actiongate-jev

Gateway that checks agent tool calls with policy plus Jev evidence, then binds approval to a single-use permit for that exact action.

MCP serverbetaApache-2.0

View on GitHub ↗

Overview

ActionGate is a runtime security gateway for AI agents that sits between a proposed tool call and its execution. Schema validation proves a call is well-formed but not that it matches what the user asked; ActionGate checks that, for example catching a refund aimed at the wrong transaction, and then binds approval to that exact action with a permit that is refused if it expires, changes or is replayed.

Jev supplies evidence, called directly through TypeSafe or via OpenRouter, with an experimental NVIDIA Nemotron option. ActionGate itself creates and enforces the permit, and a model score never overrides an RBAC, schema, limit or duplicate failure. It exposes MCP and HTTP enforcement, a dashboard and a simulator, and starts with a deterministic fake provider so no key is needed to try it. The README labels it an early public release with no external security review yet.

What the decision model decides

Type	Question	Answers
Yes / no	Does the proposed tool call match what the user asked for?(inferred)	yes · no

How it works

Agent proposes a tool call
Deterministic policy checks RBAC, schema, limits and duplicates
Jev scores whether the call matches the user's request
If approved, issue a single-use permit bound to the exact action
Executor consumes the permit; expired, changed or replayed permits are refused

Strengths

Model evidence can never override hard policy failures
Exact-action permits prevent replay and swap attacks
Runs with a fake provider for evaluation without keys

Caveats

Early release; no external security review yet
Use mock or sandbox tools while evaluating

Getting started

git clone https://github.com/omkarghugarkar007/actiongate-jev.git && cd actiongate-jev && corepack enable && cp .env.example .env && pnpm install && pnpm dev

At a glance

Type: MCP server
Status: beta
Language: TypeScript
Runtime: Node service, MCP server, Python SDK
Has code: yes
License: Apache-2.0

Use cases and integrations

Verification & Guardrails272

How curated lists describe it

Open-source Jev tool-calling authorization gateway for AI agents: deterministic policy, exact-action single-use permits, MCP and HTTP enforcement.
logicrw/awesome-jev-projects
Runtime authorization and guardrails for AI-agent tool calls with deterministic policy and TypeSafe Jev via OpenRouter.
hellogumbo/awesome-jev

Frequently asked questions

What does Jev decide?

Whether a proposed tool call matches the user's request; it provides evidence while ActionGate issues and enforces the permit.

Can a high model score bypass policy?

No, the README states a model score never overrides RBAC, schema, limit or duplicate failures.

Do I need a key to try it?

No, it starts with a deterministic fake provider.

Related projects

PermitMCP
Execution-control layer for MCP agents: deterministic policy, Jev decisions, human approval and one-use execution permits.
MCP serverprototypePython
jev-mcp
MCP server giving any agent Jev's classify, score, yes/no check and allow/confirm/block gating of risky tool calls.
MCP serverbetaJavaScript
jev-zig-cli
Auditable Zig terminal agent pairing Codex for coding with Jev typed preflight and postflight checks under deterministic policy gates.
CLIproductionZig
Agent Chaperone
MCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScript
agent-guardrail-jev
Xano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScript
approval-judge-bridge
OpenAI-compatible endpoint that answers an agent's command-approval call with APPROVE, DENY or ESCALATE from a Jev Choice, failing closed.
ProxybetaPython