User repository on GitHub
TypeSafe Jev semantic guardrails for Claude Code
- Forks
- 0
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
CommunityJev Agents & MCP
Claude Jev Plugin
Claude Code plugin that sends four typed questions about each Bash, Write and Edit call to Jev and composes the answers into a warning or a native permission prompt, in shadow mode by default.
- Stars
- 2
- Language
- TypeScript
- License
- BSD-3-CLAUSE
- Published by
- Community
- Author
- dr-dimitru
- Last verified
- Oct 2026
About this project
claude-jev adds TypeSafe Jev semantic judgments to Claude Code tool execution. PreToolUse judges Bash, Write, and Edit calls. Requests go directly from local plugin code to TypeSafe's HTTPS API. This plugin is a semantic guardrail, not a security sandbox. TypeSafe can be unavailable or wrong. Claude Code permission rules remain the hard control. Remote installation requires readable GitHub repositories for both marketplace and plugin.
Quoted from the project's README. Read the full README.
- Languages
- TypeScript
Highlights
- The pre-tool gate asks four questions in one request: destructive at 0.90, off-machine data or secrets at 0.70, beyond scope at 0.85, impact 2.50.
- Shadow mode is the default; enforce mode returns Claude Code's own permissionDecision of ask, and allow is never returned on confidence.
- Project config cannot set model, endpoint, timeout, retries or key — those come only from trusted global config, and a plaintext JSON apiKey is refused.
- Successful output is checked only for leaks, because classifying successful output produced false advice; failed output also gets a failure class.
Watch out
This is a semantic guardrail, not a sandbox: a missing key, invalid config, timeout, network failure, retry exhaustion, 429 or 529, malformed response or hook timeout all fail open and create no denial, so Claude Code permission rules remain the hard control. Shadow mode is the default and only warns, so enforce mode is opt-in — and the non-interactive permission modes it recognizes, dontAsk and bypassPermissions, are exactly where blockWithoutUI decides between failing open and denying. Bounded excerpts do leave the machine: up to 400 characters of file content or a command, 1200 of the user request and 2000 of Bash output, inside an 8000-character state cap, and detecting a secret requires sending text that may itself contain one. Per-session state and judgment caches are kept for a retention window that defaults to seven days. Copy reviewed against the repository README on 2026-10-04, not from running it.
Questions about this entry
Short answers drawn from the linked project or page.
By default it warns: shadow mode is the default, so a flagged action produces a short warning and the turn continues. Enforce mode returns Claude Code's native permissionDecision of ask, which puts the decision back in front of you. The plugin never returns allow on the strength of a TypeSafe confidence, and it is explicit that this is a guardrail rather than a sandbox — TypeSafe can be unavailable or wrong, and permission rules remain the hard control.
Bounded slices rather than your files: cwd, the tool name, up to 400 characters of file content or command with the remainder marked elided, up to 1200 characters of the user request, and up to 2000 characters of Bash output, with serialized state capped at 8000 characters. Write and Edit content, prompts, commands and output can leave the machine, and the README notes that secret detection only works by sending bounded output that may itself contain the secret. Session ID, transcript path, agent identity, the API key and raw cache records are never included.
No. Project-level .claude/claude-jev.json cannot set model, endpoint, timeoutMs, retries, apiKey or apiKeyFile; those transport fields are accepted only from trusted global configuration, and a plaintext JSON apiKey is not accepted at all — use apiKeyFile, which resolves under ~/.claude, or export TYPESAFE_API_KEY. Precedence runs defaults, then global, then project judgment config, then environment key, then session override. Every remote endpoint must be HTTPS, with plain http allowed only for localhost or a loopback address.
Two open-weight alternatives are documented, neither served by TypeSafe: Kev and Laya, both running on your own machine behind a local /v1/systemone endpoint, with start commands and a comparison document. The README's own result is qualified — with tuned thresholds Kev-4B caught as many dangerous commands as hosted Jev, while the 0.8B variant and both Laya checkpoints missed most of them — so hosted Jev stays the default and any non-empty model id you configure is sent unchanged.
Run /plugin marketplace add dr-dimitru/claude-plugins-marketplace and /plugin install claude-jev@dr-dimitru-claude-tools --scope user, export TYPESAFE_API_KEY, then /plugin enable claude-jev@dr-dimitru-claude-tools and /reload-plugins; the manifest defaults to disabled.
It asks four questions in one request: destructive at 0.90, off-machine data or secrets at 0.70, beyond scope at 0.85, and impact scored at 2.50 with confidence of at least 0.50.
One 15-second total request deadline covers connection, response-body read, JSON parsing, retry delays, and all attempts, with the Claude hook timeout at 20 seconds; retries use bounded backoff and honor Retry-After only when it fits the remaining budget.
More Jev resources like this
35GitHub stars
Diff-aware test selector that sends the git diff to Jev with one question per test, then prints the native filter flags and hands them to vitest, jest, node, bun, Playwright, cargo, or go test.
Jev Agents & MCP#community#jevbest#catalog-import
Community
mizchi/jev-test-filterTypeScript
mizchi/jev-test-filterTypeScript15GitHub stars
Node CLI that lints a file tree against fuzzy natural-language rules in one Markdown file, judging each matched file with a swappable TypeSafe-backed judge.
Jev Agents & MCP#community#jevbest#catalog-import
Community
tyler-dot-earth/patdownTypeScript
tyler-dot-earth/patdownTypeScript7GitHub stars
Claude Code plugin that scores pending tool calls and finished answers with Jev noul probabilities, denying the call with the correction attached when a rule threshold is met.
Jev Agents & MCP#community#awesomejev#catalog-import
Community
muratcakmak/jev-guardTypeScript
muratcakmak/jev-guardTypeScript10GitHub stars
Pi context extension that folds repeated reads, filters long command logs through Jev, and retrieves saved originals as searchable verbatim chunks.
Jev Agents & MCP#community#jevbest#catalog-import
6GitHub stars
Shell gate for coding assistants that judges commands by effect and blast radius, asking Jev twelve questions or a chat model, with fast rules first.
Jev Agents & MCP#community#awesomejev#catalog-import
7GitHub stars
One-file Mastra input processor that screens the last user message with Jev instead of an LLM verdict: a typed yes/no gate plus a log-only category label, in a single request that fails open behind a circuit breaker.
Jev Agents & MCP#community#jevbest#catalog-import
From the Jev community
Posts from builders shipping with Jev right now.