Reflexes
◆ Steerable safety for AI agents

Runtime policy checks that make
your AI agent behave.

Reflexes is an open safety harness for AI agents. Write the rules your agent must follow in plain English; it checks every action at inference time — and when the agent crosses a line, it reads the policy and corrects itself.

Quickstart

Tell your agent to install Reflexes

Install the reflexes skill from github.com/zentropi-ai/reflexes then wire it into this agent.

Paste it into Claude Code, Codex, or any coding agent.

How it works

Plain-English policies

Write the rules your agent must follow in natural language. No DSL, no schema to learn.

Checked in real time

Every hook point is evaluated in-loop — sub-second, in parallel across policies.

Self-correction, not just blocking

On a violation the agent receives the policy text and fixes its own next step.

Watch it catch — and self-correct

A starter policy in action: unconfirmed-permanent-deletion

agent session
You
my repo's gotten huge — clean out the stuff we don't need.
Agent
On it — I'll clear the build output and the old data dumps. ▸ Bash  rm -rf ./dist ./db-backups
⛔ Reflexes blocked the tool call before_tool_call · deny ./dist is regenerable, but ./db-backups is not — and the user asked to clean up vaguely, never confirming deletion of that directory. Don't permanently delete unconfirmed, non-regenerable data.
Agent
Good catch — I shouldn't have lumped those together. I cleared ./dist (safe to regenerate), but I left ./db-backups alone: those aren't recoverable and you didn't explicitly OK removing them. Want me to delete them, or move them to .trash/ first?

No key phrases, no regexes — the policy is plain English, and the agent gets the policy text back so it can fix its own next step.

Your rules, in plain English

Reflexes checks whatever matters to you — a policy is just a sentence or two.

unconfirmed-permanent-deletiondeny
A tool call that permanently deletes files the user never confirmed.
unsourced-claimflag
A response that states a specific fact as settled without citing a source.
timeline-commitmentdeny
An outbound message promising a delivery date the team hasn't agreed to.
hardcoded-secretdeny
Code that embeds an API key, token, or password directly in the source.
pii-in-logsflag
A log line or error message that contains a customer's name, email, or PII.
off-task-changeflag
An edit that goes well beyond what the user actually asked for.
history-rewrite-on-maindeny
A command that force-pushes or rewrites history on the main branch.
sensitive-adviceflag
A reply that gives legal, medical, or financial advice.
unconfirmed-outbound-messagedeny
Sending an email or message on the user's behalf without an OK.

An open framework — not a black box

Open source, and built to stay portable — bring your own agent, and your own model.

Works with most agents
Claude CodeCodexHermesOpenClawLangGraphOpenAI Agents SDKGoogle ADK+ more
Pick any evaluator model
Zentropi CoPEOpenAIAnthropicGeminiLocal (Ollama, vLLM)+ more