Agents: read the raw Markdown of this page, or start at llms.txt.
~/wiki/ideas
Tools: guardrails for agents (tool-call gates, permission hooks, injection screens, rule checks)
TL;DR Community tools that put Jev between an agent and its actions: tool-call gates (P03), injection and content screens (P16, P35), rule checks on edits and stop or review gates (P04, P10). Unaudited code that sees your commands, files and often your key; read the fail mode and install footprint before wiring any of it in. Where authors measured, the gate often added latency without better outcomes. Split from Tools and integrations hub: MCP servers, plugins and connectors on 2026-09-25 (nothing dropped).
Pattern IDs: Decision patterns from the community (with fit verdicts) (P03 lives in Patterns: agent internals, routing, gates, context and memory). Licence MIT unless stated. Numbers: the author's. "Our check" = our 2026-09-25 source and registry vetting (docs/sweep/2026-09-25-mrjev/partc.md), not a raw capture.
Before you install. These tools hook every tool call, edit or prompt, so their install footprint matters:
- A Jev probability can widen permissions. Jimuelle07/Helm maps
needs_human < 0.30to "unattended" flags such as Claude Code--permission-mode bypassPermissionsor Crush--yolo, and the author calls every threshold uncalibrated. Only reached through--execute. A P03 gate should only ever narrow permissions. - jev-kit wires a
PreToolUsehook on every tool (only with--wire) and installs default-on timers, including a Claude Code auto-updater; opt-in parts add a shim overclaudeand a tuning loop that commits to its own branch. - claude-jev fetches a 51 MB ast-grep binary (sha256-pinned) in a detached process; its compaction hook, like jev-pruner's and jevctl's, needs the undocumented
CLAUDE_CODE_ENABLE_FUNCTION_HOOKS. - agent-chaperone's plugin installs its npm package on the first screened call when none is global. jev-edge installs with
sudo make install. - jevwire's README says
npx -y jevwire, but npm had nojevwirepackage on 2026-09-25 (our check): anyone can claim the name. Build from the repo. - Fail direction differs: most gates here fail open (an outage lets everything through); pi-jev-auto-mode fails closed, and Pi Jev Guard asks the human, or blocks without a UI.
Tool-call gates and permission hooks (P03)
| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| Bouncer (Clownware) | Claude Code PreToolUse: 7 Nouls, YAML policy, 15 hard rules first; observe default; bouncer calibrate gates releases |
claude plugin marketplace add clownware/bouncer, then claude plugin install bouncer@bouncer |
1 · 2026-09-20 · no licence | 104 near-miss fixtures, Brier per question; cat .env scored 0.15, so rules own the edges |
| jevwire (Brainwires) | MCP server, library and Claude Code plugin: hooks on session, prompt, tool and stop events via a local daemon (127.0.0.1:10522); never returns "allow"; may deny a call once with a reason the agent can answer |
from a checkout (npm name unclaimed, above) | 20 · 2026-09-21 | hooks fail open silently if the daemon is down. Author: 53 candidates per request bunched at 0.84–0.87 and missed the file; at 16 it came first, now the cap. 740 live calls p50 536 ms, ~$0.064 total, 10 trips in 689 gate decisions → Failure reports: where Jev broke, lost, or was the wrong tool. P04, P17 |
| jev-kit (jonathanavis96) | rules table first, one Jev question for the ambiguous rest; deny needs confidence ≥ 0.8 and margin ≥ 0.4; tier guard, belay, file search, browser agent | git clone, install/install.sh (--wire edits settings) |
36 · 2026-09-24 | everything fails open. Author: general-risk rule 20/21; 30-session A/B had zero denies, so no savings shown; Wikipedia hops 15/18 when named, 0/6 when not → Builds: coding agents, harnesses and orchestration. P02, P12 |
| jev-guard (leepokai) | risk Score 0–3 plus approval, user-requested and from-untrusted Nouls per call, with session memory; scans tool results and skill files | npm i -g jev-guard; install writes hooks into Claude, Codex, Copilot, Gemini, Cursor, pi or OpenCode config |
34 · 2026-09-24 | key file 0600, sent only to TypeSafe or Vercel. Author: ~0.75 s direct from Taiwan, p50 ~580 ms via Vercel over 21 calls; none of 662 installed skills flagged. Its Vercel path differs from the documented base URL (unverified). P16, P35 |
| agent-chaperone | screens tool calls before they run and results before the agent reads them: fixed lists plus a Jev question battery; MCP proxy and hooks; shadow default |
npm install -g agent-chaperone; plugin agent-chaperone@agent-chaperone |
21 · 2026-09-23 · Apache-2.0 | author, 2026-09-21, 1,947 requests, $0.062: InjecAgent AUC 0.976; BIPIA email recall 0.825 at 0.5 (jev-edge below reports the opposite on BIPIA with other wording); 8 false positives on 68 benign texts about injection → Head-to-head benchmarks: Jev on public datasets and suites. P16 |
| Jevvy (PanAchy) | auto-approves harmless shell asks, else abstains | npx @jevvy/permissions init |
15 · 2026-09-21 | 5 providers incl. custom endpoint. Flag: approving when every Noul probability is at or under its threshold widens permissions, against this page's narrow-only rule (see the Helm warning above). Mitigations per the README: allow/deny rules stay final, it sees only unresolved shell asks, shipped thresholds calibrated on the author's eval/commands.json (custom policies and unverified endpoints not covered). |
| Interlock (somoore) | gate(): detectors → Noul battery → policy code; agent sees only canary secrets |
pip install -e . |
0 · 2026-09-19 | 38-case regression set, not a benchmark |
| pi-jev (y0usaf) | Pi gate on bash/write/edit (four questions, one request, ~300 ms), output judge for leaked secrets and failure class, jev_ask |
pi install npm:@y0usaf/pi-jev |
146 · 2026-09-22 | shadow mode default; every error fails open. Not madeye/pi-jev; unscoped npm pi-jev is TheoOliveira's (Tools and integrations hub: MCP servers, plugins and connectors). P11 |
| pi-jev-auto-mode (jomatsu) | deterministic policy first; Jev judges only escalated calls | pi install npm:pi-jev-auto-mode |
26 · 2026-09-24 | fails closed; 171 offline tests; calibration doc: 13 fixtures (its README says twelve), one sample each, reruns moved some probabilities by ±0.05 |
| jev-engineering (eugeniughelbur) | Claude Code tool-call gate; installs in observe mode | claude plugin marketplace add eugeniughelbur/jev-engineering, then claude plugin install jev-engineering@jev-engineering |
2 · 2026-09-24 | 300-call injection test: catching every attack needed a 0.8 floor that re-prompted 58% of normal traffic (Failure reports: where Jev broke, lost, or was the wrong tool) |
| dsh-jev (buberlo) | DeepSeek Harness: narrows tools and gates calls (matches task, missing info, breaks a restriction); mock + shadow by default | dsh plugin --profile <name> add @buberlo/dsh-jev@0.1.4 |
23 · 2026-09-23 | author's verdict: no better than a rule in the prompt when the model complies, and slower (prompt rule 0/10 deletions); a weaker model tried 10/10 times and Jev denied all 31 attempts. npm 0.1.2 and 0.1.3 are broken (our check) → Failure reports: where Jev broke, lost, or was the wrong tool. P08 |
| jevcore (PerryLink) | core library, DeepSeek Harness plugin and MCP server; offline mock by default, prints what each feature sends before anything leaves | dsh plugin --profile <profile> add jevcore-dsh; npx -y jevcore-mcp |
31 · 2026-09-24 · Apache-2.0 | a live check caught it sending Score criteria as a keyed map; the API needs an ordered array (verified, Score questions). Claims an audit of 19 DeepSeek Harness Jev plugins found undisclosed egress in guard modules; names none (unverified). P07, P17 |
| Helm (Jimuelle07) | picks among the coding-agent CLIs you have installed (options built from that list plus none); seven questions decide auto / recommend / clarify / escalate; a supervisor asks Jev whether the worker is done |
claude plugin marketplace add Jimuelle07/Helm, then claude plugin install helm@helm |
11 · 2026-09-24 | warning above: a low needs_human can switch on bypass or --yolo modes with uncalibrated thresholds. Author: 2,149 tokens, 0.7 s, $0.00009 per decision (verified at $0.042/Mtok). P05, P04 |
Names only: Pi Jev Guard (zszz3; four questions per action, asks the human once when Jev fails and blocks without a UI; 67 offline tests, never run with a real key; npm pi-jev-guard 0.7.2 is another publisher's, the repo's 0.2.1 is unpublished; our check).
Injection and content screens (P16, P35)
| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| jev-edge (kiwi0719) | nginx/OpenResty filter: cheap rules, then a live Jev check (~270–300 ms p50, adaptive 400–1,000 ms timeout, circuit breaker, cache), then an async side path | Docker demo; sudo make install |
35 · 2026-09-22 · Apache-2.0 | fail-open. Author: deepset AUC 0.983 with 37.3% missed, 0.996 and 5.3% once the deployment is described; BIPIA EmailQA 81.5% missed; untrusted-content flag cut tool-result misses 77.8% → 19.0% → Head-to-head benchmarks: Jev on public datasets and suites. No known production use |
| is-malicious (luantak) | scans a repo before you run it: files grouped by directory, all categories in one request, second pass on suspicious lines | npx is-malicious /path/to/project |
27 · 2026-09-23 | derives Noul confidence as 2 * |p - 0.5| (Noul has none, verified, Confidence vs probability); splits chunks on max_tokens_exceeded (unverified); skips files over 400,000 bytes. --base-url sends all scanned source to that server. No accuracy; 3 fixtures |
| tripwire (noelzappy) | AI SDK middleware or proxy, 7 checks per LLM reply | npm i @noelzappy/tripwire |
2 · 2026-09-18 | no accuracy vs real Jev yet |
Warning only, never a route: safer-with-jev (andrelandgraf, no licence) is a public demo API with no caller auth that runs anyone's text through Jev on the owner's key (/ask-jev), and can forward approved bodies with the caller's own upstream API key. An open endpoint on one key looks like offering the Services standalone (MCA §2.3(a), our reading, not legal advice); see the Warnings on Platforms and gateways: Zapier, LangChain, Spring AI, Cloudflare, Netlify, Vercel, OpenRouter, Fly.io, Pydantic AI and other hosted routes to Jev.
Rule checks on edits, stop and review gates (P04, P10)
| Tool | Does | Install | ★ · push | Note |
|---|---|---|---|---|
| claude-jev (0x7067) | rules from CLAUDE.md, AGENTS.md and rule folders judged per edit: block ≥ 0.80, silent < 0.50, second call between; verbatim compaction; prompt router | claude plugin marketplace add 0x7067/claude-jev, then claude plugin install claude-jev@claude-jev |
18 · 2026-09-25 | author, v0.21.0: 22 of 247 real edits blocked (17 by one repo's comment ban), 17/29 planted violations caught, 0/24 near-misses. Prompt router mostly failed: 34.6% on 1,613 prompts; a 3-way taxonomy (58.8%) scored below a constant guess (64.7%) → Failure reports: where Jev broke, lost, or was the wrong tool. P07, P02 |
| jev-gates | 7 Claude Code gates (rule, scope, intent, done, claims, proof, commit); escalate, never approve | plugin | 0 · 2026-09-20 | P04, P10 |
| jev-belay | Stop hook; asks only if files changed and no check passed | plugin | 18 · 2026-09-20 | AUROC 0.976 on 100 stops; 346 ms; $0.00005. P04 |
| Abide (coldteadotai) | one question per AGENTS.md rule per edit; Claude Code, Codex, OpenCode | npx @coldtea/abide init |
210 · 2026-09-20 | 93 sessions: 39 edits flagged, 10 confirmed. P10 |
| jev-pref (doeixd) | AGENTS.md preferences → semantic lint rules on code changes, fed back to the agent | npx jev-pref setup |
9 · 2026-09-18 | P10 |
| jev-commit (valentynkit) | commit-msg hook: five questions on message vs staged diff, one request |
pre-commit rev: v0.1.0 |
13 · 2026-09-19 | warns; stops only a credential on an added line. P10 |
| lorenzini (Nanako0129) | skills that wait for CodeRabbit, Copilot or Codex reviews; silence is never a pass; an 11-incident ledger of past false passes | clone | 17 · 2026-09-25 · no licence | Jev is off by default and shadow-only (JEV_SHADOW=1): it may only turn CLEAN into HOLD, never the reverse. Adding "nitpick" to the criteria moved one heading from 0.37 to 0.697 → Builder lessons: what changed the result. P42, P11 |
Also a gate: patdown's Claude Code Write/Edit hook (Tools: CLIs, linters, semantic grep and dev tools).
Related
- Tools and integrations hub: MCP servers, plugins and connectors — hub: MCP servers, plugins, connectors, agent routing
- Patterns: agent internals, routing, gates, context and memory — P03 tool-call gate, P04 done-checks; Patterns: coding agents, dev tools and self-compiling workflows — P11
- Failure reports: where Jev broke, lost, or was the wrong tool — gates that added latency or over-denied
- Tools: CLIs, linters, semantic grep and dev tools — linters and scanners run from CLI or CI
Sources
Links inline; raw captures (2026-09-23 to 25) in frontmatter. Names-only lines and "our check" notes rest on our 2026-09-25 vetting at source (docs/sweep/2026-09-25-mrjev/partc.md) where no capture exists.