stepwarden
Proof-of-concept Claude Code plugin where Jev checks every pending tool call against the session plan, then allows, asks or blocks.
Overview
stepwarden verifies each agent action before it executes rather than reviewing a run afterwards. For every tool call, it asks Jev five independent questions in parallel against the session plan and recent history: does this action contradict the plan, does it touch a resource outside the declared scope, does it contradict the previous action, should a human look at it regardless, and how consistent is it with the user's stated intent. The argument is that running a frontier model as judge on every call is too slow and expensive, while a decision model makes per-step checking affordable.
Verdicts fall into allow, ask and deny bands set by thresholds. A fresh install runs in audit mode, recording verdicts while letting calls run; /stepwarden enforce turns the gate on, at which point an out-of-scope call might prompt (for example 'touches an out-of-scope resource, p=0.83') or be blocked with the reason returned to the model. An onError setting chooses allow or deny when Jev is unreachable, and a replay of logged traffic shows what thresholds would have done. The README calls it a proof of concept on early-access dependencies with untuned thresholds, not a substitute for deterministic security controls.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this action contradict the plan? | — |
| Yes / no | Does it touch a resource outside the declared scope? | — |
| Yes / no | Should a human look at this regardless? | — |
| Score | How consistent is it with the user's stated intent? | — |
How it works
- Intercept each pending tool call
- Ask Jev five questions against the plan and history
- Map signals to allow, ask or deny by thresholds
- Audit by default; enforce when enabled
Strengths
- Checks every step, not just the end
- Audit mode and replay for tuning
- No build step or dependencies
Caveats
- Proof of concept with untuned thresholds
- Not a substitute for deterministic security controls
- Call details are sent to TypeSafe
Getting started
Install the plugin in Claude Code, enter a TypeSafe key in the install dialog, then run /stepwarden enforce to turn on the gate.At a glance
- Type
- Plugin
- Status
- prototype
- Language
- JavaScript
- Runtime
- Claude Code plugin
- Has code
- yes
Use cases and integrations
How curated lists describe it
Every tool call your agent makes, checked before it runs. A Claude Code plugin that uses TypeSafe AI's Jev to verify each pending tool call against the session plan, then allows it, asks you, or blocks it. Proof of concept.
hellogumbo/awesome-jev
Frequently asked questions
What does Jev decide?
Five signals per tool call, such as plan contradiction and out-of-scope resources.
Does it block by default?
No; it starts in audit mode and only enforces after /stepwarden enforce.
What if Jev is down?
The onError setting decides whether calls are allowed or denied.
Related projects
Claude Code plugin adding Jev judgments to Bash, Write and Edit calls and their outputs; a semantic guardrail, not a sandbox.
PluginbetaLocal guard layer for coding agents that blocks dangerous tool calls by deterministic rules, with optional Jev judgments.
CLIbetaTypeScriptAgent-ergonomic Jev CLI and PreToolUse hook that scores shell commands for hazards and screens fetched text for injection.
PluginbetaTypeScriptPreToolUse firewall for Claude Code and Codex: shell-aware rules first, then Jev returns allow, ask or block, failing closed.
HookbetaTypeScriptSafety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScriptSecurity hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScript