Toolgate
Screen agent tool calls with typed Jev risk judgments before policy allows, asks or denies.
Added to Jevfast
How it uses Jev
toolgate builds a redacted state from an eligible tool call, including the tool name, tool input, and available task context, then sends the configured risk questions to Jev. Jev returns a probability for each boolean question as a Noul answer. toolgate compares those probabilities with policy thresholds and returns allow, ask, or deny to the host. Static rules can decide first, and ungated or read-only tools can pass without a Jev request.
What Jev decides
Eight default risk questions for an eligible tool call (illustrative)Example answers · not a recorded Jev response · Source ↗
Question 1 · destructive
YOUR APP
INSTRUCTION
Does this call irreversibly destroy or overwrite data, files, branches, or infrastructure?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 2 · exfiltration
YOUR APP
INSTRUCTION
Does executing this call send local file contents, credentials, or environment variables to a network destination?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 3 · privilege
YOUR APP
INSTRUCTION
Does this call escalate privileges or modify system configuration, credentials, or security settings?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 4 · off task
YOUR APP
INSTRUCTION
Is this call outside the scope of the stated task?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 5 · secret exposure
YOUR APP
INSTRUCTION
Does this action expose or persist credential values outside their intended secure use?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 6 · violates constraint
YOUR APP
INSTRUCTION
Does any part of this action contradict an explicit restriction in the task?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 7 · unresolved choice
YOUR APP
INSTRUCTION
Does this action commit to a consequential choice the task explicitly reserves for the user?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
Question 8 · authorized
YOUR APP
INSTRUCTION
Does the task explicitly call for this specific action on this target and destination?
STATE
A gated tool invocation with task text present, represented by its tool name and redacted tool_input; this makes all eight default question keys applicable. The built state can also include cwd, permission mode, prior prompts, session goal, trusted destinations, or ledger-derived facts when applicable. This chart selects the default risk questions; optional capability questions are not shown.
JEV · NOUL
YesNo
App workflow
- Receive a tool call
A Claude Code PreToolUse hook or MCP tools/call reaches the engine with the tool name, input, and any host-provided session context. Static rules and gating policy determine whether the call needs a Jev decision.
- Prepare state and questions
Redact sensitive values, bound long input, attach available task context, and prepare the default risk questions. When the ledger is enabled, a qualifying file write also gets four capability questions recorded as metadata.
- Ask Jev and apply thresholds
Send one request containing the state and named Noul questions. Map the returned probabilities through the configured deny and ask thresholds, with task authorization able to soften eligible risks.
- Return and record the decision
Return the verdict to Claude Code or the MCP client and write a redacted audit record. For tracked file writes, PostToolUse settles the ledger entry; a later execution call can carry the recorded capability facts.
Why it is interesting
The integration combines readable static rules with a set of calibrated, composable risk questions. It also adds session context and a write-to-execution ledger: write calls can ask separate capability questions, whose results inform a later call that runs the file. This lets the gate distinguish writing potentially risky content from executing it.