User repository on GitHub
A real-time firewall for AI coding agents: every Claude Code / Codex tool call is checked before it reaches your machine
- Forks
- 0
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
CommunityJev Agents & MCP
Jev Firewall
PreToolUse hook for Claude Code and Codex that puts a shell-aware rules engine and Jev in front of every tool call, returning allow, ask or block per command and logging the reason and latency behind each decision.
- Stars
- 2
- Language
- TypeScript
- License
- MIT
- Published by
- Community
- Author
- Koushik890
- Last verified
- Oct 2026
About this project
AI agents like Claude Code and Codex run shell commands, read files, and hit the network on your machine. jev-firewall sits between the agent and your system as a PreToolUse hook: every action is checked by deterministic rules plus the Jev decision model, which answers exactly one of allow / ask / block with calibrated confidence. Confident answers act instantly; uncertain ones go to a human.
Quoted from the project's README. Read the full README.
Used inJev for Software & DevTools
- Languages
- TypeScript
Highlights
- Commands are resolved to what the shell would actually run: tree-sitter-bash by default, with a hand-written resolver taking over if the wasm grammar fails.
- Each segment is judged separately, env-var indirection and chained assignments expanded, base64/base32/xxd payloads decoded and eval sinks re-resolved.
- Fails closed, always: a bad config, a failing model call or an unparseable hook payload becomes a block rather than a silent allow.
- An allow below the ask_below threshold, 0.7 by default, becomes ask, and a payload built at runtime escalates even on a 95%-confident allow.
Watch out
Rules can only block or hand off; the only allows are the safe_commands you delegate in config, which short-circuit before any model runs, so a bad entry there is an unreviewed hole. The allow-list catch is upstream rather than this project's: putting Bash in Claude Code's permissions.allow lets commands bypass hook decisions entirely, per the linked upstream issue, and until you remove it the firewall sees nothing. The model layer needs a TypeSafe or Vercel AI Gateway key and adds a network call to every unmatched action; setup validates the key with one live call and refuses to save a rejected one, but a key that is valid and merely behind a billing gate is still saved. Failing closed also means a broken config stops your agent rather than waving commands through. Copy reviewed against the repository README on 2026-10-04, not from running it.
Questions about this entry
Short answers drawn from the linked project or page.
Two ways, and one of them is not this project's fault. Its rule engine parses commands and the model never sees the conversation, so a prompt injection has nothing to phish. But Claude Code permission allow-lists can bypass hook decisions — the README links the upstream issue — so if Bash sits in permissions.allow, commands never reach the hook and the firewall is decoration.
Unsure becomes ask and a human decides; an error becomes block. Any allow whose confidence sits below ask_below, 0.7 by default, is downgraded to ask, and a payload constructed at runtime escalates even when the model is 95% confident. That is the deliberate trade: an unavailable or broken judge stops your agent rather than letting commands run unattended.
You need one for the model layer, and setup validates it with a single live Jev call before saving it to ~/.jev-firewall/.env at mode 0600 so every hook subprocess finds it. The README does not price a call. Commands the rules layer resolves on its own are judged with no network call, which it quotes as roughly 40 ms.
No, and the README calls the sandbox real protection. Sandboxing is walls with no judge inside them; this judges command semantics and stacks on whatever permission mode you already run. workspace-write still confines the agent to the workspace and anything inside it is fair game, and danger-full-access removes the walls — this layer does not put them back.
Run npm install -g jev-firewall then jev-firewall setup. The wizard asks for a TypeSafe direct or Vercel AI Gateway provider, validates the key with one live call, saves it to ~/.jev-firewall/.env at mode 0600, and writes PreToolUse hooks for detected agents.
Commands are resolved into what the shell will execute using tree-sitter-bash with a hand-written fallback: every segment is judged separately, env-var indirection is expanded, base64 payloads are decoded, and eval sinks become their own segments.
An unmatched action goes to the decision model, and an allow below ask_below, default 0.7, becomes ask so a human decides. On any error anywhere it fails closed.
More Jev resources like this
15GitHub stars
Node CLI that lints a file tree against fuzzy natural-language rules in one Markdown file, judging each matched file with a swappable TypeSafe-backed judge.
Jev Agents & MCP#community#jevbest#catalog-import
Community
tyler-dot-earth/patdownTypeScript
tyler-dot-earth/patdownTypeScript6GitHub stars
Shell gate for coding assistants that judges commands by effect and blast radius, asking Jev twelve questions or a chat model, with fast rules first.
Jev Agents & MCP#community#awesomejev#catalog-import
2GitHub stars
Filters long command output for coding agents against a task description, keeping retained lines unchanged and in order, collapsing dropped runs into markers with a saved copy you can print back later.
Jev Agents & MCP#community#awesomejev#catalog-import
Community
ibrahemid/jevpruneTypeScript
ibrahemid/jevpruneTypeScript2GitHub stars
A runtime authorization gateway for agent tool calls: deterministic policy plus six narrow Jev questions produce evidence, then a single-use grant bound to the exact approved action is consumed at execution.
Jev Agents & MCP#community#awesomejev#catalog-import
1GitHub stars
A Claude Code plugin that verifies every tool call before it runs, asking Jev five parallel questions about the plan, scope, prior action and stated intent, then allowing, asking or blocking. Fresh installs ship in audit mode.
Jev Agents & MCP#community#jevbest#catalog-import
Community
getexcited/stepwardenTypeScript
getexcited/stepwardenTypeScript16GitHub stars
Single-command harness that turns a plain-language stack description into synced docs plus blocking hooks for Claude Code, Codex, and Pi, with deterministic presets or one Jev chooser call.
Jev Agents & MCP#community#jevbest#catalog-import
Community
kyu1204/oh-my-harnessTypeScript
kyu1204/oh-my-harnessTypeScriptFrom the Jev community
Posts from builders shipping with Jev right now.