Is this a sandbox, or can something just call the tool directly?

It is defense in depth and the README is blunt about it: it shrinks the blast radius of mistakes and prompt injection, but it does not replace containers, least-privilege credentials or your own review. What it intercepts is Claude Code tool calls, through either the mod or the PreToolUse hook, plus MCP traffic routed through its proxy — any MCP client, whether Cursor, Claude Desktop or your own agent. A sufficiently adversarial input can fool any classifier, which is why static rules run before the model.

What stops the model from arguing the gate into approving a bad command?

Two layers. Static patterns run first with first match wins, so rm -rf on / or ~ is denied and curl piped into sh is asked about without any model call at all. Past that, the model is told the tool input and prompt text are untrusted data rather than instructions, and a separate authorized question asks whether the task explicitly calls for this action. The four task-context questions are skipped entirely when there is no prompt to read.

What does this add to every tool call in latency and cost?

Static rules and passthroughs cost about 90 ms and never load the AI SDK, while a real decision takes roughly a second for a fraction of a cent, with every verdict logged alongside its probabilities. The default gated set is Bash, Write, Edit, MultiEdit, NotebookEdit, WebFetch, WebSearch and mcp__.*; read-only tools never cost a model call. /toolgate shows the audit summary for the session.

What happens in unattended mode when it wants to ask me something?

Claude Code tells the hook which permission mode it is in. In bypassPermissions and dontAsk an ask would be auto-resolved without you ever seeing it, so by default it becomes a deny there with the reason fed back to the model; unattended.ask: ask turns that off. Auto mode is not treated as unattended, so a hook ask still surfaces a permission dialog there.

How do I install and set it up?

npm install -g @riskaverse/toolgate, export a TypeSafe, OpenRouter or Vercel AI Gateway key, then toolgate init writes ~/.toolgate/toolgate.yaml, saves the key at mode 0600, merges the hook into ~/.claude/settings.json and runs doctor to prove the chain. Then reopen Claude Code.

What does it actually ask?

Seven risk questions plus one mitigator: destructive, exfiltration, privilege, secret_exposure, off_task, violates_constraint and unresolved_choice, then authorized, which asks whether the stated task explicitly calls for the action and can soften a verdict one step.

Can I measure before enforcing?

Yes. A shadow mode records every verdict without enforcing it, and /toolgate shows the audit summary for the session, which is the documented way to see what it would have done before turning it on.

CommunityJev Practices & Patterns

Toolgate — RiskAverseTech

A calibrated tool-call firewall for coding agents: seven typed risk questions plus one question about whether the task authorized the call decide whether a Bash, Write or MCP action runs, asks, or is denied.

See highlights

Open github.com

Stars: 22
Language: TypeScript
License: MIT
Published by: Community
Author: RiskAverseTech
Last verified: Oct 2026

RiskAverseTech/toolgate

Organization repository on GitHub

View on GitHub

Open auto mode for AI agents — a calibrated tool-call firewall powered by TypeSafe Jev. Ships as a Claude Code hook

Forks: 1
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

Open auto mode for AI agents. A calibrated tool-call firewall that runs as a Claude Code mod (or PreToolUse hook) or as an MCP proxy in front of any MCP server (Cursor, Claude Desktop, custom agents): before the agent runs a risky action, toolgate asks a decision model — TypeSafe's Jev, through its API directly, via OpenRouter's Decisions API, or via Vercel AI Gateway — seven questions and acts on the probabilities. It is the "permissions / approval" pattern TypeSafe's CEO describes in his public memo on a…

Quoted from the project's README. Read the full README.

Tagscommunity awesomejev catalog-import

Works forJev for Classification Jev for Tool calling

Used inJev for Software & DevTools

Languages: TypeScript

Highlights

Runs three ways — a Claude Code mod, a PreToolUse hook, or an MCP proxy in front of any MCP client; run the mod or the hook, not both.
Linear-time static patterns run first with zero model calls, and ungated or read-only tools never load the AI SDK.
Task context comes from the latest prompt and the two before it, so a bare 'go ahead' does not authorize destruction.
fail_mode picks ask, deny or passthrough when the model is unreachable, and an internal error always answers ask.

Watch out

This is defense in depth, not a sandbox: the README says it shrinks the blast radius of mistakes and prompt injection but does not replace containers, least-privilege credentials or your own review, and that a sufficiently adversarial input can fool any classifier. An allow is advisory, since Claude Code's own deny rules and always-confirm list still apply on top. Defaults are deny at 0.85, ask at 0.55 and authorization at 0.8, and the soften logic has a subtlety worth reading: secret exposure, explicit prohibitions and reserved choices can never be softened by a task, yet an unsoftenable axis keeps its scored verdict, so a prohibition the model rates at ask level yields ask rather than deny. passthrough is offered as a fail mode and not recommended. Copy reviewed against the repository README on 2026-10-04, not from running it.

Questions about this entry

Short answers drawn from the linked project or page.

Other listings of this project

Forks and copies of this project in the directory. This entry is the canonical one.

toolgate

An agent tool and MCP call gate: paste a planned call plus its context and it returns allow, ask_human or deny with risk scores derived from a TypeSafe Jev decision call.

Jev Demos & Experiments#community#jevbest#catalog-import

Community

ndolinschi/toolgateTypeScript

More Jev resources like this

jev-agent-authorization

Starter kit putting Kinde identity plus Jev judgment in front of every agent tool call, with allow, hold-for-approval, or deny decided in code and written to a ledger first.