Jev (TypeSafe AI) in Claude Code and MCP: which server, hook or plugin fails open?

# bash, pool-authored; run in a temporary directory with the two hook files
run(){ echo "--- case: $1"; shift; start=$(date +%s%N)
  out=$(echo "$PAYLOAD" | env -i PATH=$PATH "$@" node hooks/pretooluse-guardrail.mjs 2>err.txt); code=$?
  end=$(date +%s%N); echo "exit=$code ms=$(( (end-start)/1000000 ))"; echo "stdout=$out"; echo "stderr=$(cat err.txt)"; }
PAYLOAD='{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"git push origin main"}}'
run "A no key, no env (default base 127.0.0.1:8009, closed)"
run "B no key, JEV_BASE_URL=http://127.0.0.1:9 (closed)" JEV_BASE_URL=http://127.0.0.1:9
PAYLOAD='{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"ls -la"}}'
run "C non-high-stakes command, closed port" JEV_BASE_URL=http://127.0.0.1:9
PAYLOAD='{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf / --no-preserve-root"}}'
run "D rm -rf / (not in high-stakes regex), closed port" JEV_BASE_URL=http://127.0.0.1:9

--- case: A no key, no env (default base 127.0.0.1:8009, closed)
exit=0 ms=159
stdout={"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":"jev guardrail: could not reach http://127.0.0.1:8009 (fetch failed); skipping review."},"systemMessage":"jev guardrail unreachable, skipping review: fetch failed"}
--- case: B no key, JEV_BASE_URL=http://127.0.0.1:9 (closed)
exit=0 ms=152
stdout={"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":"jev guardrail: could not reach http://127.0.0.1:9 (fetch failed); skipping review."},"systemMessage":"jev guardrail unreachable, skipping review: fetch failed"}
--- case: C non-high-stakes command, closed port
exit=0 ms=83
--- case: D rm -rf / (not in high-stakes regex), closed port
exit=0 ms=73

File hashes: lib.mjs sha256 2064e808…089e; pretooluse-guardrail.mjs sha256 d6890148…d079. Empty stderr lines are omitted from the output above.

• Install: claude plugin marketplace add typesafe-ai/skills, then claude plugin install typesafe@typesafe-ai. Other agents: npx skills add typesafe-ai/skills --skill typesafe-ai ("project-local by default; add -g to install globally"). Source: docs.typesafe.ai/agent-skill. Documented
• The tree at the tag has 9 entries: marketplace and plugin manifests, README, licences and one SKILL.md (about 150 lines). The skill says "The live TypeSafe docs are the source of truth" and "Keep API credentials server-side in web apps" (SKILL.md). Any Jev call you see after installing it is made by your agent, not by the plugin. Licence MIT.
• The skill links a v1 migration guide that returns 404. This is open issue #13, and the pool confirmed the 404 on 29 Sep. Issue #2 asks that the skill stop triggering on "TypeScript" requests. Reported
• Whether claude plugin install installs for the user or the project is not stated in TypeSafe's docs and was not tested.

• Fail-open helper: every exception (no key, unreachable, 8,000 ms abort, non-2xx, invalid JSON, missing fields) prints a warning and exits 0 (lib.mjs L46–61; pretooluse-guardrail.mjs L24–85).
• Mapping: Choice risk (safe / moderate / dangerous) and Noul needs_human. "dangerous" with confidence ≥ 0.6 → deny.
• Stop hook: SHOULD_BLOCK = false. A local log ~/.claude/jev-quality-log.jsonl stores scores, cwd, session ID and a 200-character preview (stop-guardrail.mjs).
• Defaults: JEV_BASE_URL=http://127.0.0.1:8009, JEV_API_KEY="local", JEV_MODEL="kev-latest" (index.ts L16–18). No retries, no tests. package.json says MIT, but there is no LICENSE file.

• Defaults: mode: 'shadow', timeoutMs: 1500, failOpen: true, redaction on (config.mjs). Shadow mode turns every decision into allow (policy.mjs L81–105).
• Missing key, timeout, non-2xx or "no usable answers" all count as failure (jev-client.mjs). An 8 s watchdog exits with "allowing" (entry.mjs).
• Payload built in run.mjs L131–139. Redaction masks private keys, cloud and chat tokens, sk-… keys, JWTs and *SECRET/TOKEN/PASSWORD/API_KEY= values. Results are cached for 60 s under .jev-guard/ in the project directory.
• A deterministic rule floor runs first, with or without Jev; a test asserts rm -rf / is blocked with no key, in enforce mode. The manifests name a different owner (bruno-ship-it); this was not investigated.

• Malformed or missing answers become status: "invalid_response" with recommendation: review (index.ts L296–372). Error texts redact the configured key.
• Transports: OpenRouter, Cloudflare and compatible endpoints use one 60 s deadline, up to 3 attempts, retrying 408/409/429/5xx with 0.5–4 s jittered backoff (provider.ts L28–49). TypeSafe direct and Vercel go through @jkudish/jev-agent-tools, which was not read: timeout and retries unknown.
• "The server never blocks on its own; enforcement stays with the calling agent" (README L242). Reported
• Node ≥ 22; depends on @typesafe-ai/sdk ^0.6.0. Extensive mocked tests exist; not run by the pool.

• Class langchain_typesafe.experimental.middleware.AutoModeMiddleware, installed with the [experimental] extra. It was read from the PyPI source distribution, not installed. The release tag langchain-typesafe==0.0.1a3 is commit 4af7ab8, read for framework integrations on 5 Oct 2026.
• "Classification failures propagate and the tool handler is not called, so failures are fail-closed." "This middleware blocks risky calls; it does not request human approval." (auto_mode.py L94–98)
• Timeout 30 s; no retry code (classifier.py L36–38). This matches the single-attempt row on Errors and rate limits. With no key, TypeSafeClassifier() raises "TypeSafe API key is required" (classifier.py L255–265).
• Payload: messages[-30:], the tool call id, name and full arguments, and the tool description (auto_mode.py L170–182). The trace policy hides this payload from LangChain traces only.

• Configuration: OMC_JEV=off or a list of points; OMC_JEV_TIMEOUT_MS default 250 (2,000 from v5.6.0); OMC_JEV_EXCERPT_CHARS default 200; ACTIVATED_POINTS is empty, so enabled points run in shadow (config.ts L1–31). Model jev-latest is hard-coded.
• On timeout, HTTP error or invalid response the heuristic "twin" decides and the call is logged as degraded (resolver.ts). The project's decision record rejects fail-closed: "blocking the orchestration on an external judgment API would make OMC hostage to one dependency" (ADR 03665).
• Timeout history: PR #4092 raised it to 2,000 ms and was merged on 22 Sep, 22:21 UTC, into the dev branch. On 29 Sep, v5.5.0 and main still set 250 ms (L27); only dev set 2,000 ms (L36). The change was released in v5.6.0 on 1 Oct 2026 (config.ts L36 at e74b22c, read 3 Oct). v5.6.0 also adds environment activation (OMC_JEV=<point>:active, commit 3681dcb3, #4093) and fixes the request shape (lowercase types; Score criteria sent as a list). Documented
• No retries ("the interactive path degrades instead"). Tests use injected fetch stubs; not run by the pool. Which hook events each point runs in (points.ts) was not read.

• Pin 7349bc9 (3 Oct). HEAD checked by git ls-remote on 6 Oct 2026, 05:20:19 UTC (R9-S70): HEAD 7349bc9 = run-7 pin; failure files unchanged. Cells from the run-7 read of the source, 4 Oct 2026 (R7-S85). Documented
• Default gate_mode "enforce" (register.ts L88, L222). Timeout 1,500 ms (policy.ts L37). No key (register.ts L333–341), timeout (L360–365) and errors (L377–381) fall back to Claude Code's built-in classifier. Malformed answers: typesafe.ts L54–74; register.ts L198. Thresholds and defer: policy.ts L27–42, L423–445.
• Bypass: engine already decided or not auto mode (register.ts L305–316); tools other than Bash, WebFetch and WebSearch; secrets, too-long or empty input (policy.ts L28, L348–383); measure mode; cache hits reuse a stored verdict. Opt-in logs in enforce mode; a write failure never affects the decision (register.ts L47–70). 4 test files; not read.

• Pin 7c7b1b5 (1 Oct; Show HN 49919953, 1 Oct). HEAD checked by git ls-remote on 6 Oct 2026, 05:20:19 UTC (R9-S70): HEAD 7c7b1b5 = run-7 pin; failure files unchanged. Cells from the run-7 read of the source, 4 Oct 2026 (R7-S84). Documented
• Returns verdict; not a decision: the jev-guard CLI prints Decision: <ACTION> and exits 0 for allow, review and block (cli.js L31–41); it exits 1 only when evaluation throws (L41) or input is over 20,000 characters (L28). The demo server returns the analysis as JSON and enforces nothing (web-server.js L76–100). A CI step that runs jev-guard fails only on an error, not on a "block" verdict.
• No key, 30,000 ms timeout, HTTP errors and malformed answers all throw (guard.js L50–71). Thresholds 0.4 and 0.8 are set in code (policy.js L32, L42–45). No audit log; tests stubbed, not run.