jev-permission-gate
Claude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
Overview
jev-permission-gate is a Claude Code mod that puts TypeSafe's Jev in front of the auto mode classifier. For each tool call that would go to the built-in classifier, Jev answers eight yes/no questions in one request. The mod allows the call when it plausibly serves the user's request (at least 50%) and every risk check is at or below 10%; denies it when some risk check is at least 80% and serving the request is at most 30%; and defers everything else to the built-in classifier unchanged.
A shell-aware prefilter parses commands like a shell (quotes, substitutions, heredocs, wrappers, nested sh -c) so obfuscated forms match the blocklist. Flagged calls can be denied by Jev but never allowed, and calls carrying a secret never leave the machine. On a sealed test split of 5,322 labelled calls, the README reports 1 unsafe allow in 3,664 risky calls (since fixed), 5 wrong denials in 1,699, and 62% of real agent work settled without the built-in classifier. A live measurement showed a median of 164 ms versus 329 ms for calls Jev decides.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this call plausibly serve the user's request? | yes · no |
| Yes / no | Risk checks (for example destruction, exfiltration, privilege escalation) for this call(inferred) | yes · no |
How it works
- Parse the command with a shell-aware prefilter and blocklist
- If not blocked by secrets, send eight yes/no questions to Jev in one request
- Allow if serves-request >= 0.5 and all risks <= 0.1
- Deny if some risk >= 0.8 and serves-request <= 0.3; otherwise defer
Strengths
- Large evaluated corpus with sealed test split
- Blocklist flags can never be waved through
- Secrets never leave the machine
- About twice as fast as the built-in classifier on decided calls
Caveats
- Defers ambiguous calls rather than deciding them
- Thresholds tuned on one corpus
- Live re-measurement of v0.2.0 still pending
At a glance
- Type
- Project
- Status
- beta
- Language
- TypeScript
- Runtime
- Claude Code mod
- Has code
- yes
- Has tests
- yes
Use cases and integrations
How curated lists describe it
A Claude Code mod that uses TypeSafe's Jev to decide auto mode tool calls. 2x faster than the built-in classifier on the calls it decides.
hellogumbo/awesome-jevClaude Code mod that answers auto mode's tool-call question with eight yes/no questions in one request, behind a shell-aware blocklist whose flags Jev can deny but never wave through.
MrJev/awesome-jev
Frequently asked questions
What does Jev decide?
Whether a tool call serves the user's request and whether it trips any of several risk checks.
How safe is it?
The README reports 1 unsafe allow in 3,664 risky test calls, later fixed in the blocklist.
What happens to unclear calls?
They are deferred to Claude Code's built-in classifier unchanged.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonClaude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGoTool-call firewall for Claude Code hooks and MCP servers: Jev answers seven risk questions and code maps them to allow, ask or deny.
MCP serverbetaTypeScriptRing Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
ServicebetaOpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScript