How do the risk scores become allow, ask_human or deny?

The README does not say. It names the three outcomes and says risk scores come from Jev, but gives no thresholds, no policy code and no default cutoffs, so whether a borderline score routes to a human or waves through is a detail you have to read out of the repository yourself.

Does it run as an MCP server, or only in the browser?

It is described as a gate for agent tool and MCP calls, but the only command given is npm i && npm run dev, which starts a dev app. No MCP transport, stdio or otherwise, is documented, so the README supports reading this as a local UI you paste calls into rather than something you wire into a running agent.

Where do I put the TypeSafe API key?

Undocumented in the README. It says the risk scores come via TypeSafe Jev but never names the environment variable or .env file to set, which is the first thing you will go looking for after npm i && npm run dev and the one detail to confirm in the source.

Is this usable as a real enforcement gate today?

Not something you can judge from this README. Three lines of description and a dev command tell you the intent — allow, ask_human or deny with risk scores from a decision call — but nothing about persistence, auditing, latency, behaviour on a malformed call, or whether the thresholds were ever validated against real traffic. Treat it as a prototype to read, not a component to deploy.

What are the setup commands for ToolGate?

npm i then npm run dev. The README is three lines and documents no key setup, config file, or API surface beyond those commands.

What language is ToolGate written in?

It is cataloged as TypeScript. The README names no framework, runtime version, or dependencies.

Is ToolGate part of a larger set of Jev demos?

Yes. It is one of eight demos cataloged under the GitHub user ndolinschi, alongside JevPlay, LaneBreak, McpMatch, PulseLane, SpendBrake, SwarmRouter, and TrustGate.

CommunityJev Demos & Experiments

Toolgate — ndolinschi

An agent tool and MCP call gate: paste a planned call plus its context and it returns allow, ask_human or deny with risk scores derived from a TypeSafe Jev decision call.

See highlights

Open github.com

Stars: 2
Language: TypeScript
Published by: Community
Author: ndolinschi
Last verified: Oct 2026

ndolinschi/toolgate

User repository on GitHub

View on GitHub

Agent tool/MCP call gate — allow / ask_human / deny via TypeSafe Jev

Forks: 0
Last pushed: Updated Sep 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

This is one of several Jev listings for the same project. The canonical entry is Toolgate — RiskAverseTech.

About this project

Agent tool/MCP call gate — paste a planned tool call + context → allow / askhuman / deny with risk scores via TypeSafe Jev.

Quoted from the project's README. Read the full README.

Tagscommunity jevbest catalog-import awesomejev

Works forJev for Classification Jev for Tool calling

Used inJev for Software & DevTools

Languages: TypeScript

Highlights

Three outcomes rather than a boolean — allow, ask_human and deny — so a risky call can go to a person instead of passing or failing outright.
You paste a planned tool call plus its context and get risk scores back, which makes this an inspection tool rather than a live enforcement hook.
The verdict comes from a TypeSafe Jev decision call rather than a regex or a policy file you would otherwise have to write yourself.
Setup is a single npm i && npm run dev. The README is three lines and documents no install path, key setup or API surface.

Watch out

The README is three lines long and this entry is written from that alone. What it does state: the project gates agent tool and MCP calls, takes a planned call plus context as input, and returns allow, ask_human or deny with risk scores from TypeSafe Jev. What it does not state matters just as much — there is no documented install path, no mention of where the TypeSafe API key goes, no list of the questions asked, no threshold for how a score becomes allow or deny, no tests and no licence. Those are discoverable by reading the repository rather than the README. Run it with npm i && npm run dev, but expect to read the source before trusting the verdicts on anything real. Copy reviewed against the repository README on 2026-10-04, not from running it.

Questions about this entry

Short answers drawn from the linked project or page.

More Jev resources like this

jevarena

Next.js spectator demo in which two independent Jev agents drive separate Snake browsers through same-origin iframes, clicking indexed direction buttons only, with each board state streamed to a server-only endpoint that returns the chosen target.