Organization repository on GitHub
JAST is an experimental SAST (static application security testing) desktop app that uses TypeSafe AI's Jev System One model.
- Forks
- 0
- Last pushed
- Updated Sep 2026
Repo stats from the GitHub API, cached Oct 2026.
CommunityJev Tools & CLIs
Jast
Experimental desktop SAST app that asks Jev reviewable questions about bounded source regions, with Rust handling inventory, bounds, hashing, consent, and persistence.
- Stars
- 1
- Language
- Rust
- License
- MIT
- Published by
- Community
- Author
- turenlabs
- Last verified
- Oct 2026
About this project
JAST is an experimental SAST (static application security testing) desktop app that uses TypeSafe AI's Jev System One model. It differs from traditional SAST in that it does not require semantic rules: instead of a rule library, JAST asks Jev explicit, reviewable questions about bounded source regions. Rust owns every deterministic mechanic: inventory, region bounds, hashing, consent and persistence.
Quoted from the project's README. Read the full README.
Highlights
- Findings are candidate signals with probabilities, not verdicts, with explicit missing-context signal.
- Pins jev-1.13.0 with a configurable candidate threshold defaulting to 0.5 recorded per scan.
- Covers Java, Python, Go, JS/TS, PHP, Rust, and Ruby with fourteen shared checks plus extras.
- Searchable findings with source-region viewer, raw requests, dismissal state, and JSON export.
Watch out
Only macOS is build-tested; source leaves the machine to the TypeSafe API and completed means workload finished, not full audit. Copy reviewed against the repository README on 2026-10-04, not from running it.
Questions about this entry
Short answers drawn from the linked project or page.
Traditional SAST needs a semantic rule library. JAST asks Jev explicit reviewable questions about bounded regions and lets Rust own inventory, bounds, hashing, consent, and persistence.
No. The approach reached Youden's J near eighty percent on the OWASP Java Benchmark with correct prompts, but the digest states that is not what the app achieves today. Treat outputs as candidate signals.
Source leaves your machine to the TypeSafe API after explicit consent bound to inspected input. Keys stay in the OS keychain, never in SQLite, storage, exports, or logs.
Investigations run at most three rounds over already captured source, offering up to eight excerpts and inspecting at most two, with an explicit sufficiency policy before support or reject verdicts.
Only macOS is build- and launch-tested; building needs Rust, Node and the platform Tauri prerequisites. It scans Java, Python, Go, JavaScript, TypeScript, PHP, Rust and Ruby, applying 14 shared checks per region for most languages and 15 for JS, TS and Rust.
Rust builds immutable, inspectable source snapshots, and the UI previews file and region counts, exclusions and the exact source and upload requests; you explicitly authorize sending that snapshot before scanning. Files up to 24 KiB are kept whole, and larger files use byte-bounded regions rather than arbitrary line cuts.
No, by design: every check in a language's pack runs on every region of that language, with no benchmark category oracle or model-based prefilter that silently drops categories. The preview shows language counts and the actual checks per region, and skipped or unsupported files are reported rather than treated as reviewed.
More Jev resources like this
1GitHub stars
Rust Leptos and Axum demo that sends an NCR description to Jev as state with one yes-or-no question per defect code, then sorts suggestions by confidence.
Jev Tools & CLIs#community#github
Community
Alexandre-Borghi/jev-ncr-demoRust
Alexandre-Borghi/jev-ncr-demoRust3.5kGitHub stars
An Elasticsearch-compatible autoindex search layer that optionally sends top hits to TypeSafe Jev and reorders results by relevance scores.
Jev Tools & CLIs#community#rust#search
Community
xerj-org/xerjRust
xerj-org/xerjRust376GitHub stars
Claude Code Trace renders the JSONL session files in ~/.claude/projects/ as browsable conversations with expandable tool calls, MCP tool names, and token counts, with an optional Jev pass that scores agent efficiency.
Jev Tools & CLIs#community#jevbest
Community
delexw/claude-code-traceRust
delexw/claude-code-traceRust56GitHub stars
R.A.I.N. Lab is a local-first research environment. Four constrained perspectives investigate a question, quoted spans are checked against a local paper corpus, and experiments are pre-registered with host code, not a model, deciding pass, fail or inconclusive.
Jev Tools & CLIs#community#jevbest
Community
topherchris420/james_libraryRust
topherchris420/james_libraryRust51GitHub stars
Docker Compose log intelligence stack: Rust ingest and retrieval crates over ClickHouse and Qdrant with a Next.js dashboard, where the decision model is an optional query classifier.
Jev Tools & CLIs#community#jevbest
Community
YEDASAVG/StratumRust
YEDASAVG/StratumRust30GitHub stars
Rust CLI that checks each PDF page for a usable text layer, extracts text pages locally, sends only the rest to an OCR model via LiteLLM, and merges a page-ordered result.
Jev Tools & CLIs#community#jevbest#catalog-import
Community
misbahsy/doc-routerRust
misbahsy/doc-routerRustFrom the Jev guides
Original write-ups on what this entry is for.
The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.
Jev Tools & CLIs#gateway#vercel#cloudflare
Read article
Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.
Jev Tools & CLIs#open-models#local#onnx
Read article
Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.
Jev Tools & CLIs#classification#email#security
Read article
From the Jev community
Posts from builders shipping with Jev right now.