jev-auto-approve
Claude Code PreToolUse hook that auto-approves shell commands Jev is confident are read-only, and otherwise shows the normal prompt.
Overview
jev-auto-approve is a Claude Code hook that stops you clicking yes on commands like git status. For each Bash command it asks Jev a single Noul about whether the command is strictly read-only, and auto-approves at a probability of 0.95 or more. It is fail-safe by design: it can only allow or stay silent, never deny, and silence shows Claude Code's normal permission prompt.
Commands such as rm, git push, curl, installs, redirects and sudo are never sent to Jev, nor are commands containing comments or approve-style text (a prompt-injection guard); plan mode, bypass mode, non-Bash tools and multi-line commands are skipped, and outages, slowness over 3 s or a missing key fall back to the prompt. On 16 commands with jev-1.13.0, the README reports 0 of 8 state-changing commands approved (all scored 0.01-0.03) and 6 of 8 read-only commands auto-approved, with git status (0.82) and python --version (0.90) still prompting. It recommends running a dry mode with logging for a day first.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this shell command strictly read-only? | yes · no |
How it works
- Claude Code proposes a Bash command
- Local hard-no list and injection filter screen it
- Jev scores read-only probability
- Auto-approve at >= 0.95; otherwise show the normal prompt
Strengths
- Can never deny or approve risky commands on a guess
- Wide gap between safe and unsafe scores in the published test
- Dry-run mode for building trust
Caveats
- Small calibration set (16 commands)
- Some read-only commands still prompt
Getting started
Set TYPESAFE_API_KEY and add a PreToolUse hook for Bash running `python /path/to/jev_auto_approve.py` in ~/.claude/settings.json; start with JEV_AUTO_APPROVE_DRY=1.At a glance
- Type
- Hook
- Status
- beta
- Language
- Python
- Runtime
- Claude Code hook
- Has code
- yes
Use cases and integrations
How curated lists describe it
Coding agents: Claude Code PreToolUse hook that asks Jev a `Noul` on whether a shell command is strictly read-only, auto-approving at 0.95 and otherwise falling back to the normal permission prompt without ever denying, while a local hard-no list and injection filter keep risky commands from reaching Jev; 0 of 8 state-changing commands were approved in its published calibration.
yibie/awesome-jevClaude Code PreToolUse hook: one Jev Noul per Bash command on whether it is strictly read-only; auto-approves at p ≥ 0.95, otherwise falls back to the normal permission prompt and never denies. A local hard-no list and injection filter keep risky commands away from Jev; 0 of 8 state-changing commands approved in its published calibration
AnotiaWang/awesome-decision-models
Frequently asked questions
Can the hook block commands?
No. It only approves confident read-only commands or stays silent.
Are dangerous commands sent to Jev?
No, a local hard-no list keeps them away and they always prompt.
How was it calibrated?
On 16 commands: 0 of 8 state-changing approved, 6 of 8 read-only approved.
Related projects
Claude Code plugin adding typed Jev decisions to hooks: task kind, command risk, failure class, completion; never grants permissions.
PluginbetaJavaScriptStrict-allowlist shell harness where Jev walks a TOML decision tree to pick a bash command, flags and paths, confirming writes.
ProjectprototypePythonOn-device Android agent that taps any app, with an allow/confirm/block safety gate optionally backed by Jev or Laya.
ServiceprototypeKotlinAI decision reliability control plane that evaluates autonomous agent actions with Jev before they run.
ProjectClaude Code plugin adding Jev judgments to Bash, Write and Edit calls and their outputs; a semantic guardrail, not a sandbox.
PluginbetaLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScript