jamjet

Purpose

JamJet is an open-source security layer for AI agents, positioned as the "action control plane for agents." It does not replace frameworks such as LangChain, LangGraph, CrewAI, Google ADK, or Spring AI; instead, it sits beneath these frameworks and agents, enforcing policy before tool calls actually happen. The official emphasis is: prompts are not a security boundary, the runtime is.

Main Capabilities

• Runtime interception: blocks unsafe tool calls, such as database deletions, payments, file writes, and more. blocked_tools listed in the policy are rejected outright.
• Human approval: pauses execution for high-risk actions via require_approval_for and waits in a durable way for an out-of-band decision; a crash will not lose the approval, and execution continues once the approval arrives.
• Budget control: limits cost caps per agent, per run, and per project.
• Audit trail: records compliance-ready audit data, suitable for regulatory review scenarios.
• Replay and recovery: replays or recovers crashed runs from the last checkpoint.
• Unified policy: all adapters load the same policy.yaml and output unified audit JSONL; jamjet audit show can be used to view the decisions of all adapters in chronological order.
• Durable execution: a built-in durable, event-sourced execution engine that supports event logs, snapshots, crash recovery, and deterministic replay (agent.run_durable).
• Sessions and memory: durable Session threads across runs and restarts, plus a governed Engram retrieval/recording loop.
• Multi-agent: provides orchestration modes such as Sequential, Parallel, coordinator Team, and Loop, with each sub-agent running as an independent governed durable execution; the entire agent cluster can also be declared in YAML with cron scheduling configured.
• Evaluation: supports batch evaluation and LLM-as-judge scoring, as well as trajectory regression diff comparison.
• Deployment: agent.deploy(runtime="local" | "self-host" | "cloud") can deploy the same compiled IR to different runtimes.
• Development workflow: jamjet create creates the project scaffold, and jamjet dev runs the entire local stack with a single command.
• Web companion interface: embedded in the runtime binary, providingGraph view, timeline, state inspector, replay, and fork control.
• Java/JVM support: Spring AI and LangChain4j teams can get the same-layer capabilities through a single dependency. The Spring Boot starter automatically injects JamJet advisors into ChatClient, making every call persistent and auditable without modifying application code. It provides crash recovery, event sourcing, and REST endpoints for approving/rejecting pending actions; it degrades gracefully when the runtime is unreachable. You can also choose to not use a sidecar at all and use the JamJet Java Runtime to embed persistent execution directly into the JVM process.

How to Use

An official 60-second demo is provided: no API key, no Docker, no cloud account required; the model is simulated, but the execution path is real.

After placing policy.yaml into ~/.jamjet/, all listed adapters will automatically use it. Policies can also be placed directly next to the agent code, and the runtime will intercept before tool calls leave the agent process: blocked_tools are rejected directly, and require_approval_for will persistently pause execution and wait for an out-of-band decision.

Example (Python, with managed control plane): a runnable approval workflow example examples/hitl-approval and Cloud Quickstart are provided.

Compatible combinations: Claude Code, OpenAI Agents SDK, MCP clients, LangChain, CrewAI, ADK, Spring AI, LangChain4j. JamJet does not replace the hook points provided by these platforms, but makes their capabilities stronger. For example, Claude Code's PreToolUse hook can gain a real policy engine, approval flow, and audit trail, and the same rules can be used as-is with OpenAI Agents SDK, MCP clients, Spring AI, and your own Python or TypeScript code.

Full documentation entry points: the Quickstart, Concepts, Python SDK, Java SDK, YAML Workflows, REST API, MCP, A2A, Eval, Enterprise, Observability, CLI, Deployment, and other sections on jamjet.dev.

Applicable Scenarios

Applicable when an agent may perform the following operations: call an MCP server or any tool; write to a database; send email or Slack messages; trigger payments or external API calls; access customer data or PII; run for minutes to hours and need to recover from crashes; consume real model budgets at scale; delegate to other agents.

Ecosystem and Limitations

Engram is the agent memory layer in the JamJet ecosystem: JamJet provides persistent execution (recoverable after process crashes), and Engram provides persistent memory (facts are retained across runs and versioned through supersede()), with a temporal knowledge graph, hybrid retrieval, and conflict detection. Engram is released as a Rust crate (also packaged into the Rust runtime), and also provides an MCP server (Docker, GHCR), a standalone Python library, a Python client for the MCP server, and a Spring AI ChatMemoryRepository.

License and pricing: Apache 2.0 license, with no usage restrictions for the runtime, all SDKs, and Engram. There is also an optional managed control plane (app.jamjet.dev) that provides tracing, approval queues, audit retention, and team projects; pricing and specific billing plans are not yet provided.

Officially, no further limitation explanations beyond specific performance data are currently provided in the materials; the benchmark comparison for the Java native runtime only mentions being 8.9 times faster than calling the REST sidecar, with links to the benchmark and release article.