jev-guard plugin
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
- 153 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The context of every call and its result goes to the external Jev scoring service
- Hooks are wired into the agent configuration and can block or change its work
- The TypeSafe, Vercel or OpenRouter key is stored in local configuration
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/jev-guardDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The context of every call and its result goes to the external Jev scoring service
- Hooks are wired into the agent configuration and can block or change its work
- The TypeSafe, Vercel or OpenRouter key is stored in local configuration
This is third-party code. Review the repository files before installing.
What it does
jev-guard brings what Claude Code calls auto mode to any coding agent: a classifier reviews actions before they run. Instead of a proprietary model it uses the Jev service: each call gets three typed questions with probabilities (risk, whether the user asked for exactly this, whether the call comes from untrusted content). The policy fits in about twenty lines of code. There are three checks. Before a tool runs, destructive calls are denied, risky ones need approval unless the user just asked for exactly that, and a call carrying out an instruction planted in text the agent read is denied even when it looks harmless. After a tool returns, its result (web pages, files, MCP and command output) is scanned for text aimed at AI agents: injections and canaries. Hits are flagged as untrusted and remembered for the rest of the session. Instruction files (skills, plugins, rules, CLAUDE.md, AGENTS.md) are scanned for hidden behavior such as exfiltration, covert execution or overriding other instructions. It works with Claude Code, Codex, GitHub Copilot CLI, Gemini CLI, Cursor, pi, OpenCode, Antigravity and ACP clients, and the package has no dependencies.
Who it is for. Developers who run agents with broad permissions and want a second line of checks on commands and loaded skills.
Good fit when
- The agent runs with few confirmations and needs a filter for destructive commands
- The agent reads web pages and files that may hide instructions aimed at it
- Before installing someone else's skill you want to scan it for hidden behavior
- One policy has to cover Claude Code, Codex, Cursor and Gemini CLI at once
Not a fit when
- Code and call contents must not leave the machine: scoring runs through the Jev API
- You need a fully offline check with no key and no network
- You need a guarantee: the author calibrated on 21 calls and does not promise to catch everything
Example request
Install jev-guard for Claude Code and check that the command rm -rf ~/ gets deniedLimitations
A key is required: TypeSafe (console.typesafe.ai), Vercel AI Gateway (vck_) or OpenRouter (sk-or-). Every tool call and result goes to the external Jev model for scoring. Node.js 20.3 or newer is required. Codex has no ask confirmation, so it gets a warning instead, and Gemini CLI behaves the same way. Antigravity has not been verified live, and some builds ignore hooks. The model scores are probabilistic, so some calls get a cautious denial or an extra confirmation prompt, and a rare attack can slip through.
How to disable. Remove the plugin with /plugin in Claude Code or its equivalent in your agent, and the npm package with npm uninstall -g jev-guard. Hooks written by jev-guard install live in the agent's user configuration, so remove them from there by hand.
FAQ
How does jev-guard differ from Claude Code auto mode?
It does the same job, but in place of a proprietary classifier it asks the Jev model three typed questions and works in other agents: Codex, Copilot CLI, Gemini CLI, Cursor, pi, OpenCode and ACP. The policy and session memory are shared across them.
What does the check cost?
Per the README, about $0.042 per million input tokens and $0 for output, roughly $0.00004 per call, or about four cents for a thousand calls. These are the author's figures from the model card in Vercel AI Gateway.
How do I check a skill before installing it?
The jev-guard scan-skills command scans instruction files for exfiltration, covert execution and overriding other instructions. The check also runs automatically at session start, on file load and when a skill runs.
What does it take to run?
Node.js 20.3 or newer, a TypeSafe, Vercel AI Gateway or OpenRouter key, and the npm i -g jev-guard and jev-guard key commands. Then jev-guard install writes the hooks into your agent.
How does protection behave in Codex and Gemini CLI?
They have no ask confirmation before a tool runs, so a warning appears instead of a prompt. Blocking of destructive calls still works.
Discussion
No questions or reviews yet.
Related
PluginsVigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
A Claude Code plugin that screens prompts, tool calls and documents for injection and leaks, returning BLOCK, CHALLENGE or ALLOW
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| jev-guard (this card) | no | 153 | |
| AgentGuard | no | 494 | another guard plugin with its own policy |
| HOL Guard | yes | 1,094 | a CLI check before installing agent components |
| Jev-Code-Reviewer | no | 152 | code review on the same Jev model, without a call hook |
README in short
The README explains the auto-mode idea for every agent, gives a table of Jev price and speed with sources, describes the three checks and an install table per agent. Further come the npm package commands, the 21-call calibration and the limits.