Gate risky coding-agent tool calls

01 · Role in the system

What Jev does here

Before bash, write, or edit calls, Jev scores destructive impact, exfiltration, and scope risk. After selected command results, it checks for leaked credentials and classifies failures so code can append fixed advice. Shadow mode is the default, all error paths fail open, and enforcement requires explicit configuration.

Risk scoring before the tool call, forensics after

The extension brackets the dangerous moments of a coding agent. Before a bash, write, or edit call, Jev scores three risks in parallel — destructive impact, exfiltration, and out-of-scope behavior — and after selected command results, it checks for leaked credentials and classifies failures so code can attach fixed advice. Each side is a batch of narrow judgments over bounded input, not a conversation about safety.

The defaults reveal the design philosophy: shadow mode is on unless enforcement is explicitly configured, and every error path fails open. The tool would rather miss a catch than block a legitimate command, which is the right bias for a first-generation guardrail — and the record is explicit that this calibration is small and proves nothing about production safety performance.

Reading the 203-fixture smoke calibration

The published metric is a smoke calibration across 53 fixtures — 203 requests — which is evidence that the judgment plumbing behaves consistently, not that the guardrail catches attackers. Safety benchmarks need adversarial suites and measured false-positive rates on real workloads; this record has neither, and says so instead of dressing the fixture run up as validation.

One structural caveat deserves attention before anyone copies the pattern: tool arguments and output excerpts are sent to the TypeSafe API, so gating the agent means shipping code snippets and command output to a third party. For some repositories that is an acceptable trade for a second opinion on every destructive call; for others it is disqualifying, and the limitation says which decision each team has to make.

02 · Control boundary

Where Jev sits

Tool intent and bounded output to parallel risk judgments; extension code applies thresholds and user-confirmation policy.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• The smoke calibration is small and does not establish reliable safety performance.
• Failures fail open, and tool arguments or output excerpts are sent to the TypeSafe API.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• y0usaf ↗Community · github · public · checked 2026-09-18