Jev Voice

How we reviewed this: we drove its real modules in Docker against a local stand-in and captured the outbound payload. It is macOS-only, so the execution paths — osascript, Quartz, whisper.cpp on Metal — were read, not run, and none of the README’s latency figures could be checked. We made no Jev calls.

What it does

The microphone stays open, whisper.cpp transcribes locally, and one request asks Jev eighteen questions at once: which of fourteen actions this is, which app, which site, which shortcut from a list of 43, and — nicely — which span of the transcript is the text to type, rather than asking a model to write it. Code executes the answer.

The fan-out is the idea worth taking. One round trip produces a whole plan.

The wake word is documented but not enforced

The README says:

the mic stays open and whisper transcribes every utterance locally (~100 ms, nothing leaves the machine). Only utterances that name the assistant (WAKE_WORDS in .env, default Alfred / Jarvis) go to Jev.

Two things are wrong with that sentence.

First, the ordering. When an utterance has no wake word, the code does this:

# No name: let Jev judge whether this is a command for the computer at all.
gate = s.brain.evaluate(text)
ok_cmd = (gate.args.get("addressed", 0) >= UNNAMED_MIN_ADDRESSED
          and gate.confidence >= UNNAMED_MIN_CONFIDENCE)

evaluate() is the request. The transcript has already left the machine before anything judges whether it was meant for the computer.

Second, the thresholds. The code’s own defaults are 0.7 and 0.7. The .env.example that the README and the setup script tell you to copy contains:

UNNAMED_COMMANDS=1
UNNAMED_MIN_ADDRESSED=0
UNNAMED_MIN_CONFIDENCE=0

Both comparisons become >= 0, so the gate always passes. Install it as documented and every sentence spoken near the microphone is sent, and any of them that Jev classifies as an action with confidence above 0.35 is executed — no name, no confirmation. Reported. The addressed probability is computed, printed, and then ignored.

There is no policy layer

Not a reduced one. None. There is no allow-list, no blocked-command list, no confirmation step, and no word matching “confirm” anywhere in the action module. The only gate on execution is a single confidence threshold of 0.35, and behind it sits:

if op == "empty_trash":
    _osascript('tell application "Finder" to empty trash')

Compare macbrow, reviewed in the same batch, which puts empty trash on a blocked list and ships a deliberately blocked seed tool to prove the policy fires.

What does leave the machine is narrower than its peers, at least: the transcript, the frontmost app, and the list of installed apps. It never reads the screen, so no window titles or field values. Nothing is redacted or truncated. If you have ElevenLabs configured, the spoken replies — which contain your search terms and note titles — go to a second vendor and are cached as MP3s.

Verdict

The eighteen-question fan-out is a good pattern and the span-picking is the right instinct. Everything around it is a weekend’s work: one commit, no tests at all, no CI, created and pushed within five seconds.

If you run it, set UNNAMED_MIN_ADDRESSED and UNNAMED_MIN_CONFIDENCE back to the 0.7 the code intended, and know that the trash can be emptied by a sentence you did not address to anything.

For the same idea with a policy layer, see macbrow; for screen reading instead of transcripts, jev-use.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.