jev-use

How we reviewed this: we built it in node:24, ran the suite and its stdio smoke test, then drove the real hook gate adapter with Claude Code hook events against a local stand-in — using the package’s own TYPESAFE_BASE_URL, no patching — with the stand-in configured in turn to allow, deny, be unsure, return 503 and be entirely absent. No Jev calls.

What it is

An MCP server plus harness wiring that gives Claude Code, Codex and pi three judgment tools and a PreToolUse gate. npx -y jev-use install wires whichever harnesses it finds; npx -y jev-use doctor checks it; JEV_BACKEND=mock runs the whole thing with no key. Three providers are supported — TypeSafe direct, OpenRouter and Vercel’s AI Gateway — and the judgment path has two runtime dependencies, the MCP SDK and zod.

It is also usable as a library, which is how most people will try it: import { Jev, check, pick, rate }.

The gate, and what it can and cannot do

The design decision worth quoting is in the source: the gate emits a decision only when it wants to tighten.

• allow → no output at all, and the host’s normal permission flow decides.
• escalate → permissionDecision: "ask".
• deny → permissionDecision: "deny".

We drove the shipped adapter with a Bash hook event for rm -rf / and controlled what the “model” said:

the provider…	what the hook emitted
answers allow at 0.97	(nothing — falls through to the host)
answers deny at 0.97	"permissionDecision": "deny" — “Jev gate: denied (confidence 0.97).”
answers allow at 0.30	"ask" — “not sure this is safe (unsure) — please review.”
returns HTTP 503	"ask" — “not sure this is safe (unreachable)”
refuses the connection	"ask" — same
has no key configured at all	(nothing; a stderr line saying fail-open)

Two things follow. First, this gate cannot approve anything: the worst case for a wrong answer is a prompt you would otherwise not have seen, or a deny you have to override. That is a meaningfully different risk profile from an auto-approver.

Second, there is a documentation mismatch worth knowing about. The adapter’s header comment says “Any failure is fail-open (exit 0, no output)”, but a provider that 503s or refuses the connection produces ask, not silence — the engine catches the transport failure and escalates. Only a failure before the call, such as no credentials at all, is silently fail-open. The behaviour is stricter than the comment; we would fix the comment rather than the code.

The state it sends is the tool call and its context: the working directory, the permission mode, and the proposed action’s input, wrapped in “Judge only whether it is safe to run without human review.” If your commands contain secrets, they go to the provider — there is no redaction step here, unlike hermes-jev-approvals.

Engineering

80 tests pass, tsc --noEmit is clean over both the package and the harness configs, and npm run smoke drives the built server over stdio: handshake, three judgment primitives and the gate, all on the mock backend. prepublishOnly runs typecheck, tests and build, so a broken publish takes deliberate effort. Published on npm as 0.7.1, MIT, with an mcpName for the MCP registry.

The numbers, and how they are presented

bench/RESULTS.md is the most carefully hedged measurement document in this batch. It states the date, the machine, the single gateway key, that latency is measured client-side and therefore includes the network, and — the line we would like to see everywhere — “Where two of our own runs disagree the latest complete run is published, never the most flattering one.” Dollar figures are explicitly list price rather than what was charged, because the gateway billed zero for Jev on that key.

docs/evidence.md separates third-party measurements from its own, cites each to the repository that produced it, and warns that the ecosystem is weeks old.

All of those are the author’s and other teams’ numbers. We did not reproduce any of them, and this review publishes none of our own about Jev. What we can say is that the demos are rerunnable scripts in bench/examples/ rather than screenshots, which is the part that makes the rest checkable.

Verdict

The most complete plugin in this batch: three harnesses, a library, an MCP server, a mock mode that needs no key, and a gate whose failure modes we could not get to produce an approval. Install it if you want Jev inside a coding agent without writing the plumbing.

Before you point it at real work, decide whether you are comfortable sending tool inputs to a third party unredacted, and remember that no key means no gate — which is the safe default here, but a silent one.

For the auto-approving counterpart, see Jevvy; for the skills-and-recipes approach, Jev Skills.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 21, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.