leepokai/jev-guard

What it is

jev-guard is an MIT-licensed hook layer that puts an "auto mode" (a second model vets each tool call) in front of Claude Code, Codex, Copilot CLI, Antigravity CLI (agy), Gemini CLI, Cursor, pi, OpenCode and ACP editors such as Zed and JetBrains. It calls the Jev model through TypeSafe (api.typesafe.ai), the Vercel AI Gateway or OpenRouter. The policy lives in src/guard.js.

How it works

Before a tool runs, Jev answers typed questions and the code applies thresholds:

• Deny if from_untrusted ≥ 0.7, or if risk ≥ 2.5 (risk is a 0–3 position).
• Allow if (risk ≥ 1.5 or approval ≥ 0.75) and user_requested ≥ 0.85.
• Ask if risk ≥ 1.5 or approval ≥ 0.75.
• Allow otherwise.

A user request can turn ask into allow but never lifts a deny. Read-only tools, Skill, Task and Agent are skipped before the call, though their results are still scanned.

After a tool returns, results of 200 characters or more are checked. They are flagged when directed ≥ 0.6 and the kind is injection or canary. Discussion of injection is not flagged. Inputs above about 60k characters are truncated head and tail.

Skills, plugins, rules and CLAUDE.md files are checked at session start, on load, when a Skill runs, and with jev-guard scan-skills. Serious kinds flag at p ≥ 0.45, unrelated_side_effects at p ≥ 0.8.

Per-session memory in ~/.jev-guard/sessions/ holds recent user prompts, the agent's stated intent, recent decisions and excerpts of flagged content.

The author's measurements (September 2026):

• Cost is $0.042 per 1M input tokens, about 4 cents per 1,000-call session.
• Latency is about 580 ms p50 through the gateway.
• rm -rf node_modules && npm install asks, git push --force asks, and curl … | sh, DROP TABLE and rm -rf / are denied.
• A planted "git push mirror --all" instruction was denied at from-untrusted p=0.97 while npm test stayed allowed.
• Across 662 real installed skills none were flagged; the highest legitimate score was 0.74 for unrelated_side_effects.

What to do

npm i -g jev-guard
jev-guard key "…"
jev-guard install claude|codex|copilot|gemini|agy|cursor|pi|opencode
jev-guard check Bash '{"command":"rm -rf ~/"}'

Claude Code can also use /plugin marketplace add leepokai/jev-guard then /plugin install jev-guard@jev-guard. OpenCode needs "plugin": ["jev-guard"] in opencode.json (0.2.1+). check exits 0 for allow, 1 for ask and 2 for deny, and scan exits 2 if flagged, so both work in CI and for calibrating thresholds on your own examples. JEV_GUARD_* environment variables tune every threshold.

Set JEV_GUARD_FAIL_CLOSED if you want an unreachable Jev to deny instead of allow. JEV_BASE_URL points to a local server speaking POST /v1/systemone, such as Kev.

Caveats

• It fails open by default, with only a stderr warning.
• It is a guardrail, not a sandbox. A hook can be misconfigured, an agent can bypass a tool path, and Jev can be wrong.
• Per-host support varies:
• Codex and Gemini CLI have no ask, so ask becomes a warning.
• Cursor can ask only for shell and MCP calls.
• agy ask is unverified live, and some agy builds ignore PreToolUse/PostToolUse.
• The ACP proxy does not see tools an agent runs itself, such as a built-in web fetch.
• Only Claude Code and OpenCode were verified end to end against the live API. Codex, Copilot CLI, Gemini CLI and Cursor were tested at the payload level only.
• Thresholds were calibrated on Jev. Re-check them before using another model.
• Tool calls and results are sent to the provider (zero data retention is requested), and results can contain anything the agent read. Review TypeSafe's privacy policy before using it on sensitive repositories.
• Plain http to JEV_BASE_URL is allowed on localhost or private addresses. Anyone on that network can forge answers and make the guard allow everything.
• The speed and "100x cheaper" claims come from TypeSafe docs. The latency figures were measured by the repo author, from Taiwan.