspring.jamjet.approval.enabled=true # opt-in human-in-the-loop approval\n```\n\nCrash recovery, event sourcing, and a REST endpoint to approve or reject held actions. Falls back gracefully if the runtime is unreachable.\n\nPrefer no sidecar at all? **[JamJet Java Runtime](https://github.com/jamjet-labs/jamjet-runtime-java)** embeds durable execution directly in your JVM process: Java 21, no Docker, **8.9× faster** than calling out to a REST sidecar ([benchmark and launch post](https://jamjet.dev/blog/zero-sidecar-durable-agents-java/)). Works with Spring AI, LangChain4j, and Google ADK.\n\n→ See a Spring Boot agent survive `kill -9` mid-run in **[`examples/loan-underwriter-agent`](examples/loan-underwriter-agent)**: resumes from disk checkpoints, gates disbursement on human approval, emits a signed receipt bundle.\n\n## The same policy, everywhere\n\nEvery agent toolchain is inventing its own safety layer. JamJet gives you one policy file and one audit trail across all of them.\n\n| Adapter | Install | Host |\n|---|---|---|\n| [`@jamjet/claude-code-hook`](https://npmjs.com/package/@jamjet/claude-code-hook) | `npm i -g @jamjet/claude-code-hook` | [Claude Code](https://docs.claude.com/en/docs/claude-code/hooks) PreToolUse hook |\n| [`@jamjet/mcp-shim`](https://npmjs.com/package/@jamjet/mcp-shim) | `npx -y @jamjet/mcp-shim ...` | Any [MCP](https://modelcontextprotocol.io) client (Claude Desktop, Cursor, …) |\n| [`@jamjet/openai-guardrail`](https://npmjs.com/package/@jamjet/openai-guardrail) | `npm i @jamjet/openai-guardrail` | [OpenAI Agents SDK](https://github.com/openai/openai-agents-js) tool guardrail (TS) |\n| [`jamjet.integrations.openai_guardrail`](https://pypi.org/project/jamjet/) | `pip install jamjet` | [OpenAI Agents SDK](https://github.com/openai/openai-agents-python) tool guardrail (Python) |\n| [`jamjet`](https://pypi.org/project/jamjet/) | `pip install jamjet` | Python SDK + runtime |\n| [`dev.jamjet:jamjet-spring-boot-starter`](https://central.sonatype.com/artifact/dev.jamjet/jamjet-spring-boot-starter) | Maven / Gradle | [Spring AI](https://spring.io/projects/spring-ai) ChatClient advisors |\n| [`@jamjet/cloud`](https://npmjs.com/package/@jamjet/cloud) | `npm i @jamjet/cloud` | TypeScript SDK + shared engine |\n| [`@jamjet/cli`](https://npmjs.com/package/@jamjet/cli) | `npm i -g @jamjet/cli` | Unified `jamjet audit show` / `jamjet approve` |\n\nAll adapters load the same `policy.yaml`. All emit conformant audit JSONL to `~/.jamjet/audit/`. Run `jamjet audit show` to tail every decision across every adapter in one chronological view.\n\nJamJet does not replace the hook points these platforms give you. It makes them do more: Claude Code's PreToolUse hook gets a real policy engine, approval flow, and audit trail, and the same rules carry unchanged to OpenAI Agents SDK, MCP clients, Spring AI, and your own Python or TypeScript code.\n\n### One policy, every adapter\n\n```yaml\n# ~/.jamjet/policy.yaml\nversion: 1\nrules:\n - { match: \"*delete*\", action: block }\n - { match: \"payments.*\", action: require_approval }\n - { match: \"shell.exec\", action: block }\n```\n\nDrop this file in `~/.jamjet/`. Every adapter listed above uses it automatically.\n\n> Prompts are not a security boundary. The runtime is.\n\n→ Read **[When AI Deletes the Database](https://jamjet.dev/blog/when-ai-deletes-the-database/)** for why this is a runtime architecture problem, not a model problem.\n→ See the deeper **[durability demo at jamjet.dev/demo](https://jamjet.dev/demo)** for what happens when an agent crashes mid-tool-call.\n\n## Policy in your own code\n\nDrop a policy beside your agent code. The runtime intercepts any matching tool call *before* it leaves the agent's process: `blocked_tools` are refused outright, `require_approval_for` pauses execution durably and waits for an out-of-band decision. Crashes don't lose the approval; execution resumes when it arrives.\n\n```yaml\n# workflow.yaml\npolicy:\n blocked_tools:\n - \"*delete*\"\n - \"payments.refund\"\n require_approval_for:\n - \"database.*\"\n - \"payment.transfer\"\n - \"user.suspend\"\n```\n\n**Python, with the hosted control plane:**\n\n```python\nimport jamjet\njamjet.cloud.configure(api_key=\"jj_...\", project=\"my-agent\")\njamjet.cloud.policy(\"block\", \"*delete*\")\njamjet.cloud.policy(\"require_approval\", \"database.*\")\n# Every OpenAI / Anthropic call in this process is now policy-gated.\n```\n\n→ Runnable approval workflow in **[`examples/hitl-approval`](examples/hitl-approval)** · [Cloud Quickstart](https://docs.jamjet.dev/en/docs/cloud-quickstart)\n\n## Where JamJet sits\n\n```text\n Your Agent / Framework\n (LangChain · CrewAI · ADK · custom · MCP client)\n │\n ▼\n ┌───────────────────────────────────────────────┐\n │ JamJet Safety Layer │\n │ policy · approval · budget · audit · replay │\n └───────────────────────────────────────────────┘\n │\n ▼\n Tools · MCP servers · APIs · DBs · Agents\n```\n\n## Use JamJet when your agent can…\n\n- call MCP servers or arbitrary tools\n- write to a database\n- send emails or Slack messages\n- trigger payments or external API calls\n- access customer data or PII\n- run for minutes/hours and needs to survive crashes\n- spend real model budget at scale\n- delegate to other agents\n\n## What JamJet adds\n\n| Without JamJet | With JamJet |\n|---|---|\n| Agent crashes lose progress | Resume from the last checkpoint |\n| Tool calls rely on scattered app logic | Runtime policy blocks unsafe actions |\n| Human approval is custom glue | Approval is a durable workflow step |\n| Costs are discovered after the bill | Budgets enforced per agent / per run |\n| Audit evidence is stitched from logs | Append-only event log, signed export |\n| Memory is framework-specific | Pair with [Engram](#engram) for portable memory (MCP · REST · Python · Java) |\n| Frameworks stay siloed | MCP + A2A connect tools and agents |\n\n## A full runtime underneath\n\nThe safety layer runs on a durable, event-sourced execution engine. When you want more than enforcement, it's already there:\n\n- **Durable execution.** Event log, snapshots, crash recovery, deterministic replay. `agent.run_durable(...)` in [`examples/react-agent-durable`](examples/react-agent-durable).\n- **Sessions and memory.** Persistent `Session` threads across runs and restarts, with a governed Engram retrieve/record loop. [`examples/session-memory`](examples/session-memory).\n- **Multi-agent.** `Sequential`, `Parallel`, coordinator `Team`, and `Loop`; each sub-agent runs as its own governed durable execution. [`examples/team-multi-agent`](examples/team-multi-agent). Declare whole fleets in YAML with cron schedules: [`examples/fleet`](examples/fleet).\n- **Evaluation.** Batch eval with LLM-judge scoring ([`examples/eval-harness`](examples/eval-harness)) and trajectory regression diffs ([`examples/trajectory-eval`](examples/trajectory-eval)).\n- **Deploy.** `agent.deploy(runtime=\"local\" | \"self-host\" | \"cloud\")` ships the same compiled IR to any runtime. [`examples/deploy-an-agent`](examples/deploy-an-agent).\n- **Dev loop.** `jamjet create` scaffolds a project; `jamjet dev` runs the whole local stack with one command.\n- **Web Companion.** A UI embedded in the runtime binary: graph view, timeline, state inspector, replay and fork controls.\n\n## Works with your stack, not a replacement\n\nJamJet does not replace LangChain, LangGraph, CrewAI, Google ADK, Spring AI, or your custom agent code. Use those to build agent behavior. Use JamJet to control what happens at runtime.\n\n| You're using | Keep it for | JamJet adds |\n|---|---|---|\n| **LangChain · LangGraph · CrewAI · Google ADK · AutoGen** | Authoring agent behavior | Runtime safety: policy, audit, replay, approvals |\n| **LangSmith · Arize · Weights & Biases** | Observability and evaluation | Active enforcement (block at runtime) + durable recovery |\n| **Temporal · Orkes · DBOS** | General durable workflows | Agent-native primitives: policy on tool calls, MCP/A2A, memory |\n| **Google · AWS · Azure agent platforms** | Cloud-native ecosystems | Open-source, cloud-neutral governance that works on-prem |\n\nWant to build the official integration for *your* framework? **[Claim a slot](https://github.com/jamjet-labs/jamjet-examples/issues?q=is%3Aissue+is%3Aopen+label%3Awanted-integration)**: 8 slots open, the first 10 merged contributors get JamJet swag.\n\n## Examples\n\n| Example | What it shows |\n|---------|--------------|\n| [`01-block-unsafe-tool`](examples/01-block-unsafe-tool) | A destructive tool call blocked before execution |\n| [`hitl-approval`](examples/hitl-approval) | Human approval as a first-class workflow primitive |\n| [`react-agent-durable`](examples/react-agent-durable) | A ReAct agent on the durable engine: event log, replay, park-on-429 |\n| [`team-multi-agent`](examples/team-multi-agent) | Multi-agent Teams, each sub-agent its own governed run |\n| [`loan-underwriter-agent`](examples/loan-underwriter-agent) | Spring Boot agent that survives `kill -9` and gates on human approval |\n| [`claims-processing`](examples/claims-processing) | Insurance pipeline: 4 specialist agents + HITL + audit |\n| [`eval-harness`](examples/eval-harness) | Batch evaluation with LLM judge scoring |\n\n→ [All 33 examples](examples/)\n\n## Engram\n\n**[Engram](runtime/engram-server/README.md)** is the JamJet ecosystem's memory layer for agents. Where JamJet provides durable *execution* (process can crash and resume), Engram provides durable *memory* (facts persist across runs and version cleanly via `supersede()`). Temporal knowledge graph, hybrid retrieval, conflict detection. Ships as a [Rust crate](https://crates.io/crates/jamjet-engram) (also bundled into the Rust runtime above), an [MCP server](https://registry.modelcontextprotocol.io/servers/io.github.jamjet-labs/engram-server) (Docker · GHCR), a [standalone Python library](https://pypi.org/project/jamjet-engram) ([github.com/jamjet-labs/engram](https://github.com/jamjet-labs/engram), 71% on LongMemEval-S), a [Python client](https://pypi.org/project/jamjet) for the MCP server, and a [Spring AI `ChatMemoryRepository`](https://central.sonatype.com/artifact/dev.jamjet/engram-spring-boot-starter). Comparison with Mem0/Zep → [java-ai-memory.dev](https://java-ai-memory.dev).\n\n## Architecture\n\n\nStack diagram
\n\n```\n┌──────────────────────────────────────────────────────────┐\n│ Authoring Layer │\n│ Python SDK | Java SDK | TypeScript SDK | YAML │\n├──────────────────────────────────────────────────────────┤\n│ Compilation / Validation │\n│ Graph IR | Schema | Policy lint │\n├────────────────────────────┬─────────────────────────────┤\n│ Rust Runtime Core │ Protocol Layer │\n│ Scheduler | State SM │ MCP Client | MCP Server │\n│ Event log | Snapshots │ A2A Client | A2A Server │\n│ Workers | Timers │ │\n├────────────────────────────┴─────────────────────────────┤\n│ Enterprise Services │\n│ Policy | Audit | PII Redaction | OAuth | mTLS │\n├──────────────────────────────────────────────────────────┤\n│ Runtime Services │\n│ Model Adapters | Tool Execution | Engram Memory │\n├──────────────────────────────────────────────────────────┤\n│ Storage │\n│ Postgres (production) | SQLite (local) │\n└──────────────────────────────────────────────────────────┘\n```\n\n*\"Engram Memory\" here is the in-process distribution bundled with the Rust runtime. Engram also ships standalone; see [Engram](#engram).*\n\n \n\n## Documentation\n\nFull docs at **[jamjet.dev](https://jamjet.dev/quickstart)**\n\n[Quickstart](https://jamjet.dev/quickstart) · [Concepts](https://jamjet.dev/concepts) · [Python SDK](https://jamjet.dev/python-sdk) · [Java SDK](https://jamjet.dev/java-sdk) · [YAML Workflows](https://jamjet.dev/yaml-workflows) · [REST API](https://jamjet.dev/api-reference) · [MCP](https://jamjet.dev/mcp) · [A2A](https://jamjet.dev/a2a) · [Eval](https://jamjet.dev/eval) · [Enterprise](https://jamjet.dev/enterprise) · [Observability](https://jamjet.dev/observability) · [CLI](https://jamjet.dev/cli) · [Deployment](https://jamjet.dev/deployment)\n\n## Contributing\n\nContributions welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n**Looking for a starter task?**\n- Build a [framework integration](https://github.com/jamjet-labs/jamjet-examples/issues?q=is%3Aissue+is%3Aopen+label%3Awanted-integration): 8 slots open, first 10 contributors get JamJet swag\n- Browse [good first issues](https://github.com/jamjet-labs/jamjet/labels/good%20first%20issue)\n- Join the conversation in [Discord](https://discord.gg/SAYnEj86fr)\n\n## Community\n\n[GitHub Discussions](https://github.com/jamjet-labs/jamjet/discussions) · [Issues](https://github.com/jamjet-labs/jamjet/issues) · [Discord](https://discord.gg/SAYnEj86fr)\n\n## License\n\nApache 2.0. See [LICENSE](LICENSE).\n\n---\n\n\n\n*Hosted control plane available at [app.jamjet.dev](https://app.jamjet.dev): traces, approval queue, audit retention, team projects. Optional. The runtime, all SDKs, and Engram are Apache-2.0 with no usage limits.*\n\n### ⭐ Star JamJet if you believe agents need a runtime safety layer\n\n
Built by Sunil Prakash · © 2026 JamJet Labs · jamjet.dev · Apache 2.0\n\n