System One Connector

How we reviewed this: we built it from source in Docker, ran go vet, gofmt and its test suite, then drove it over stdio MCP against a local stand-in /v1/systemone that logged every request and could be scripted to fail or answer with rubbish. On 2026-10-01 we re-checked the items cap against the released v0.4.8. Every claim below was read off the wire or off the process. No Jev calls, no API key. Formerly itsmostafa/typesafe-mcp; the old URL redirects, and the earlier version of this page covered v0.4.1.

What it does

evaluate is one static Go binary that runs as an MCP server offering a single tool, also called evaluate. Your agent sends a state and a map of typed questions — noul (yes/no), choice, score — and gets back the endpoint’s answer with probabilities. evaluate setup mcp registers it with Claude Code, Codex, Hermes and Claude Desktop in one command; setup pi writes a TypeScript extension instead, because pi has no MCP client.

It is a connector, not a client library: the reply is the endpoint’s own JSON, passed through.

The JSON handling is the good part

Three things we expected to be sloppy and weren’t. We sent "ticket_id": 9007199254740993, which is 2⁵³+1, and it arrived on the wire as those exact digits — the code discards the MCP SDK’s own decode precisely because it lands JSON numbers in any as float64 and would have rounded it to …992. We wrote choice options in the order zebra, billing, alpha, and both the request and the answer’s probabilities came back in that order rather than alphabetically. And <b>urgent</b> & angry was not rewritten as <b> on the way through.

None of this is visible in a README. All three are the kind of thing that silently corrupts one record in ten thousand, and each has a comment in the source naming the bug it fixes.

min_confidence is the one piece of judgment the connector adds rather than forwards: an abstain threshold applied locally, so below it an answer gains "uncertain": true and a choice becomes "__uncertain__", probabilities kept. A flat three-way distribution and a noul of 0.55 both abstained; 0.98 did not. Asking for it on a score, with a threshold of 1.5, or with an option named __uncertain__ is refused with the caller’s own JSON path, and nothing reaches the network.

One approved call, five hundred requests

items takes a map of records and asks the same questions of each. We sent 500 and counted on the wire: 500 upstream requests, eight in flight, each carrying {"item": …, "context": <your state>} so records cannot see each other, and item ids never appear in any body. Ten of twenty failing gave ten results and ten errors with no tool error; all failing gave one representative error.

All as documented. The part worth stopping on is that the tool is advertised with readOnlyHint: true, which many hosts read as safe to auto-approve, and one auto-approved call can fan out to 500 billed requests.

Fixed in v0.4.8, two days after we reported it. TYPESAFE_MAX_ITEMS now lowers the per-call cap, and we checked it on a live path: with it set to 3, a ten-item call is refused before anything reaches the network — items: 10 items exceeds the limit of 3 per call — while 0, 501 and abc refuse to start at all, with the range in the message. The maintainer added a number we had not measured: because the client retries a 429 or 529 four times, one 500-item call can reach about 2,000 requests. readOnlyHint stays, which we agree with — nothing is mutated — and the items description now warns that the result can exceed the agent’s context window.

The 16 MiB response budget covers the whole batch rather than each reply, so a runaway batch cannot exhaust memory: with every reply at 4 MiB we got three results, nine explicit dropped: batch responses exceed … errors, and a well-formed answer — 12 MiB of it, handed straight to the agent. The cap protects the process, not the context window.

Failure paths

A 200 carrying a proxy’s HTML page is an error, not an answer. Two 429s were retried and the third attempt succeeded about three seconds later, on a 1s-doubling backoff that ignores Retry-After. A 500 is not retried, and its body reaches the agent verbatim. With no key it refuses to start and names both variables it accepts.

What it sends, and what setup writes

Three outbound hosts in the source: the configured endpoint, openrouter.ai on that route, and api.github.com on evaluate update. No telemetry.

Setup registers the server by shelling out to each client’s own CLI, passing your key as a command-line argument: claude mcp add evaluate -s user -e TYPESAFE_API_KEY=…. We ran it against fake clients that logged their argv, and the key was in all three command lines. It therefore lands in each client’s config in plaintext, and is briefly visible in the process table to any other user on the machine. Every TYPESAFE_* variable you have set is forwarded the same way.

Two fixes from our earlier review have held: setup no longer deletes an unrelated MCP server named jev — it only removes and re-adds its own name — and TYPESAFE_BASE_URL and TYPESAFE_MODEL now exist, which is why this review needed no patched line.

Releases pin their actions by commit and stay draft until install.sh has run end to end against them. There is no build provenance attestation, and install.sh takes the archive and the checksums from the same release, so the checksum catches corruption, not substitution.

Verdict

The best-engineered of the single-tool Jev MCP servers we have run, and the care is in the places that don’t show: number precision, key order, HTML escaping, validation that fires before the network. 325 stars, eleven days old, MIT, one maintainer, eight releases, and everything we reported last week fixed within a day.

Before you point it at a funded key, decide whether you want a read-only-hinted tool that can spend 500 requests in one call, and put the key somewhere you are comfortable seeing in a config file. For ten focused tools instead of one general one, see Jev MCP; for the same idea aimed at code review, Jev Review MCP.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Oct 1, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.