stas4000

Openbles Firewall — AI skill for Claude Code

AI community

OpenBles Firewall 1: an open 31.8 MB decision model that catches prompt injection in what an AI agent reads (web pages, tool and MCP results).

How to install Openbles Firewall

This entry records only its repository, not the path inside it, so there is no exact command to give. Open stas4000/openbles-firewall and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Openbles Firewall does

OpenBles Firewall 1: an open 31.8 MB decision model that catches prompt injection in what an AI agent reads (web pages, tool and MCP results). Open weights, MIT. Measured on public held-out sets.

Alternatives in AI

UltraCode Shim — Give Claude Code's ultracode mode to ANY model you already pay for 422 ★
SoloDawn — Catches and repairs AI hallucinations before delivery: three quality gates, 31 built-in rules, a self-healing 312 ★
Engram — The context spine that 10x's every AI coding session 141 ★

README

OpenBles Firewall 1

A new open decision model that works as a prompt injection firewall for AI agents. It reads the text an agent is about to read (a web page, a tool or MCP result, an email, a file) and answers one question: is this text trying to give the agent orders?

Open weights, in this repo: model/ holds the 31.8 MB adapter, the loader, and the training and eval scripts. MIT.
On Hugging Face: openbles/firewall-1, the same weights with a model card and a loader that pulls them from the hub.
Runs offline: about 33 ms per text on a laptop, no API key.
Measured on public held-out texts: 119 of 120 attacks on agents caught with 0 clean texts flagged (F1 0.996), 55 of 60 classic injections caught (F1 0.940).
Trained on public human-labelled data only, 8 minutes on a MacBook. Base model: fastino/GLiNER2.5-Decide (Apache-2.0).

from model.load_guard import load            # pip install gliner2 safetensors
m = load("model")
m.classify_text(text, {"injection": {"labels": ["injection", "benign"]}})

The repo also ships the full guard around the model: rules for hidden text, a Claude Code hook that withholds a poisoned tool result and blocks its source, and an optional hosted backend (Jev) scored on the same sets below.

OpenBles is the name of everything Bles Software releases in the open. How the names work: [docs/NAMING.md](docs/NAMING.md). This repo was called `jev-injection-guard` until 9 Oct 2026; old links redirect.

Measured

Two public labeled sets, held out: the rules were written against the train splits only and these numbers are from the test splits. Run on 2026-10-02 with `jev-1.13.0`. Everything below is in `data/eval.json`.

**Agent attacks** ([3nesdeniz/agentic-prompt-injection-boundary-pairs](https://huggingface.co/datasets/3nesdeniz/agentic-prompt-injection-boundary-pairs), test split, 240 texts: 120 atta