Jevbridge

How we reviewed this: we ran it in Docker on Node 22 and 24 with no network, ran its tests, completed an MCP handshake against the server, and replayed its gate with its own code. We made no Jev calls.

What it does

Jevbridge, by tacticocc, exposes Jev to agents over MCP and ACP with three tools: jev_decide (ask a batch of questions in one call), jev_gate (turn answers into execute / confirm / escalate / abort), and jev_computer_use (five questions about a proposed UI action, including “is this next action safe to run without extra confirmation?”).

The packing is the good idea: independent questions share one round trip, which is exactly what this model class is for. The MCP layer is correct — protocol versions, tool listing, error codes, clean failures without a key — and it has no runtime dependencies.

Note that jev_computer_use is not computer use: it takes an array of visible control labels from the caller and returns a choice. Nothing here can see or touch a screen.

The gate was broken twice over

It can’t execute. The server builds its policy object with explicit undefined for the three thresholds, and the gate merges that over its defaults — so the defaults are wiped and every comparison against them is false. Running its own code, the same answers give:

jev_decide (gate embedded)              -> execute
jev_gate, same answers, defaults        -> escalate
jev_gate, same answers, thresholds given -> execute

Two tools disagree about the same answers, and the one the README tells you to call before destructive actions is the one that can’t approve anything.

And when it does execute, the destructive check may not apply. The rule is: confirm if destructiveness is at least 0.62 and confidence is below 0.88. Above that confidence the action is approved regardless. We ran it: a destructiveness of 1.0 at 0.95 confidence returns execute. Since confidence here measures how peaked the distribution is — not how safe the action is — the effect is that the more certain the model is about what to do, the less the “is this dangerous” answer matters.

There is a further trap: in jev_decide, the destructive answer is ignored unless the caller remembers to name it.

Without a key, it makes the numbers up

backend: "auto" is the default everywhere, and with no key it silently falls back to a local keyword scorer. The payload says "backend": "heuristic", but nothing warns the calling model that the probabilities it is about to act on came from word overlap — and the scorer includes the question text in its evidence, so asking “would this spend money or delete data?” about the state “hello world” returns a high number.

Two other things: the environment lookup tries several provider keys in a fixed order regardless of which provider is selected, so a key for one vendor can be sent to another vendor’s endpoint; and upstream error bodies are passed back into the model’s context unfiltered.

Both gate bugs were fixed within hours

We reported the gate and 84fcdc3 landed the same day. Explicit undefined thresholds now fall back to the defaults, so a peaked distribution reaches execute; and destructiveness became an independent gate rather than a clause that a high confidence could outvote — the README’s new line is that “a refund button that spends money comes back confirm, not execute”. Two test files cover both, with a case asserting that a destructiveness of 1.0 still confirms. The repository also gained CI, which it did not have.

The keyword-scorer fallback and the key-order lookup above are unchanged as of this writing.

Verdict

The batching idea and the MCP plumbing are worth reading. The safety story — which is how this project is presented — does not hold: the gate cannot approve, the destructive check is conditional on an unrelated number, and the default offline backend invents its inputs.

If you want the packing behaviour, take jev_decide and write your own policy. Don’t rely on the gate.

For a gate that does hold, see pi-warden and Jev-cu.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.