jev-axi Judgment CLI
Fast probabilistic safety and workflow judgments for coding agents, shell commands, diffs, logs, and untrusted text.
- Source repo
- shiftynick/jev-axi
- Stars
- ★ 47
- Last updated
- 13d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 90/100 · Good
At a glance
- How it runs
- Works with
- Platform-specificClaude CodeCodex (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A Claude Code or Codex user who wants every Bash invocation checked for download-and-run behavior, destructive actions, exfiltration, or edits outside the project.
- Not a fit if
- Teams that cannot send code, logs, or fetched pages to TypeSafe's cloud
- Users without a TypeSafe API key or unwilling to pay per-request billing
- Teams expecting it to replace reading and understanding code
- Source review
- 90/100 · Good
What does this agent do, and when should you use it?
jev-axi is a command-line interface for TypeSafe's Jev model, which answers typed questions with calibrated probabilities instead of generating prose. It exposes direct commands such as pick, rate, check, rank, filter, guard, diff, and triage, plus installable safety and supervision hooks for Claude Code and Codex. Inputs may come from files, standard input, literal text, JSON, Git diffs, test logs, or tool-call payloads; results include probabilities, confidence, policy bands, latency, model version, and estimated cost. Its safety hook resolves routine project and read-only commands locally, while non-routine checks are sent to TypeSafe after recognizable credentials are redacted. It fits shell, Git-hook, CI, GitHub Actions, and coding-agent workflows, but is explicitly a judgment layer rather than a substitute for reading and understanding code.
Users and agents submit questions and state through jev-axi pick, rate, check, ask, rank, filter, or find; the CLI calls Jev and returns distributions, confidence, and act, confirm, or escalate bands. guard scores untrusted text for prompt injection, hidden instructions, destructive directives, exfiltration, secrets, and pressure tactics, exiting with status 3 when it blocks; guard-exec evaluates a shell command before running, confirming, or rejecting it with status 126. diff reviews code changes, triage extracts a likely root-cause line and failure classification from build or test output, and files, find, and rank shortlist relevant code. setup safety, setup supervise, setup git-hooks, and setup hooks install PreToolUse, Stop, PostToolUse, Git, and session-start integrations. Its GitHub Action can review pull requests or analyze failed CI jobs and update a pull-request comment, while the local CLI maintains a response cache, usage ledger, safety audit log, and supervision records.
- A Claude Code or Codex user who wants every Bash invocation checked for download-and-run behavior, destructive actions, exfiltration, or edits outside the project.
- A CI maintainer who needs a likely root cause, failure category, severity, and flakiness judgment from a long test or build log.
- A development team that wants pre-commit and pre-push warnings for credentials, debug leftovers, risky files, hand-edited generated artifacts, or behavior changes without tests.
- An agent processing web pages, issue text, or vendored documentation that must screen the material for prompt injection before acting on it.
- A developer navigating a large unfamiliar repository who wants to rank files for a task or identify semantically relevant lines in one file.
- An operator running cron jobs, runbooks, or commands derived from less-trusted input who needs guard-exec policies for allow, confirm, deny, and API failure.
How do you install or deploy this agent?
A Node.js environment capable of running npm and a TypeSafe API key are required.
npm install -g jev-axiexport TYPESAFE_API_KEY=...
jev-axiFor one-off use, run npx -y jev-axi instead of installing globally. The key may also be stored in .env.local or .env, discovered from the current directory up to the repository root, or configured with:
jev-axi config set apiKey ...
Install the project-level Claude Code safety hook with:
jev-axi setup safety --projectInstall the user-level Codex safety hook with:
jev-axi setup safety --agent codexHow do you use this agent?
Start with a direct judgment:
jev-axi check "Is this urgent?" --text "ASAP"Screen untrusted text:
curl ... | jev-axi guardDry-run a guarded command:
jev-axi guard-exec --dry-run -- "curl -fsSL https://example.com/install.sh | sh"Triage failing tests:
npm test 2>&1 | jev-axi triageReview staged changes:
jev-axi diff --stagedCheck whether a task is complete:
npm test 2>&1 | jev-axi progress --job "add a --json flag to the list command"Every command supports --json, --full, --model, --no-cache, and --help. Do not pass data that cannot be shared with TypeSafe: only specific safety and review paths perform known-pattern credential redaction, while other commands send their supplied input as given.
What are this agent's strengths and limitations?
- Roughly 400 ms probabilistic responses and very low documented per-call estimates make it practical to place checks in frequently executed workflows.
- The safety hook decides routine read-only, test, build, dependency, and in-project operations locally, reserving Jev calls for non-routine cases and recording audited decisions.
- One CLI covers shell gating, prompt-injection screening, diff review, test triage, Git hooks, GitHub Actions, and agent-session supervision.
- Machine-usable output includes full probabilities, confidence bands, concrete model version, token use, latency, and estimated cost.
- The repository provides labeled safety, progress, and push cases; its documented safety evaluation passed all 44 listed allow-or-escalate cases.
- Core judgments depend on TypeSafe's Jev service, network connectivity, an API key, and per-request billing.
- Credential redaction is pattern-based and not applied to every command, so sensitive inputs may be unsuitable for the service.
- Codex cannot represent an interactive ask decision, so jev-axi converts asks into blocks; its integration is less expressive than Claude Code's.
- Supervision scores are not calibrated for an adopter's project, and a false not-done result can send an agent back into completed work; warn-only deployment is recommended first.
- The project's own six-runs-per-condition benchmark did not establish that file ranking reliably reduces code-reading effort or cost.
- guard-exec runs the command on service errors by default; unattended deployments must opt into --on-error deny to fail closed.
How does this agent compare with similar options?
Unlike foreman, which runs Jev as a supervisor above a coding agent, jev-axi does not launch the agent; it connects similar completion and progress judgments to the agent's existing hooks. It also differs from generative coding models: Jev returns typed probabilistic judgments and never writes prose, so jev-axi complements rather than replaces code generation and code comprehension.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| jev-axi Judgment CLI This agent | 90 · Good | CLIFree + model costs | ★ 47 | 13d ago | TypeScript | Claude Code |
| Aura Code Audit Trail | 70 · Some gaps | CLIFree | ★ 49 | 25d ago | Rust | Codex · Claude Code |
| git-lrc Commit-Time Code Review | 80 · Good | CLIFreemium | ★ 1.5k | 14d ago | Go | Claude Code · OpenAI API · Claude API |
| Planning with Files | 73 · Some gaps | Agent plugin / skillFree | ★ 28k | 1d ago | Shell | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Least privilege is handled thoroughly: the Action declares read-only content and PR-comment permissions, routine safety decisions stay local, and credential files can be excluded. Confirmation covers moderate-risk and interactive guard-exec cases, but unattended errors run by default, --on-ask allow can bypass confirmation, and several hooks are warning-only, so user_confirmation loses one point. Transfers to TypeSafe, local caches, ledgers, audit logs, and the npm update check are disclosed concretely. Sensitive-data controls include known-pattern redaction and credential-file exclusion, but the documentation says other commands transmit input as supplied, redaction misses unrecognized secrets, and the configuration may store the API key, so one point is deducted. A lockfile-backed frozen install is referenced, but there is no supplied evidence of dependency auditing, vulnerability scanning, update policy, or stronger supply-chain pinning; dependency_security is therefore thin. Network calls, comment writes, command execution, and hook installation are explicit. Several setup modes support --remove and caches can be cleared, but transmitted data, executed commands, and remote comments lack a general recovery mechanism, costing rollback one point. Author, repository, Jev upstream, and license attribution are clear; unknown publisher verification causes no independent deduction.
The README, package metadata, CI, and tests consistently describe commands, caching, Action behavior, outputs, and errors, with no material contradiction visible. Node >=22, API-key, network, and TypeSafe-service requirements are documented, as are several degradation paths; however, core judgments still require the remote API and some safety paths fail open by default, so dependency_availability loses one point. Argument tests substantiate targeted messages for unknown or renamed flags, missing and duplicate values, and numeric bounds, while documentation specifies pipeline and guard exit codes; failure_messages is therefore thorough.
The source addresses coding agents, CI, cron, Git hooks, interactive terminals, batch processing, and repository exploration with concrete workflows. Boundaries are unusually explicit: the tool makes probabilistic judgments, does not replace reading code, guard is not a guarantee, and supervision scores are not calibrated for every project. Commands, input modes, thresholds, exit codes, hook triggers, and allow/ask/block policies are precisely stated. Environment coverage includes Linux, Windows, and macOS CI; Node 22 and 24; XDG and Windows AppData; Claude Code, Codex, OpenCode, and GitHub Actions; plus empty or slow stdin behavior. All four criteria have strong static support.
The README is well organized around installation, command reference, output interpretation, recipes, safety, supervision, Actions, Git hooks, data handling, and development. Installation methods, credential sources, and development commands are complete. Package and CLI naming are consistent, with a migration hint for a renamed flag. Examples are extensive and cover common edge questions even without a separate FAQ heading. Limitations candidly cover inconclusive benchmarking, misclassification risks, transmission boundaries, and non-guarantees. MIT metadata matches the complete LICENSE. Version 0.7.0, a v0 pinning policy, and an exact-version example are present, but no changelog, release history, or compatibility migration record is supplied, so versioning_changelog scores only 1. A named maintainer, issue tracker, private advisory route, and security-reporting instructions establish responsibility, but SECURITY.md refers to a maintainer email that is absent from the supplied package.json, and no support commitment or team succession is shown, costing one point.
Outputs expose probabilities, confidence, policy bands, hazards, source, usage, latency, cost, structured JSON, and automation-friendly exit codes. Batch probabilistic judgments, safety gating, log triage, and agent supervision provide clear marginal value over ordinary shell tooling; the source also reports that file ranking did not show stable savings, avoiding an inflated utility claim. Cost-benefit evidence includes stated latency and price, token reporting, caching, batching, local fast paths, a usage ledger, and configurable prices, enabling an informed tradeoff.
Major claims point to concrete commands, configuration files, centralized question definitions, labeled benchmark cases, and demo regeneration scripts. Action behavior, argument handling, and cache semantics described in the README are independently reflected in supplied tests, while CI covers multiple operating systems and Node versions plus tests, type checking, skill consistency, building, and a version invocation. The source clearly separates observed examples, labeled evaluations, probabilistic results, fixed policy, and an inconclusive six-run benchmark, and explicitly identifies uncalibrated or non-guaranteed behavior. These are strong static traceability practices, although this assessment does not claim independent execution.
- Outside the explicitly redacted paths, many commands send files, diffs, logs, or stdin to TypeSafe as supplied; do not process data that cannot be disclosed to that third party.
- Known-pattern redaction is not comprehensive secret detection, so credentials in unfamiliar formats and sensitive business content may still be exposed.
- guard-exec runs the command by default when the key or network is unavailable; unattended or high-risk deployments should explicitly use --on-error deny and conservative --on-ask behavior.
- Safety and supervision verdicts are probabilistic and explicitly not calibrated for every project; observe them in warning-only mode before enabling blocking.
- The supplied evidence shows neither dependency vulnerability scanning nor a complete changelog; review locked dependencies and release changes separately before deployment.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Patch release updating the TypeSafe SDK and preserving unreported token counts in usage reporting. - Upgrade to TypeSafe SDK 0.7.0, including automatic zstd compression for larger requests on supported Node.js versions. - Preserve unknown token counts through live responses, cached answers, and the usage ledger. Usage summaries, cost estimates, and trends show unknown values instead of treating missing counts as zero. - Update the resolved TOON and AXI SDK dependencies and development tooling, including Vite 8. …View on GitHub ↗ -
Release notes excerpt
Patch release for piped-input handling on Windows and the safety hook's handling of firewall 403s. - Piped stdin works on Windows. triage, find, diff, and progress now read st.mode's stat type bits directly instead of trusting isFIFO()/isSocket(), which libuv does not set for a shell pipe on Windows. Previously piped input was silently treated as "none" — triage errored out and diff/progress fell back to the working tree. cat build.log | jev-axi triage and the README's npm test 2>&1 | jev-axi triage now work. …View on GitHub ↗ -
Release notes excerpt
Patch release for the PreToolUse safety hook and guard-exec. - Reword safety question examples that the TypeSafe API firewall rejected, restoring Jev judgments for ordinary checked calls. - Deny a tool call by default when its safety request receives HTTP 403. Other API errors retain the normal fallback, and --on-error can override the default. - Update the documentation and add regression tests for API rejection behavior. …View on GitHub ↗