jev-guard (leepokai)
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
Overview
jev-guard by leepokai is a security hook for coding agents modelled on Claude Code's auto mode, where a separate classifier reviews actions before they run. It asks Jev three typed questions about each tool call: how risky it is, whether the user requested it, and whether it is driven by untrusted content. The result maps to allow, ask or deny, and tool results are also scanned for prompt injection.
It brings this to Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP editors with the same policy and session memory everywhere, or acts as a second opinion inside Claude Code. The README sources its price estimate (about $0.00004 per tool call) from the Vercel model card and reports measured latency of about 0.75 s direct and 580 ms median via AI Gateway over a 21-call calibration run. The policy fits in about twenty lines of readable code.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Score | How risky is this tool call? | — |
| Yes / no | Did the user request this action? | — |
| Yes / no | Is this action driven by untrusted content? | — |
How it works
- Hook intercepts a tool call with session context
- Ask Jev risk, user_requested and from_untrusted
- Policy maps answers to allow, ask or deny
- Scan tool results for injection
Strengths
- Auto-mode-style protection across many agents
- Shared session memory and policy
- Small readable policy
Caveats
- Calibration run is small (21 calls)
- Requires a Jev key via TypeSafe or Vercel
At a glance
- Type
- Library
- Status
- beta
- Language
- TypeScript
- Runtime
- Agent hook library
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Agent security: prompt-injection and dangerous-action guard for Claude Code, Codex, Pi, and ACP agents, with Jev deciding what to block.
yibie/awesome-jevTool-call checks for coding Agents that assess operation risk, user intent and prompt-injection signals.
logicrw/awesome-jev-projectsCross-agent tool-call risk scoring with allow, ask, and deny outcomes.
cobanov/awesome-jevPrompt-injection and dangerous-action guard for coding agents (Claude Code, Codex, pi, ACP), powered by Jev.
hellogumbo/awesome-jevRisk-scores every tool call against session context into deny, ask, or allow, and flags prompt injection in tool results.
MrJev/awesome-jev
Frequently asked questions
What does Jev decide?
Risk of a tool call, whether the user asked for it, and whether untrusted content drove it.
Which agents does it support?
Codex, Copilot, Gemini, Cursor, pi, OpenCode, ACP editors, and Claude Code as a second opinion.
What does it cost?
About $0.00004 per tool call, per the README's sourced estimate.
Related projects
Pre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptCompiler that turns agent rules in CLAUDE.md and similar files into testable Jev programs: typed questions plus a coded verdict.
ProjectbetaTypeScript