construct-auto-classifier
Effect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
Overview
construct-auto-classifier sits in front of coding assistants' shell tools (run_command in Google Antigravity, bash in OpenCode, and external harnesses) and decides whether a proposed command can run automatically, needs the agent to explain itself, or must go to a human. It judges what a command actually does, its reversibility and blast radius, rather than matching keywords like sudo.
Sub-millisecond rules fast-deny catastrophic commands and fast-allow plain reads and safe git operations; everything else goes to a model. With the default Jev provider, the command and any script it runs are the state and twelve questions are asked in one call: an allow/deny choice and eleven yes/no risks such as exfiltration, secret in output, lockout and prompt injection. A command passes only if allow is confident enough and every risk stays under threshold; missing, low-confidence or failed answers deny. The README reports Jev as the only model certified at zero dangerous commands allowed across 1,300 decisions, at $0.112 per 1,000.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this command be allowed or denied? | allow · deny |
| Yes / no | Does this command risk exfiltration (and ten other harms such as data_destruction, lockout, prompt_injection)? | yes · no |
How it works
- Intercept the agent's proposed shell command
- Apply fast-deny and fast-allow structural rules
- Send remaining commands to Jev with the allow/deny choice and eleven risk questions
- Allow only if p(allow) clears 0.6 and all risks are below 0.7; otherwise deny or escalate
Strengths
- README reports zero dangerous commands allowed in certification with Jev
- Low cost per decision reported versus chat LLMs
- Fails closed on missing or low-confidence answers
- Can swap to any OpenAI-compatible chat model
Caveats
- Certification sets were partly developed alongside the gate
- Requires a TypeSafe key for the default provider
- Does not judge code executed by allowed test runners
Getting started
Configure llm.provider as "jev" (default) and set TYPESAFE_API_KEY, then install the harness adapter for Antigravity or OpenCode.At a glance
- Type
- Project
- Status
- beta
- Language
- TypeScript
- Runtime
- agent hook / plugin
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
Effect-based safety gate for AI coding agents' shell commands (OpenCode, Antigravity): fast structural rules, then TypeSafe's Jev or a chat model judges what a command does. Certified with Jev at zero dangerous commands allowed.
hellogumbo/awesome-jev
Frequently asked questions
What does it decide?
Whether an agent's shell command is allowed, plus eleven independent risk flags, before it runs.
How does it compare with chat LLMs?
Its README certification table reports Jev at zero dangerous commands allowed, while the tested chat models allowed between 3 and 73.
Can I use it without Jev?
Yes, set llm.provider to openai to use a chat model on any compatible endpoint.
Related projects
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptPre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptXano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScriptDeepSeek Harness plugin where Jev classifies risk, irreversibility, task fit and injection for every tool call before it runs.
PluginbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScript