open-jev-approvals
Claude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
Overview
open-jev-approvals is an approval gate for Claude Code (the list summary also mentions Codex) aimed at setups using third-party APIs that cannot use the harness's own auto-approval. A PreToolUse hook intercepts each tool call, sends Jev the current-turn user messages, the redacted tool input and any verified facts, and asks a fixed set of questions about risk, authorization, hazards and scope. A versioned local policy turns those answers into a binary allow or deny.
Denies need positive evidence: confirmed (at least 0.70) constraint violations, malicious instructions, persistent security weakening or unauthorised sensitive egress are denied; if Jev cannot answer, the call is allowed. A UserPromptSubmit hook records prompts as authorization evidence. Keys are read only from a user-level env file, so a checked-out repo cannot redirect the endpoint or steal the key. Prompts and payloads are redacted before going to Jev or disk, and decisions are stored in SQLite. It is written in Go for macOS and Linux.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this action violate a stated constraint? | yes · no |
| Yes / no | Did the user authorize this action? | yes · no |
| Yes / no | Does this action send sensitive data out without authorization? | yes · no |
How it works
- Record the user's prompt as authorization evidence.
- Intercept a tool call and redact its payload.
- Ask Jev the fixed risk, authorization, hazard and scope questions.
- Local policy denies on confirmed (>= 0.70) violations; otherwise allows.
Strengths
- Keys cannot be redirected by repo files.
- Redaction before data leaves the machine.
- Local, versioned policy keeps the final verdict.
Caveats
- Fails open when Jev cannot answer.
- macOS and Linux only in the first release.
Getting started
go build -o bin/jev-approve ./cmd/jev-approve && bin/jev-approve install --harness claude-code --project /path/to/repo --binary "$(pwd)/bin/jev-approve"At a glance
- Type
- Project
- Status
- beta
- Language
- Go
- Runtime
- Claude Code hooks, CLI
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Binary approval gate for Codex and Claude Code — every intercepted tool call is reviewed by TypeSafe JEV and composed through a versioned local policy, with scoped authorization.
logicrw/awesome-jev-projects
Frequently asked questions
Who makes the final decision?
A local policy, using Jev's answers as evidence.
What if Jev is unavailable?
The call is allowed; a deny requires positive evidence of danger.
Where does it read the API key?
Only from a user-level env file, never from a project .env.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScriptClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonTool-call firewall for Claude Code hooks and MCP servers: Jev answers seven risk questions and code maps them to allow, ask or deny.
MCP serverbetaTypeScriptRing Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
ServicebetaOpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScript