Skip to content
Metatext Decide — typed decisions for your agents, with a probability on every answerGet early access
Metatext
Sign Up

jev-firewall

PreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.

Hookbeta
View on GitHub ↗

Overview

jev-firewall sits between AI coding agents and the machine as a PreToolUse hook for Claude Code and Codex. Every tool call (shell commands, file reads, network access) is checked by a deterministic, shell-aware rules engine, and actions the rules do not match go to Jev, which answers exactly one of allow, ask or block with calibrated confidence. Confident answers act immediately and uncertain ones go to a human. List summaries note it fails closed.

One core serves both agents through thin adapters that translate payloads and decision vocabulary. A setup wizard asks whether the key is TypeSafe direct or Vercel AI Gateway and validates it with one live call. The README compares the firewall with auto mode and sandboxing, documents design principles, a hook contract, configuration, an audit log, security notes and known limitations, and includes a short walkthrough of a prompt-injected agent attempting exfiltration.

What the decision model decides

TypeQuestionAnswers
ChoiceShould this agent tool call be allowed, asked or blocked?allow · ask · block

How it works

  1. Agent fires a PreToolUse hook
  2. Shell-aware rules decide clear cases
  3. Unmatched actions go to Jev for allow, ask or block
  4. Act on confident answers; route uncertain ones to the user; log to audit

Strengths

  • Works for both Claude Code and Codex
  • Deterministic rules before any model call
  • Audit log of decisions

Caveats

  • Requires a Jev key via TypeSafe or Vercel
  • Known limitations documented in the README

Getting started

`npm install -g jev-firewall` then `jev-firewall setup`.

At a glance

Type
Hook
Status
beta
Language
TypeScript
Runtime
Claude Code / Codex PreToolUse hook (Node CLI)
Has code
yes

Use cases and integrations

How curated lists describe it

  • Real-time firewall for AI coding agents: a PreToolUse hook checks every Claude Code / Codex tool call with deterministic shell-aware rules, and unmatched actions go to Jev for a calibrated allow/ask/block that fails closed.

    hellogumbo/awesome-jev

Frequently asked questions

What does Jev decide?

Whether an unmatched tool call should be allowed, asked or blocked.

Which agents are supported?

Claude Code and Codex through PreToolUse hooks.

What happens if Jev is unavailable?

List summaries say it fails closed.

Related projects

  • jev-axi

    Agent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.

    PluginbetaTypeScript
  • jev-guard (leepokai)

    Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.

    LibrarybetaTypeScript
  • reflex (ursuciprian)

    Pre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.

    ProjectbetaJavaScript
  • Agent Chaperone

    MCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.

    MCP serverbetaTypeScript
  • agent-guardrail-jev

    Xano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.

    ProjectbetaXanoScript
  • construct-auto-classifier

    Effect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.

    ProjectbetaTypeScript