Winnow

How we reviewed this: we installed it in Docker, ran its tests and its own demo and doctor commands offline, and read the sidecar’s request handling line by line. We made no Jev calls.

What it does

winnow, by Ghaleb Dweikat, sits between a coding agent and its tool results. Long output is split into blocks of about 25 lines, and each gets one Noul:

Would the assistant have to look at blocks.{id} to accomplish task? Judge only this block, against task and tool.

with a shared error question over the whole output. One request per judged tool result. Everything after that is deterministic: if the error question fires, keep everything; no probability, keep; between the drop and keep thresholds, keep; and if the rewrite wouldn’t save 20%, don’t rewrite.

80 tests pass offline, winnow demo --fake and winnow doctor both work with no key, and the doctor tells you honestly what isn’t configured.

The measurement work deserves calling out. It publishes calibration — including that its expected calibration error is 0.182, and that in the 0.1–0.2 band the content was actually needed 39% of the time — and then tells you to raise the threshold only with your own evidence. Very few projects publish the number that argues against their own default.

The service has no lock on the door

winnow runs a resident sidecar on a loopback port. Reading its request handler end to end, there is no authentication of any kind: do_POST dispatches /shutdown and the hook endpoints directly, with no token check, no origin check, and no content-type check.

That means any process on your machine — and, because a form-style POST needs no preflight, any web page you happen to visit — can:

• send a hook payload of its choosing, which the sidecar will judge using your API key, spending your money and writing attacker-chosen content into its cache; or
• stop the service outright.

The response can’t be read cross-origin, so this isn’t data theft through the browser. It is unauthenticated use of your key, and a trivial denial of service. A shared token in the hook configuration, or a check that the request has no Origin header, would close it.

What it sends, and what it keeps

The state is the task, the tool name with truncated arguments, and the untruncated text of each block being judged, up to 200 blocks or 120,000 characters. The exclusion list covers Read (by path) and Bash (by command pattern) — but not Grep, so a grep through a credentials file is judged like anything else, contents included.

Hidden output is cached in full under your home directory so it can be recovered, with no automatic eviction, and on our run that directory was created world-readable. On a shared machine, that’s every file your agent has read.

Verdict

The thinking here is good — errors protected outright, keeping as the default, a shadow mode, and published calibration that undercuts its own marketing.

Fix the open port before running it anywhere but a single-user machine, add Grep to the exclusions, and tighten the cache permissions. Then it’s a genuinely careful tool.

For the same problem inside Claude Code, see jev-pruner and fast-jev-compaction.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.