**Reflex is an open-source pre-execution risk gate and prompt injection guard for AI coding agents such as Claude Code, Codex CLI, opencode and pi.** It hooks into each agent (Claude Code hooks, Codex hooks, pi and oh-my-pi extensions, an opencode plugin, Hermes hooks) and decides for every shell command the agent wants to run whether it runs, needs a human's approval, or is blocked. It also scans what the agent reads (web pages, MCP results, files from other projects, `curl` output) for prompt injection before the agent acts on it.

Reflex starts locally with deterministic rules and no account. For commands the rules do not cover, it can ask [TypeSafe Jev](https://docs.typesafe.ai), a small System One model that answers typed questions in well under a second, and turn the answers into a decision with a policy file you can edit. [Laya](https://huggingface.co/convaiinnovations/laya) is an experimental local alternative to Jev. An autonomous profile adds a stronger model (System 2) and an asynchronous human approval queue, so autonomous coding agents only stop for the commands that need a person.

In one minute

• What it is: a hook, installed with one command, that gates the shell tool of Claude Code, Codex CLI, pi, oh-my-pi, opencode and Hermes. MIT licensed, Node.js 18+, no runtime depende