opencode-jev-guard
OpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
Overview
jev-guard is an OpenCode 2 plugin that sends every shell command the agent wants to run to Jev first, including commands run on remote hosts through FarHand's farhand_remote_shell MCP tool (whose command it takes from the execute.before hook, since MCP permission requests carry no arguments). Jev answers six typed questions: an overall run or confirm verdict, and risks for leaving files outside the project, global installs, global config changes, harmful actions and privacy exposure.
A command is treated as safe only if the verdict is run with enough confidence and every risk is below threshold; then your normal OpenCode permission config applies. Anything else gets OpenCode's permission prompt with Jev's reasons, plus a transcript note because OpenCode 2.0.14's prompt cannot show reasons. If Jev is unreachable or no key is set, the command asks. The guard only adds prompts and never turns a prompt into an allow. Categories can be tuned or extended per user or project.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | verdict: is this ordinary work inside the project? | run · confirm |
| Yes / no | Does it install software globally? | yes · no |
| Yes / no | May it do damage (data loss, force-push, sudo)? | yes · no |
| Yes / no | May it expose private data? | yes · no |
How it works
- Capture the command (and cwd) before execution.
- Ask Jev the six questions.
- Safe only if verdict run with confidence and all risks below threshold.
- Otherwise show a permission prompt with Jev's reasons.
Strengths
- Only adds prompts; never weakens existing permissions.
- Covers remote commands via FarHand.
- Customisable risk categories.
Caveats
- Prompt preselects Allow once, so a stray Enter approves.
- Sends commands to TypeSafe.
At a glance
- Type
- MCP server
- Status
- beta
- Language
- TypeScript
- Runtime
- OpenCode 2 plugin
- Has code
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
When FarHand is active, the agent's commands run on a remote host through the \`farhand\_remote\_shell\` MCP tool instead of \`shell\`. OpenCode's permission request for an MCP tool carries no arguments, so the plugin takes the command (and its \`cwd\`) from the \`execute.before\` hook, which OpenCode runs first.
logicrw/awesome-jev-projects
Frequently asked questions
What does Jev check?
Whether a command is ordinary project work and whether it litters the host, installs globally, changes global config, is harmful or exposes private data.
What if Jev is down?
The command asks for permission; it never silently runs.
Can it auto-approve commands?
No, it only adds prompts on top of your existing permission settings.
Related projects
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptClaude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScriptRing Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
ServicebetaClaude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPythonClaude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGoPi extension using Jev as a tool-call gate, a bash output judge and a jev_ask tool, in shadow mode by default and failing open.
PluginbetaTypeScript