Tool menus grow faster than the tasks that use them: one catalog benchmark gathered 525 real MCP tools across 94 annotated tasks, and every MCP server you add moves selection further from the model's attention. The Jev-based routers and gates in the catalog prune that menu, score tools one by one, resolve which action a request means, and approve the call before it runs.
The case for a smaller menu
mcp-router is the clearest statement: an open-source Jev-based router that discovers, catalogs, classifies and deduplicates every MCP server and tool you have, then exposes each agent only the small, authorized subset a task needs. Routing decisions are System One Choice, Score and Noul questions answered by a pluggable engine — Laya, a 421M open-weight Jev-compatible model (Apache 2.0) at the edge or hosted. A deny-by-default policy engine keeps model scores as relevance data that can never widen access, and a request can lower an exposure budget but never raise it. Its caveats: no benchmarks published, a truncated README, and retrieval that assumes Postgres with pgvector.
Kody, an MCP-first cloud on Cloudflare Workers, prefers a compact search-and-execute surface over a large static catalog — adjacent, not an integration, since nothing in its README mentions Jev.
What the evidence says
The closest head-to-head evidence is jev-tool-search, comparing BM25, embeddings, rerankers and Jev for tool search over 525 real MCP tools and 94 annotated tasks.
| Method | Found right tool first | Cost per 1,000 searches |
|---|---|---|
| BM25 | 32% | $0 |
| Embeddings | 46% | $0.01 |
| Two-stage Jev | 56% | $1.03 |
| Rerank-2.5 | 60% | $2.23 |
| Embeddings + experimental engine | 59% (92% top-5) | $0.26 |
The rows are the README's own numbers, from different runs measured 2026-09-25/26 through the Vercel AI Gateway; its caveat: at 94 tasks, differences under about 10 points are noise, and a later interleaved run scored the FastMCP-style search at 54%. Two-stage Jev at $1.03 per 1,000 searches is a real line item, not a free filter.
jev-toolspace turns selection into scoring: one API call asks a yes/no noul question per tool, and the independent probabilities mean tools never compete for one score. Its own Qwen2.5-7B runs report 80.7 macro accuracy on TGB for the trace-based setting against 69.5 keep-all, and 17.3 on BFCL multi-turn against 11.3 keep-all. Executor traces want a GPU.
Routing requests, not just menus
The tinystruct TypeSafe SDK does natural-language intent routing onto Java @Action methods: Jev returns a distribution over the options you define and never generates text — an enum maps to one Choice, a boolean to one Noul, a string to a Choice over spans. Nothing is routable until typesafe.routing.allowed-actions is set, and a call below min-confidence raises AmbiguousIntentException instead of running. The score that gates a call is the weakest link across the action and every argument resolved from it. It needs Java 17 with tinystruct 1.7.34 or later, and arguments bind by position.
The MCP servers shrink the surface further. jkudish-jev-mcp exposes ten judgment tools in roughly 150 to 500 ms each, with one-line npx setup for Claude Code, Codex, Amp and OpenCode. Typesafe MCP ships one evaluate tool in a Go binary; Freepik's Go server offers five tools behind a 30-second timeout and 1 MiB input cap; Jev Decision MCP batches questions — choice 1 to 255 options, score 2 to 10 levels, noul a 0-to-1 probability — leaving thresholds to the caller. All return judgments and usage; nothing executes anything.
Gating the call before it runs
jev-tool-permissions is the policy-conscious take: a pre-flight approval gate for the Vercel AI SDK returning auto-approve, ask-human or block, plus pruning that drops irrelevant tool definitions to save context tokens. A deterministic allow/deny floor runs first and never calls the model — deny rules are checked before anything reaches Jev — and the design is fail-closed: on error or timeout the gate asks a human. Install is npm install jev-tool-permissions ai; auth comes from AI_GATEWAY_API_KEY or a roughly 12-hour VERCEL_OIDC_TOKEN.
glama-use-jev draws the line the other way: its jev_gate returns allow, deny or ask, and oversized, malformed or unreachable questions fail open. Its PreToolUse hook only tightens permissions and clips input at 4,000 characters, and only the TypeSafe backend is verified against live responses — OpenRouter's decisions path is alpha.
WebMCP: decisions inside the page
jev-webmcp-extension takes the idea into the browser: a Chrome side panel that reads the current page's WebMCP tool schemas and predicts the tool call, its arguments, confidence and latency as you type. Tool lists, enums, booleans and free text each map to a Choice, a Noul, or a parsed span. Confident read-only calls run automatically; state-changing tools require Enter; consequential annotations require a second Enter. The guardrail angle is the interesting one: Jev screens each tool description for instructions aimed at an agent, and flagged tools get a badge and cannot run automatically. Setup is Chrome 149+ with WebMCP enabled, load unpacked, a TypeSafe key; host access is one site at a time.
Where this is still early
Read the maturity labels first. mcp-router publishes no benchmarks; jev-toolspace's numbers are the project's own; the tool-search benchmark warns its rows come from different runs. Licensing is uneven: jev-tool-permissions and use-jev list no license, Kody is source-available under a Fair Source label, and several Glama-hosted servers show none. And typed output guarantees an interface, not truth. For budgeting, MCP.so's explainer lists Vercel's AI Gateway price for typesafe-ai/jev at $0.04 per million input tokens as of September 18, 2026, with its own caveat to check the provider page.
Model and skill selection are the sibling tasks, covered in Routing Models, Tools, and Skills with Jev and Putting Jev in the Coding Loop; the injection mechanics behind that WebMCP screening get their own read in Guardrails and Prompt Injection.
