jevgate

Your agent stops to ask permission. jevgate answers in ~300 ms — with a probability, a risk score, and an audit log. It replies with one of the options the prompt itself offers: yes, no, and every "yes, and…" or "no, and…" your harness attached — remember this rule, open this directory, move to this mode. It hands back the one option only you can give — no, do this instead — and anything it isn't sure about.

npx -y jevgate init          # writes the PermissionRequest hook for Codex and Claude Code,
                             # then signs you in from the browser (Google, or a one-time email link)
npm i -g jevgate             # optional: puts `jevgate` on your PATH
jevgate status               # plan, usage, endpoint
jevgate log                  # your last decisions, locally

No token to paste: init opens your browser, you confirm, and the CLI receives its token directly. Codex runs a new hook only after you trust it once — open codex and accept the jevgate hook when it asks. Claude Code only prompts outside auto mode; jevgate answers those prompts.

How a decision is made: the request (the command, the task you gave the agent, the working directory) goes to jevgate's endpoint, which asks Jev — TypeSafe's decision-only model, via Vercel AI Gateway — five typed questions in one ~300 ms call: which of the offered replies you would give, should this be allowed, how risky is it (four levels), how clearly did you authorise it, and what kind of action it is. Saying yes stays the hard part: jevgate allows only when risk is low with high confidence and the action isn't an install or anything destructive, and it only writes a permission change — the one your harness proposed, never one of its own — above a higher bar than a single run, and a higher bar again when that change would be written to settings rather than held for the session. Every kind of suggestion your harness can attach is read the same way: a rule to remember, replace or drop, a directory to open or withdraw, a permission mode to move to. Saying no needs a confident answer that the allow probability doesn't contradict, and cannot carry a permission change of its own — the hook schema allows one only alongside a yes — so a no that was meant to stand is given as a plain no and logged as answered_deny_unpersisted. Everything else, including any error or timeout, returns nothing — your harness then does exactly what it does today.

New accounts get 7 days or 500 decisions free, whichever comes first, with no credit card required. Trial decisions do not reset at the start of a new month. When the trial ends, automatic approvals pause until you subscribe. No automatic charge.

A pause is easy to miss — the agent simply asks you again, as it always did. So jevgate says it out loud. init also writes a SessionStart hook, which checks the plan once an hour and puts a line in the session when there is something to act on: not signed in, trial over, allowance spent. The same line appears at the next approval prompt if the state is first discovered there, and once the allowance passes 80% the count comes with it. Once per session, never more than one in fifteen minutes, and never in place of a decision: the prompt you would have seen is the prompt you get. jevgate status shows the current one. To silence them, set JEVGATE_NOTICE=off (or "notice": "off" in ~/.jevgate/config.json); if your harness shows nothing, JEVGATE_NOTICE=error reports them as a hook error instead, which every harness renders. Email covers the times nobody is at the terminal: one at 80%, one when the allowance or the trial runs out.

One plan: $9/month for up to 500 decisions a month, at up to 300 per minute. The paid allowance resets on the 1st of each month (UTC), with no rollover or overage charges. Subscribe and manage billing at https://jevgate.dev/console.

Powered by Jev (TypeSafe). Not affiliated with TypeSafe, OpenAI, or Anthropic.

For opt-in local evaluation collection, jevgate capture start records full task/tool requests to ~/.jevgate/eval/requests.jsonl for blind human labeling. It refreshes the local hook script and requires an existing hook installation and sign-in. The capture contains no model responses or login token and is not uploaded; task text and tool arguments may still contain sensitive material. Check/redact a copy before sharing. jevgate capture status shows the state and storage use; jevgate capture stop disables it. Storage is capped at 256 MiB.