mu

How we reviewed this: we built the repository at faed8c3 from source and ran the judgment kernel’s test suite. We then ran mu headless twice in a small project with a planted .env. The working model was qwen/qwen3.7-flash on OpenRouter, and the judge was a stand-in that logged every request and answered in TypeSafe’s published shape. We also ran mu doctor with no keys and no network. We made no Jev calls, so nothing here measures the judge’s accuracy. The README’s measurements are the authors’ own.

What it is

mu is pi, the minimal coding agent, plus what its authors call a judgment kernel. There is also a desktop app built on AionUi. The kernel is 38 named decision points across a turn. Some frame the task when you send a message. Others check a tool call against the task’s constraints, screen web pages and MCP output for instructions aimed at the model, decide chunk by chunk what tool output enters the context, and catch a turn that ends on “let me run the tests next” without doing it.

Each decision point is a few bounded questions about a small state. Each can be active, shadow (asked and logged, changes nothing) or off, and each can name its own judge. A judge can be Jev reached through one of five services, Laya running locally, any chat model, a classifier, or your own /v1/systemone endpoint. Rules come first: a dangerous-looking command is caught before any judge is asked.

What the judge sees

This is the question for any tool that sends your session to a second model. In our first run we asked mu to read .env and src/app.js, run ls -la, and explain the app. The judge received three requests:

decision	what was in the state
task framing (ten questions: side question? needs files changed? plan first? complexity?)	your message
capabilities the task needs	your message
did the turn finish what it promised?	your message and the agent’s final answer

The .env value did not reach the judge. The agent read it, and its answer mentioned that a DATABASE_URL exists without quoting it. Had the answer quoted the value, the turn-end check would have carried it. The second run asked about a 3,000-line build log. The judge got a fourth kind of request: the command the agent chose (grep -i 'error\|fail' build.log, not cat), checked as “needed”, “beyond” what was asked, “unrelated” or “unclear”. The agent never streamed the full log, so the chunk-by-chunk admission path did not run, and we have not tested it.

The judge’s model is jev-latest, and the request shapes are TypeSafe’s.

The free judge

With no key set, mu still works: Jev 1.13 on OpenCode Zen, “free for a limited time”, answers. Your messages, the agent’s commands and its answers therefore go to OpenCode by default, which the docs say does not train on them. This is disclosed well. It is in the Quick start and the Privacy section, mu doctor prints it (“what it judges goes to OpenCode”), and mu repeats it once a day. MU_JUDGE=off turns the kernel off, Laya keeps judging on your machine, and any key you set takes over from the next question. The free default is in the unreleased changes as of this commit, not yet in the npm 0.1.8 release.

One design choice deserves credit. Only your own ~/.mu/agent/mu.json is read for the judge. A repository you clone cannot change the judge, its endpoint or its modes, so it cannot point the model that reads your messages at its own server.

Building it

npm ci and the offline build fail at first with “Model data is missing or stale”. Running npm run hydrate:model-data first fixes it. After that the build succeeded, and the judgment kernel’s suite passed: 989 tests, 17 skipped, across 81 files. Most users will install the mu-agent npm package or the desktop app instead.

Verdict

The most complete attempt we have seen to make a coding agent’s small decisions explicit. Each one is named, has a mode, has a judge you choose, and lands in a ledger you can read. Every decision point can run in shadow mode before it acts, and the endpoint lock against repositories is a real security property. 488 stars; MIT for mu’s own code, Apache-2.0 for pi’s.

Before you start, decide where the judge runs. By default your session’s messages, commands and answers go to a free service on someone else’s terms; one setting keeps them on your machine. For a narrower Jev guardrail around a single coding agent, see pi-warden.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Oct 11, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.