CommunityJev Integrations & Adapters
Admission Gate
A Kubernetes admission webhook that asks Jev to allow, flag, or deny a manifest change for intent-shaped policies a Rego rule cannot express, keeping hard rules in Rego and failing closed by default.
- Published by
- Community
- Author
- Kube Decision
- Last verified
- Oct 2026
Highlights
- Sends only intent-shaped policies to the model; hard rules stay as Rego.
- Fails closed for deny-worthy classes and fail-open for advisory ones, as explicit config.
- Caches decisions by manifest hash and allows on timeout so it cannot stall a rollout.
- Ships a kind-based harness that applies sample manifests and asserts the verdicts.
Watch out
A complement to policy-as-code, not a replacement; every decision records whether it failed open or closed, and the webhook deadline must be tuned to the cluster's admission budget.
Questions about this entry
Short answers drawn from the linked project or page.
A Kubernetes admission webhook that asks Jev whether a manifest change should be allowed, flagged, or denied, for the policy cases that are about intent rather than a fixed field, such as an image that looks unrelated to its workload.
Only for the judgments a Rego rule cannot express. The README keeps every hard rule, such as a required label or a banned registry, as a Rego policy and sends Jev only what is left over.
It fails closed by default for deny-worthy classes and can be configured to fail open for advisory ones. Both modes are explicit configuration, and each decision records which one applied.
The webhook has a short deadline, caches decisions by manifest hash, and returns allow on timeout when the class is advisory, so a slow model cannot stall a rollout.
Those sit in front of model or tool calls. This one sits in the cluster's admission path, on infrastructure manifests, and its output is a verdict the API server enforces.
Go 1.23 or newer, a TLS cert for the webhook, and a TypeSafe key. The repo includes a kind-based test harness that applies sample manifests and asserts the verdicts.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsHacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsX: Secret detection with Jev, tested
More Jev resources like this
73GitHub stars
High-performance Go event bus with a bounded MPMC ring buffer, fan-out and ordered handlers, plus an optional routing layer that evaluates deterministic rules first, reuses cached decisions, and asks Jev a typed Choice only for ambiguous cache misses.
Jev Integrations & Adapters#community#go#event-bus
Community
Protocol-Lattice/GoEventBusGo
Protocol-Lattice/GoEventBusGo2GitHub stars
A Unix-pipeable CLI that asks Jev (or Berget System One models) one question over stdin, with shell-safety exit codes and a calibrate subcommand.
Jev Integrations & Adapters#community#cli#shell
Community
frodi-karlsson/onesieGo
frodi-karlsson/onesieGo60.9kGitHub stars
LiteLLM's proxy adds TypeSafe guardrail hooks and a Jev complexity classifier for policy judgments and request routing across 100+ model providers.
Jev Integrations & Adapters#community#python#gateway
Community
BerriAI/litellmPython
BerriAI/litellmPython10GitHub stars
x402 risk-check provider that scores agent counterparties before payment: OFAC, phishing and drainer feeds, transaction simulation, drainer-kit fingerprints and a Jev model reading context for injected instructions, issuing an ES256-signed attestation per verdict.
Jev Integrations & Adapters#community#x402#payments
3GitHub stars
Go CLI for Jev with noul, choice, score, eval, rank, and models commands: rank sends one Score question per item per weighted YAML dimension in a single request and sums weight times score in code, while threshold flags turn a failed gate into exit code 10 for scripts and CI.
Jev Tools & CLIs#community#cli#go
Community
saembit/jeff-cliGo
saembit/jeff-cliGo1GitHub stars
Go linter whose rules are plain-English questions: AST matchers select nodes and Jev answers one Noul per fragment above the rule's threshold. It runs standalone, under go vet, and as a golangci-lint plugin, with cached answers so runs only ask about changed code.
Jev Tools & CLIs#community#linter#go
Community
arturobermejo/semcheckGo
arturobermejo/semcheckGoFrom the Jev community
Posts from builders shipping with Jev right now.