CommunityJev Tools & CLIs
Jev-IDS: System One Models for Network Intrusion Detection (arXiv 2610.01079)
JEV-IDS is an open experimental network intrusion detector that serializes one flow per request and asks Jev for a binary attack probability and a finite-choice traffic category. On a 300-flow NSL-KDD pilot it reports F1 0.859 and novel-attack recall 0.838.
- Format
- Article
- Published by
- Community
- Last verified
- Oct 2026
Highlights
- Asks Jev two questions per serialized flow: a binary attack probability and a finite-choice traffic category.
- Across 5,400 decisions on a 300-flow NSL-KDD pilot split: F1-Score 0.859, precision 0.941, recall 0.790.
- Novel-attack recall reached 0.838, 1.5 times GPT-5.6 Luna's, while running 4.8 times faster and 3.8 times cheaper.
- Produced 15 times fewer false alarms than a low-data Random Forest.
- Increasing k to 2 reduced the F1-Score to 0.839 from 0.859.
Watch out
arXiv preprint posted October 1, 2026 (cs.CR, cs.AI). All results come from a 300-flow NSL-KDD pilot split with 5,400 decisions, a small and dated benchmark, so the abstract does not establish performance on modern traffic or live networks; it is called open, but no repository is named.
Questions about this entry
Short answers drawn from the linked project or page.
It serializes one flow per request and asks two questions: a binary attack probability and a finite-choice traffic category, keeping the outputs typed under label scarcity.
Across 5,400 decisions on a 300-flow NSL-KDD pilot split, it achieved F1-Score 0.859, precision 0.941, recall 0.790, and novel-attack recall 0.838.
At k=1, Jev was 4.8 times faster and 3.8 times cheaper than GPT-5.6 Luna, with 1.5 times higher novel-attack recall, according to the paper.
JEV-IDS produced 15 times fewer false alarms than a low-data Random Forest, the paper reports, addressing the scarcity setting where labelled training data is limited.
Increasing k to 2 reduced the F1-Score from 0.859 to 0.839, so the single-question configuration performed better on this pilot.
Machine-learning IDS need substantial labelled datasets and task-specific training, while LLM detection analyzes flows directly but costs more, runs slower, and returns less constrained outputs.
The paper describes JEV-IDS as an open experimental general NIDS, but the abstract names no repository, package, or license for the implementation.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsHacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsX: Secret detection with Jev, tested
More Jev resources like this
A diagnosis-guided repair agent whose CWE classification comes from Jev. Jev beats six open-weight models on every classification and ranking metric and runs at 6.27x lower median latency than GPT-5.6-Sol; with Jev diagnosing, repair lifts the detector-measured security pass rate from 63.5% to 70.7%.
Jev Tools & CLIsArticle#community#research#arxiv
Community
COGNIT-Guard is a safety guardrail that pairs a calibration-tuned CPU gatekeeper with confidence-gated escalation to an NPU-resident 322M direct-decision model, Laya-322M. It reports 98.85% accuracy and 0.42% benign false-positive rate on DUCS-Bench, with experience replay recovering out-of-distribution accuracy.
Jev Tools & CLIsArticle#community#research#arxiv
Community
SecJev is a family of security-specialized System One decision models from 0.8B to 9B parameters, built on Kev's single-pass candidate scorer. It spans 14 tasks and eight sources, and SecJev-0.8B beats general Kev-9B by 20.51 points in task-macro accuracy.
Jev Models & ReimplementationsArticle#community#research#arxiv
Community
An integration of Jev's decision API into edge service orchestration that extracts four to eight bounded intent fields per request. Across 33 test conditions Jev cuts median decision latency by 22.7-64.5% versus the fastest LLM, and on a live admission path it keeps 0.91-0.95 of requests exact and on time.
Jev Tools & CLIsArticle#community#research#arxiv
Community
11GitHub stars
Kernel-enforced runtime security for AI agents with eBPF/LSM: policy decides file, exec, package-install and MCP operations at the syscall, while Jev can run as an optional checks provider whose verdict can only raise severity. The Jev checks layer is off by default.
Jev Tools & CLIs#community#security#ebpf
Community
ringzerosec/jev-runtime-securityRust
ringzerosec/jev-runtime-securityRustA unified guardrail model that selects an applicable audit policy from a policy tree, then classifies safety conditioned on the retrieved policies. On 7,033 cases it reports 93.72% safety accuracy and 93.10% hierarchical routing accuracy at 58 ms mean latency.
Jev Models & ReimplementationsArticle#community#research#arxiv
Community
From the Jev guides
Original write-ups on what this entry is for.
Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.
Jev Tools & CLIs#classification#email#security
Read article
The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.
Jev Tools & CLIs#gateway#vercel#cloudflare
Read article
Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.
Jev Tools & CLIs#open-models#local#onnx
Read article
From the Jev community
Posts from builders shipping with Jev right now.