x-scanner

How we reviewed this: we loaded the real extension into Chromium 153 in Docker with api.typesafe.ai and openrouter.ai pointed at 127.0.0.1 and verified unreachable, against the project’s own fake server and our own harnesses. We made no Jev calls.

What it does

A Manifest V3 Chrome extension that watches your X timeline and, as each post comes within 800 px of the viewport, sends its text to Jev with six questions attached. The verdict appears as a chip under the post, and a panel in the corner shows the running cost.

The privacy engineering is better than most things with “privacy” in the README. manifest.json:8 grants exactly one host permission:

"host_permissions": ["https://api.typesafe.ai/*"],

There is not a single console. call anywhere in src/. And the key really is out of reach of the page: we ran script in the main world of a fixture page and could reach neither chrome.storage nor chrome.runtime.id, with localStorage empty. The content script lives in an isolated world and does not hold the key itself — it posts {type: "analyze", state} to the background worker.

We also checked what actually goes over the wire across 72 captured requests. PRIVACY.md claims “no author name, handle, post id, media, or engagement numbers”, and that is exactly what we found. The state is the post text, the quoted post’s text if there is one, and whether it is a reply. Nothing else.

That is a rare thing to be able to write. Most privacy documents in this directory describe a different program from the one in the repository.

Protected accounts are not mentioned

PRIVACY.md opens by saying the extension “sends the text of posts you scroll past on X”. The default scope is all (src/shared/settings.ts:16) and the content script matches https://x.com/*.

There are exactly two skip conditions, at src/content/index.ts:123:

if (t.promoted) {
  markSlot(slot, "skipped", "promoted, not analyzed");
  return;
}
if (!t.state.text) {
  markSlot(slot, "skipped", "no text to analyze");
  return;
}

Promoted posts and empty ones. We grepped src/ for protected, private, lock and bookmark and found nothing relevant.

So a post from a protected account — visible to you because its author approved you, and to nobody else — is sent like any other. That text belongs to someone who restricted its audience and has no relationship with either you or TypeSafe. Direct messages are unaffected, since they are not article[data-testid="tweet"].

We are raising it because the rest of the policy is so precise. A reader who checks the field list and finds it accurate will reasonably trust the scope sentence too. Either skip articles under a protected-account indicator, or say plainly that protected posts are included.

Cost

One request per post, six questions packed together. Retries only on 429 and 529, three attempts.

About 92% of each request body is the questions themselves — we measured 2,439 bytes of question JSON against 205 bytes of state on a 173-character post. The README says as much, giving roughly 720 of 906 tokens as the six questions, and our measurement agrees with its order of magnitude. Credit for putting that in the README; it is the kind of number most projects leave for someone else to find.

The consequence is that cost scales with posts scrolled past, not with how much you read, and there is no ceiling. The panel shows what you have spent and does not stop. On a timeline you are skimming, the look-ahead means you pay for posts your eyes never land on.

Verdict

One request per post, no telemetry, no analytics, no server of its own, and a cache keyed on post id so a post you have already passed is not re-sent. For an extension that reads your timeline, this is close to the minimum viable data footprint.

Two things we would want before leaving it on: a skip rule for protected accounts, and a spending cap rather than a counter. Both are reported.

For sentiment on X posts collected server-side instead, see Jev X Sentiment — which stores every post it has ever seen, author handles included.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.