jev-shield
Semantic MCP firewall that screens tool calls, results and descriptions with Jev, plus allowlists and session taint tracking.
Overview
jev-shield sits between any MCP client and any stdio MCP server and screens every tool call, tool result and tool description using Jev through the Vercel AI Gateway. Its argument is that existing MCP security proxies are deterministic or pattern-based and miss paraphrased attacks, while Jev judges meaning and returns probabilities so your own policy decides what to do.
It layers three controls: structural rules such as recipient allowlists, free; a semantic layer with one Jev call per event checking exfiltration, destructive actions, injection in arguments, credential sensitivity, injected or secret-bearing results and poisoned tool descriptions; and session taint tracking that escalates policy after a flagged result. The bundled demo runs a deliberately vulnerable server and shows poisoned descriptions flagged, injected search results and leaked secrets redacted, and exfiltration and destructive calls blocked while a legitimate email passes. The README reports 10 verifications costing $0.0003 total with a median latency of 558 ms, and the list summary cites 94% block recall with zero false positives. Every event is written to a JSONL audit trail.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this tool call attempt data exfiltration? | yes · no |
| Yes / no | Does this tool result contain injected instructions? | yes · no |
| Yes / no | Is this tool description poisoned? | yes · no |
| Score | How severe is this action? | — |
How it works
- Point the MCP client at jev-shield wrapping the real server
- Scan tool descriptions on tools/list
- Apply structural rules and Jev checks on each call
- Screen results and redact injections or secrets
- Escalate policy after flagged results and log to JSONL
Strengths
- Catches paraphrased attacks by meaning
- Policy decides thresholds, not the vendor
- Transparent drop-in for stdio servers
- Audit trail with cost and latency
Caveats
- About 500 ms added per screened event
- Stdio servers only
- Recall and false-positive figures come from its own demo
Getting started
AI_GATEWAY_API_KEY=<key> npx jev-shield -- node path/to/server.jsAt a glance
- Type
- MCP server
- Status
- beta
- Language
- TypeScript
- Runtime
- Node MCP proxy (stdio)
- Has code
- yes
Use cases and integrations
How curated lists describe it
Semantic MCP firewall powered by Jev — screens every tool call, tool result, and tool description with calibrated System One verification. 94% block recall, 0 false positives, ~$0.00002/check.
hellogumbo/awesome-jev
Frequently asked questions
What does Jev decide?
Whether calls exfiltrate data or are destructive, whether results carry injections or secrets, and whether tool descriptions are poisoned.
How does it fit into my setup?
Point your MCP client's command at jev-shield wrapping the real server; everything else is transparent.
What does it cost?
The bundled demo ran 10 verifications for $0.0003 with a median latency of 558 ms.
Related projects
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScriptPre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptLarge catalog of Claude Code agents, commands, hooks and MCPs, listed with community Jev mods for guardrails and subagent models.
CLIproductionJavaScriptEffect-based safety gate for coding-agent shell commands: fast rules first, then Jev decides allow/deny plus eleven risk checks.
ProjectbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScript