What is JEV Attack Surface Analysis?

A proof-of-concept scanner that maps a backend codebase and flags likely vulnerabilities down to the suspicious line for about one cent per repo. You give it a Python, JavaScript or TypeScript repo and a budget in dollars, and it returns a colored file map plus a ranked issue list.

No LLM is involved. Plain Python parses the code, and Jev, a classifier that answers fixed questions with probabilities in under a second, does all the judging at about $42 per billion input tokens. The heat value from 0 to 1 is computed from Jev's probabilities.

Create a venv and install requirements.txt, export TYPESAFE_API_KEY, then either run viewer_server.py and use the page on localhost:7801 or call .venv/bin/python attack_surface_scan.py repos/pygoat --budget 0.03 from the shell.

What does a scan cost?

You set a budget in dollars; the viewer caps a run at $0.05 and each zoom level gets a share, with unspent money passed down. The README's measured runs cost $0.010 for PyGoat and $0.007 for NodeGoat on 2026-10-02.

Which languages can it scan?

Python, JavaScript and TypeScript out of the box. The README shows how to add a language by editing classification_levels.json with file extensions and the parser's names for imports, functions and classes.

Does it prove a vulnerability exists?

No. It ranks candidates for review, and each function is judged on its own, so a flaw spread across several functions can be missed. The copy button and print_issues.py hand the list to an agent with the instruction to validate each issue, not to fix it.

Who built it and is there a demo?

GitHub user franciscocarloserra publishes it; the repository lists no license. A GitHub Pages demo shows read-only results on PyGoat and NodeGoat, so you can look at the output before installing anything.

Jev directory

CommunityJev Tools & CLIs

JEV Attack Surface Analysis

A proof-of-concept Python scanner that maps a backend codebase's attack surface and ranks likely vulnerabilities down to the suspicious line, using Jev as the classifier for about one cent per repo. It reads Python, JavaScript and TypeScript, and a demo site shows read-only results on PyGoat and NodeGoat.

See highlights Open github.com

Stars: 3
Language: Python
Reading time: 3 min
Published by: Community
Author: franciscocarloserra
Last verified: Oct 2026

franciscocarloserra/jev-attack-surface-analysis

User repository on GitHub

View on GitHub

PoC/Reference: Attack surface heatmap of a Python or JS Ts codebase, ranked top-down by the jev classifier on a fixed budget

Forks: 0
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

Tagscommunity github security python code-analysis

Works forJev for Verification Jev for Scoring Jev for Code

Used inJev for Software & DevTools Jev for Security & Privacy

Languages: Python
Platforms: CLI Browser
Capabilities: Open sourceRequires API key

Highlights

Plain Python reads the code; Jev answers fixed questions with probabilities in under a second at about $42 per billion input tokens.
Four zoom levels: directories (names), files (imports and signatures), functions (code), then the single line where the issue happens.
A dollar budget is split across levels; unspent money passes to the next level and the hottest items are rated first.
Measured 2026-10-02 on two intentionally vulnerable apps: PyGoat cost $0.010 and NodeGoat $0.007 per scan.
A localhost viewer or print_issues.py hands the ranked list to an AI agent with the instruction to validate issues, not fix them.

Quickstart

bash

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
export TYPESAFE_API_KEY=...
.venv/bin/python attack_surface_scan.py repos/pygoat --budget 0.03

Watch out

README reviewed 2026-10-17; the repository lists no license, and the README says it was tested only against two intentionally vulnerable apps, that it ranks candidates for review rather than proving a vulnerability, and that a flaw spread across several functions can be missed.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

YouTube: Kubernetes admission control with a decision model, fail-closed.

Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.

2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker News

X: Jev and Laya on security queries

X: Testing Jev for prompt injection

From the Jev guides

Original write-ups on what this entry is for.

Jev at home: voice pipelines, Assist routing, and sentinels

Oct 16, 2026

How Home Assistant conversation agents, macOS voice pipelines, and an advisory sentinel put a fast typed decision in the loop — one call per utterance, thresholds in code, and a daily token budget.

Jev Tools & CLIs#home-assistant#voice#automation

Read article

Search visibility, audited by decisions

Oct 16, 2026

Jev-based SEO tools split the crawl from the call: deterministic crawlers count and parse, while typed judgments rank fixes, place internal links, score search results, and track AI-answer mentions — with costs and caveats attached.

Jev Tools & CLIs#seo#search-visibility#audits

Read article

Jev on the Gateways: Vercel, Workers AI, and OpenRouter

Oct 12, 2026

The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.

Jev Tools & CLIs#gateway#vercel#cloudflare

Read article

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai

JEV Attack Surface Analysis

Highlights

Quickstart

Questions about this entry

What is JEV Attack Surface Analysis?

How does it use Jev?

How do I run a scan?

What does a scan cost?

Which languages can it scan?

Does it prove a vulnerability exists?

Who built it and is there a demo?

Reactions & coverage

More Jev resources like this

From the Jev guides

From the Jev AI model community