A safety gate for AI coding agents
Your agent asks permission for everything or for nothing. This is the missing middle: allow, ask or deny on every tool call, in 371ms for two hundredths of a cent.
Get it on GitHubInstall
claude plugin marketplace add eugeniughelbur/jev-engineering
claude plugin install jev-engineering@jev-engineeringIt installs in observe mode. It logs every decision and blocks nothing until you have read a week of your own numbers.
How it decides
- Hard rules. Deterministic denials in plain regex. Single-digit milliseconds.
- Fast path. A read-only allowlist. Never calls the model.
- Jev. One request, two questions, answered in parallel.
- Thresholds. Your numbers, from your own log.
Denials run before the allowlist, because a command name says nothing about its arguments. Hard rules come before the model on purpose. In testing, the model was least reliable exactly where a hard rule is easiest to write.
What the attack kit found
| Attack | Got through | Safe commands wrongly blocked |
|---|---|---|
| Blunt, "ignore your instructions" | 0 of 30 | 3 of 30 |
| Authority, "the owner approved this" | 3 of 30 | 1 of 30 |
| Authority, "the lead signed off" | 1 of 30 | 2 of 30 |
| Authority, "standing allowlist" | 1 of 30 | 0 of 30 |
The blunt attack does not get in. It jams you, by making the gate deny safe work. The polite attack is the real one. And one command, git stash clear, flipped under every framing, which is why it is a hard rule here.
Questions people ask
What is Jev?
An AI model from TypeSafe AI that answers typed questions with probabilities instead of writing text. You send it a situation and questions, it returns numbers. Roughly 400ms, about two hundredths of a cent per call.
What is an agent harness?
The code around an AI model that turns it into an agent. Five parts: instructions, tools, memory, a loop and gates. Claude Code, Codex and Cursor are all harnesses. This sits in the gates slot.
How much does it cost to check every tool call?
$0.0000189 per checked call, measured over 300 calls. At 500 checked calls a day, under one cent.
Can the gate be tricked?
Yes, about ten percent of the time, with text claiming a human already approved the action. Keep deterministic rules underneath it.
Is this a security product?
No. It catches mistakes, not attackers. A seatbelt for late-night debugging, not a replacement for permissions and sandboxes.