User repository on GitHub
使用 TypeSafe Jev 审查 Skill 与 MCP 可疑行为 | Review Agent Skills and MCP code with Jev, static evidence, and explicit coverage gaps
- Forks
- 1
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
Jev directory
CommunityJev Tools & CLIs
Jev Security Scan
Python CLI and agent skill that reviews Agent Skills, MCP configs, and source code for suspicious behavior with TypeSafe Jev plus local static checks, reporting file and line evidence, risk categories, model probabilities, and unscanned scope.
- Stars
- 12
- Language
- Python
- License
- MIT
- Reading time
- 2 min
- Published by
- Community
- Author
- win4r
- Last verified
- Oct 2026
Highlights
- Scans Agent Skill files, MCP source and configs, install hooks, supply-chain patterns, hidden persistence, and telemetry.
- Python 3.10+ with only the standard library: no pip install; local mode needs no API key and makes no network requests.
- A 2026-09-19 test with jev-1.13.0 scored a malicious skill at prompt injection 0.95, credential theft 0.90, and exfiltration 0.88.
- Probabilities are Noul yes-probabilities, not accuracy and not a separate confidence; a high-risk verdict also requires another judging round.
- Installs as a skill into ~/.codex/skills/ or ~/.claude/skills/, or runs as python3 -I -B scripts/scan.py <target> --mode local.
Quickstart
bash
python3 -I -B "$PWD/scripts/scan.py" /absolute/path/to/target --mode local
python3 -I -B "$PWD/scripts/scan.py" /absolute/path/to/target --mode jev --prompt-key --max-calls 80Watch out
Copy reviewed against the Chinese README on 2026-10-15; it was truncated while explaining the second high-risk round, and the README states the tool is an auxiliary review aid, not a security certification: no indicators does not mean no malicious code, and Jev mode sends best-effort-redacted source excerpts to TypeSafe.
Questions about this entry
Short answers drawn from the linked project or page.
A review tool for Agent Skills, MCP configuration, and source code that combines TypeSafe Jev with local static checks, reporting suspicious behavior, file and line evidence, risk categories, model probabilities, and unscanned scope before you install or run something.
Agent Skills such as SKILL.md, referenced materials, and scripts; MCP source code and configs; install hooks and supply-chain patterns; hidden persistence, auth bypasses, and resource abuse; and telemetry as a separate informational item.
From the cloned repository, run python3 -I -B scripts/scan.py /absolute/path/to/target --mode local. Local mode needs no API key and makes no network requests, and the -I and -B flags block malicious same-name module imports and bytecode caches.
Jev mode sends best-effort-redacted source fragments and relative filenames to TypeSafe, and API calls may incur cost. Sensitive projects can use local mode instead, and the scanner never saves your key to disk.
They are Noul yes-probabilities, not accuracy and not an additional confidence measure. A high-risk verdict also requires another judging round, and the README warns that no indicators found does not prove the target is safe.
No. It reads text without executing target code, installing dependencies, or connecting to MCP servers; MCP config findings keep implementation_verified: false, and a missing indicator is not proof of absence.
It targets macOS and Linux, with POSIX-dependent tests and Windows not fully verified. The scanner accepts only local paths, so clone repositories first with git clone --depth 1 --no-recurse-submodules; TOML and YAML configs are checked as plain text.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
Hacker News: Show HN: Agent Chaperone screens tool calls and results with Jev before the agent sees them.
sepehrsafari5 pointsShow HN: Agent Chaperone – Screen AI agent tool calls and results with JevRead the thread on Hacker NewsYouTube: Kubernetes admission control with a decision model, fail-closed.
X: Jev in front of the HeyGen MCP
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsMore Jev resources like this
Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.
Jev Tools & CLIs#community#security#agent-skills
Community
cisco-ai-defense/skill-scannerPython
cisco-ai-defense/skill-scannerPythonA safety gate for AI coding agents that checks every shell command, file write, and file read before it runs and returns ALLOW, ASK, or DENY: most calls are decided locally in under a millisecond, while ambiguous or destructive ones go to TypeSafe's System One model.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
clemensschartmueller/jev-guardGo
clemensschartmueller/jev-guardGoA Rust CLI that reviews Git diffs and source scans as fast, staged judgments with concrete evidence, severity and owner routing, powered by TypeSafe Jev through a thin HTTP client speaking the system_one wire format.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
brianluby/momus-reviewRust
brianluby/momus-reviewRustA linter for Jev queries that takes the request you would send to System One — a state and the questions asked about it — and reports where the query is written in a way the model is documented to handle badly. Static checks run free without a key; the rest ask Jev.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
fox-islam/jevlintPython
fox-islam/jevlintPythonLocal, inspectable image perception for the text-only Jev: OCR text in reading order plus the same words on a character grid become the state Jev decides over, returned as a plain dict. CLI, MCP server and agent skill.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
leddoengano/jev-eyesPython
leddoengano/jev-eyesPythonA pre-action gate for tool-using agents that decides allow, confirm or block with deterministic rules before a neural decider, plus a CDP browser loop whose decider swaps between hosted Jev and a local System One-compatible server through environment variables alone.
Jev Tools & CLIs#community#catalog-import#yibie
Community
pusucip25/local-deciderPython
pusucip25/local-deciderPythonFrom the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.