Jev Review

What it does

Jev Review, by Dev Agrawal, reviews a Git diff or a whole codebase using only Jev. It doesn’t call a generative model at all. Instead it runs a staged pipeline of small, typed questions, and code decides what to follow up:

1. A risk matrix of yes/no questions per file for five concerns: correctness, security, reliability, compatibility, and missing tests.
2. File profiles for the strongest signals.
3. Evidence selection: Jev picks the specific diff hunk or source region that supports the concern.
4. Mechanism classification (for security, for example, “Untrusted input can reach an unsafe interpreter or sink”).
5. A severity score on a 0 to 3 scale.
6. For findings above a threshold, a choice of which kind of reviewer should look at it.

Thresholds and limits (follow up signals at 0.7 or higher, route at severity 1.5, request changes at 2) live in one plain config file, which makes the policy easy to read and tune. The questions themselves are carefully written, with explicit “what counts”, examples, and things to ignore, and they’re worth reading as a model for writing Jev questions.

The results go into a saved JSON report and a local dashboard.

Setup

It needs Node 24 or newer, Git, and a TypeSafe key. There’s a single runtime dependency, TypeSafe’s official JavaScript SDK.

npm install
cp .env.example .env   # add TYPESAFE_API_KEY
npm run review:changes:save -- /path/to/repo     # current diff
npm run review:codebase:save -- /path/to/repo    # every JS/TS file in scope
npm run dashboard                                # http://127.0.0.1:4317

There’s no test suite. npm run check type-checks the code and enforces the project’s layered architecture (a small script fails the build on any upward import or cycle). That check passed in our run.

Using it

We created a throwaway Git repository containing a JavaScript change with a disabled access check and a string-built SQL query, then ran both review modes with a real Jev key. As with all our reviews, we describe how the tool behaves, not how Jev judged the code.

• Both modes ran cleanly and saved a report containing the risk matrix, the signals it followed, file profiles, workflow stats, and findings.
• The dashboard served the report from a fixed list of files. Requests for anything else, including .env, returned 404, and non-GET requests were rejected. Responses include a strict Content Security Policy.
• It keeps one report. Both commands write to reviews/latest.json inside the Jev Review folder, so a codebase scan replaces your last diff review. Set REVIEW_FILE to keep them apart.
• It’s scoped honestly. The README says it doesn’t integrate compilers or static analyzers and doesn’t generate explanations, and that findings “are review prompts, not proof of a defect.” That’s the right way to use it: as a triage layer before a person, or a stronger tool, looks closer.

One thing to know if you found it through our directory: an earlier description suggested it hands findings to a heavier model. It doesn’t. The “routing” step picks a reviewer category with a Jev question; no other model is involved.

Permissions and data

• Your code goes to TypeSafe. Diff mode sends the changed hunks of JS/TS files, and codebase mode sends every JS/TS file in scope in chunks of about 160 lines, along with snippets of related tests. Untracked files that aren’t gitignored are included, so a stray local script with credentials in it would be sent too.
• Nothing goes anywhere else. The only network destination in the code is TypeSafe’s API, through the official SDK.
• The dashboard is local. It binds to 127.0.0.1 only. It doesn’t check the Host header of incoming requests, so it has no specific defense against DNS-rebinding attacks from a malicious web page. The exposure is limited to the saved report and only while the dashboard is running, but it’s worth stopping the dashboard when you’re done.
• Reports are written to disk in the tool’s own folder (gitignored there), and include the code or diff of the files with findings.

Maintenance

Five commits on September 17 and no activity since. There are no open issues. It’s MIT licensed. The code is small and cleanly layered, so it’s easy to fork and adapt.

Verdict

Jev Review is a well-structured example of composing many narrow Jev judgments into a real workflow, with policy kept in code where you can see it. It’s a reasonable first-pass screen for JavaScript and TypeScript changes and a good template for your own Jev pipelines. It won’t explain problems or suggest fixes, it ignores other languages, and it sends your code to TypeSafe, so decide whether that’s acceptable for your repository.

For continuous review from inside a coding agent over MCP, see Jev Review MCP, a different project with a similar name. For checking code against conventions you write in plain English, see JevLint. Our best Jev tools roundup covers the tools we’ve tested.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 19, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.