jev-security-scan
Reviews agent skills, MCP configs and source with local static checks plus Jev before install, reporting evidence, risk and coverage gaps.
Overview
Jev Security Scan, documented in Chinese with an English version, reviews Agent Skills, MCP configurations and source code for suspicious behaviour before installation or execution. It looks for prompt injection, hidden behaviour and privilege overreach in skills; tool-description poisoning, credential reads, unexpected exfiltration and dynamic execution in MCP source; launch commands and remote endpoints in MCP configs; install hooks, download-and-execute and unreviewed remote imports; covert persistence and security bypasses; and telemetry, flagged separately as informational.
It reports file and line numbers, redacted evidence, risk categories, model probabilities and what was not scanned. It reads target text only, never executing code, installing dependencies or connecting to MCP servers, and ignores the target's .gitignore. A local mode needs no key or network; a Jev mode sends best-effort-redacted snippets and relative filenames to TypeSafe with a call cap. It uses only the Python standard library, runs with isolated interpreter flags to avoid importing malicious modules from the target, and installs as a skill for Codex and Claude Code. The README stresses it is an aid, not a security certification.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Which risk category does this code or config fragment fall into?(inferred) | — |
| Yes / no | Does this fragment show suspicious behaviour (e.g. exfiltration, injection)?(inferred) | yes · no |
How it works
- Clone the target without submodules
- Run local static checks
- Optionally run Jev mode on redacted snippets with a call cap
- Report findings with file, line, evidence, category and probability
- List coverage gaps
Strengths
- Never executes target code
- Fully offline local mode
- Hardened against malicious target modules
- Works as an agent skill
Caveats
- Not a security certification; absence of findings is not proof
- Jev mode sends redacted snippets externally
- Windows not fully validated
Getting started
git clone https://github.com/win4r/jev-security-scan.git, then python3 -I -B scripts/scan.py /absolute/path/to/target --mode localAt a glance
- Type
- MCP server
- Status
- beta
- Language
- Python
- Runtime
- CLI and agent skill
- Has code
- yes
- Has tests
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Reviews Agent Skills and MCP configurations and source code with local static checks and TypeSafe Jev before installation or execution, reporting file and line evidence, risk categories, model probabilities, and coverage gaps.
logicrw/awesome-jev-projects
Frequently asked questions
Does it run the code it scans?
No. It only reads text and never installs or connects to anything.
Can I use it offline?
Yes, in local mode with no key or network.
Is a clean report a guarantee?
No. The README says no findings does not mean no malicious code.
Related projects
Cisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Agent skillproductionPythonDrop-in proxy for Playwright MCP that adds Jev page triage, prompt-injection masking, snapshot pruning and risky-action gating.
MCP serverbetaTypeScriptSemantic MCP firewall that screens tool calls, results and descriptions with Jev, plus allowlists and session taint tracking.
MCP serverbetaTypeScriptStarter kit that gates every MCP tool call with Kinde identity checks plus Jev risk signals, then allows, holds for approval or stops it.
MCP serverbetaTypeScriptLocal-first MCP server that returns only Jev-checked passages from big PDFs, Word files and spreadsheets, with exact row calculations.
MCP serverbetaTypeScriptZero-dependency HTTP traffic and bot defense gate that can escalate requests to Jev for five typed risk questions.
ProjectbetaTypeScript, Python