jev-agent-authorization
Starter kit that gates every MCP tool call with Kinde identity checks plus Jev risk signals, then allows, holds for approval or stops it.
Overview
Jev Gatehouse is a Kinde starter kit for authorizing AI agent tool calls. An agent calls a small workspace API through a Kinde MCP connection, and a guard in front of the API verifies the Kinde access token, reads the user's permissions and feature flags, denies calls that lack a permission, and allows permitted reads. Every other call goes to Jev with the user's request, the tool call and the documents the agent read.
Jev returns calibrated signals in about 200 ms: does the call match the request, is it destructive, does it follow planted text, does it send data out, and how risky is it. Policy code decides to allow, hold for user approval or stop; low-confidence calls go to an LLM judge. The decision is written to a ledger before anything runs, and a failed write blocks the call. Held calls wait 10 minutes for approval behind a fresh sign-in. The app has a live ledger, an agent console, an attack playground with scripted planted-instruction attacks, a 300-call labelled benchmark comparing three decision methods, and a connect page for Cursor and other MCP clients.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this tool call match the user's request? | yes · no |
| Yes / no | Is this call destructive? | yes · no |
| Yes / no | Does this call follow planted instructions from a document? | yes · no |
| Score | How risky is this call? | — |
How it works
- Verify the Kinde token and read permissions and flags
- Deny missing permissions; allow permitted reads
- Send other calls to Jev for match, destructive, injection, exfiltration and risk signals
- Policy code allows, holds for approval or stops; unsure calls go to an LLM judge
- Write to ledger before execution
Strengths
- Identity and permission checks combined with semantic risk signals
- Ledger-first design: no record, no execution
- Attack playground and labelled benchmark included
- Live demo available
Caveats
- Tied to Kinde for identity
- Starter kit; policies need adapting to real APIs
Getting started
Try the live demo at https://jev-gatehouse.vercel.app, then follow the README to deploy with Kinde and Convex.At a glance
- Type
- MCP server
- Status
- beta
- Language
- TypeScript
- Runtime
- web app with MCP server (Convex)
- Has code
- yes
Use cases and integrations
How curated lists describe it
Jev agent authorization for MCP tool calls: Kinde identity and permissions plus Jev's typed, calibrated decisions, checked server-side before every call runs.
hellogumbo/awesome-jev
Frequently asked questions
What does Jev decide in Gatehouse?
Signals about each tool call: matches the request, destructive, follows planted text, sends data out, and risk level.
Who makes the final decision?
Policy code in the app, with an LLM judge for low-confidence calls and user approval for held ones.
What if logging fails?
The call does not run; decisions are written to the ledger first.
Related projects
Cisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Agent skillproductionPythonSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptDrop-in proxy for Playwright MCP that adds Jev page triage, prompt-injection masking, snapshot pruning and risky-action gating.
MCP serverbetaTypeScriptZero-dependency Python MCP server where Jev gates shell commands, audits patches and resolves decisions, with SQLite caching.
MCP serverbetaPythonBun-based MCP server wrapping Jev with compact answers and a code-computed act, review or abstain verdict.
MCP serverbetaTypeScriptx402 pre-payment risk-check provider combining sanctions lists, phishing feeds and simulation with Jev checks for injected instructions.
Projectproduction