toolgate

Tool-call firewall for Claude Code hooks and MCP servers: Jev answers seven risk questions and code maps them to allow, ask or deny.

MCP serverbeta

View on GitHub ↗

Overview

toolgate gates agent tool calls before they run. It ships as a Claude Code mod or PreToolUse hook, or as an MCP proxy in front of any MCP server for clients such as Cursor and Claude Desktop. Static rules run first; then Jev, reached directly or through OpenRouter's Decisions API or Vercel AI Gateway, answers seven yes/no questions per call: destructive, exfiltration, privilege, secret exposure, off-task, violates constraint and unresolved choice, plus an authorized mitigator.

Deterministic code maps the probabilities to allow, ask or deny with YAML thresholds, fails closed, logs every verdict with its probabilities, and tracks write-then-execute patterns across a session. The authorized signal softens a verdict one step when the task explicitly asked for the action. The list notes limitations: a redacted copy of each gated call goes to a hosted model, and the evaluation sets are small and reviewer-authored.

What the decision model decides

Type	Question	Answers
Yes / no	Does this call irreversibly destroy or overwrite data?	yes · no
Yes / no	Does this call send local data out (exfiltration)?	yes · no
Yes / no	Does this call contradict an explicit constraint in the task?	yes · no
Yes / no	Does the stated task explicitly call for this action (authorized)?	yes · no

How it works

Intercept a tool call via hook or MCP proxy.
Run static rules, then ask Jev the seven risk questions and the mitigator.
Map probabilities to allow, ask or deny with YAML thresholds; soften one step if authorized.
Fail closed on errors and log each verdict with probabilities.

Strengths

Policy is in YAML and every verdict is logged with probabilities.
Works with Claude Code and any MCP client.
Fails closed and tracks multi-step write-then-execute risks.
The README cites a decision in about a second for a fraction of a cent.

Caveats

A redacted copy of each gated call leaves the machine for a hosted model.
Evaluation sets are small and reviewer-authored.
Described as unofficial.

Getting started

Install the npm package @riskaverse/toolgate and register it as a Claude Code PreToolUse hook or MCP proxy.

At a glance

Type: MCP server
Status: beta
Language: TypeScript
Runtime: Claude Code hook, MCP proxy
Has code: yes
Has tests: yes

Use cases and integrations

Verification & Guardrails272

How curated lists describe it

Unofficial tool-call firewall for Claude Code hooks and MCP servers: Jev answers seven risk questions per call and deterministic code maps them to allow/ask/deny, fails closed, and tracks write-then-execute across a session
AnotiaWang/awesome-decision-models
Tool-call firewall for Claude Code hooks and MCP servers. Jev answers seven yes/no risk questions per call (destructive, exfiltration, privilege, off-task, secret exposure, constraint violation, unresolved choice) plus an authorization mitigator; deterministic code runs static rules first, maps the probabilities to allow/ask/deny by threshold, fails closed, and tracks write-then-execute across a session. Limitations: hosted model (a redacted copy of each gated call leaves the machine); evaluation sets are small and reviewer-authored.
cobanov/awesome-jev
Open auto mode for AI agents — a calibrated tool-call firewall powered by TypeSafe Jev. Ships as a Claude Code hook.
hellogumbo/awesome-jev
A calibrated tool-call firewall for agents, as a Claude Code mod or `PreToolUse` hook or as an MCP proxy in front of any MCP server: Jev checks each call for being off-task, breaking an explicit constraint or making a choice reserved for you.
MrJev/awesome-jev

Frequently asked questions

What does toolgate decide?

Whether an agent's tool call should be allowed, require confirmation, or be denied, based on seven Jev risk answers.

Does it block legitimate work?

An authorized signal softens the verdict one step when the task explicitly asked for the action.

Does any data leave my machine?

Yes, a redacted copy of each gated call is sent to the hosted model.

Related projects

jev-guard
Safety gate plugin for Claude Code, Codex CLI and Antigravity: local sensitive-file checks, then Jev judges blast radius.
PluginbetaTypeScript
jev-permission-gate
Claude Code mod that answers auto mode's tool-call permission question with eight Jev yes/no checks behind a shell-aware blocklist.
ProjectbetaTypeScript
jev-secret-guard
Claude Code hook that blocks known key formats locally and sends unknown high-entropy strings to Jev only in masked form.
HookbetaPython
open-jev-approvals
Claude Code hook where Jev reviews each tool call against risk, authorization and scope questions and a local policy returns allow or deny.
ProjectbetaGo
jev-runtime-security
Ring Zero: kernel-level runtime security for AI agents, with Jev as an optional check that can only raise severity, never permit.
Servicebeta
opencode-jev-guard
OpenCode 2 plugin that asks Jev six questions about every shell command (local or remote via FarHand) and prompts unless clearly safe.
MCP serverbetaTypeScript