Skip to main content
Glama

jev-cognitive-mcp

English · 简体中文

CI License: MIT Python 3.10+ MCP Protocol

Advisory 3+1 Cognitive Hierarchy Toolkit & Model Context Protocol (MCP) Server for Coding Agents (OpenAI Codex CLI, Claude Code, Cursor, Antigravity).

jev-cognitive-mcp provides deterministic Layer-0 DLP/destructive command pre-screening, 5-factor Meta-Controller escalation arbitration, and optional System-1 probabilistic triage (guard, route, verify, rerank) over stdio MCP. All verdicts and routing signals are advisory—the host agent remains responsible for enforcing command blocking, sandboxing, and human-in-the-loop approval gates.


Architecture: The 3+1 Cognitive Hierarchy

flowchart LR
    A["Incoming Agent Action / Task"] --> L0["Layer 0: Deterministic Reflex<br/>(0 network / 0 token cost)<br/>DLP regex & destructive pattern screen"]
    L0 -->|Blocked / Matched| OUT0["Immediate Advisory Verdict"]
    L0 -->|Needs Semantic Triage| S1["System 1: Probabilistic Intuition (JEV)<br/>(Requires external JevBridge)<br/>Guard / Route / Rerank / Verify"]
    S1 --> MC{"Meta-Controller<br/>5-Factor Arbitration"}
    MC -->|High Confidence & Two-Way Door| OUT1["Advisory Fast Path"]
    MC -->|Low Confidence / High Risk| S2["System 2: Host Frontier LLM<br/>(Codex / o3 / Sonnet Thinking)"]
    MC -->|One-Way Door & High Risk| HG["Explicit Human Gate Required"]

Layer

Role

Execution Mode

Responsibility

Layer 0 (Reflex)

Deterministic Code

Local offline (0 tokens, no network call)

Pre-egress regex DLP credential screening (sk-*, ghp_*, glpat-*, AKIA*, Bearer, password=, secret=, api_key=, token=, PEM keys), destructive shell pattern matching (rm -rf /, rm -rf -- /, Remove-Item -Recurse -Force, mkfs, DROP DATABASE, curl | bash), strict schema validation

System 1 (Intuition)

Probabilistic JEV

External JevBridge single-attempt call

Multi-head noul (boolean probability), choice (categorical distribution), and score (0..4 ordinal rubric) evaluations

System 2 (Reasoning)

Host Frontier LLM

Host agent runtime

Complex causal reasoning, multi-file architecture design, subtle debugging

Meta-Controller

Control Plane

Local offline (0 tokens, no network call)

Arbitrates escalation using 5 quantitative signals: Confidence, Risk, Reversibility, Expected Value, and Cost Pressure


Related MCP server: ToolBastion

Core Modules & MCP Tools

  1. jev_guard (jev_kit.guard) — Advisory Pre-Tool Command Risk Screen

    • Evaluates shell commands before execution and returns an advisory action (ALLOW, INSPECT, ESCALATE_HUMAN, or BLOCK).

    • Layer 0 (reflex_only=true or pre-screen): Blocks literal credential egress (SENSITIVE_INPUT_REJECTED) and known destructive shell/PowerShell patterns locally with zero network calls.

    • System 1 (when reflex_only=false): Evaluates is_destructive, is_rce_or_exfil, and is_secret_leak probabilities via JevBridge.

  2. jev_arbitrate (jev_kit.controller) — Offline 5-Factor Meta-Controller

    • Purely deterministic calculation of expected escalation utility from (confidence, risk, reversible, expected_value, cost_pressure). Recommends human_gate on irreversible high-risk actions. Works completely offline.

  3. jev_route (jev_kit.router) — Advisory Task & Model Tier Router

    • Classifies incoming coding prompts into FAST (codex-mini-latest, gpt-4o-mini), STANDARD (gpt-4.1, gpt-4o), or DEEP_REASONING (o3, codex-1) tiers while estimating architectural scope.

  4. jev_verify (jev_kit.verifier) — Caller-Supplied Completion & Acceptance Review

    • Reviews caller-supplied task_spec, implemented_changes summary, and test_results logs to return PASS, ADVISORY, or NEEDS_REVISION. Does not inspect git repositories or run test suites directly.

  5. jev_rerank (jev_kit.reranker) — Bounded Semantic Candidate Reranker

    • Ranks up to 96 caller-supplied code snippets or issue candidates in deterministic batches of 12 while preserving full provenance and failing closed on partial batch errors.


Offline Deterministic Mode vs. External JevBridge Requirement

  • Works 100% Offline (Zero External Dependencies):

    • jev_arbitrate (5-factor Meta-Controller)

    • jev_guard with reflex_only=true (jev-kit guard "<cmd>" --reflex-only)

    • jev-kit init-codex (configuration generator for OpenAI Codex CLI and MCP clients)

    • Pre-egress credential DLP screening inside call_jev() (blocks sensitive tokens before any bridge lookup)

  • Requires External JevBridge Runtime:

    • jev_guard (when reflex_only=false and Layer 0 does not match), jev_route, jev_verify, and jev_rerank invoke jev_cli.py from the local JevBridge runtime directory.

    • Set JEV_BRIDGE_DIR=/path/to/JevBridge/runtime (defaults to %LOCALAPPDATA%\JevBridge\runtime on Windows or ~/.local/share/JevBridge/runtime on Linux/macOS). If the bridge runtime is not installed, these tools fail closed with JevIntegrationError(code="BRIDGE_MISSING").


Quick Start

1. Installation

git clone https://github.com/17671454333/jev-cognitive-mcp.git
cd jev-cognitive-mcp
pip install -e ".[dev]"

2. Wire into OpenAI Codex CLI (~/.codex/config.toml)

Generate the exact TOML snippet with jev-kit init-codex --format toml and add it to ~/.codex/config.toml:

[mcp_servers.jev_cognitive]
command = "jev-mcp"
args = []

3. Wire into JSON MCP Clients (Claude Code, Cursor, Antigravity)

Generate with jev-kit init-codex --format json:

{
  "mcpServers": {
    "jev-cognitive": {
      "command": "jev-mcp",
      "args": []
    }
  }
}

4. CLI Usage & Verification

# Generate OpenAI Codex CLI config.toml snippet
jev-kit init-codex --format toml

# Layer-0 deterministic reflex screen (offline, 0 tokens)
jev-kit guard "rm -rf -- /" --reflex-only

# 5-factor Meta-Controller arbitration (offline, 0 tokens)
jev-kit arbitrate --confidence 0.62 --risk 0.75 --irreversible --value 0.85

# Run deterministic unit test suite
python -m unittest discover -s tests -v

Security & Reliability Boundaries

  • Pre-Egress Credential DLP Chokepoint: Both local_reflex_screen() and call_jev() screen serialized inputs for literal secrets (sk-*, ghp_*, glpat-*, AKIA*, Bearer, password=, secret=, api_key=, token=, PEM private keys, and URL userinfo credentials) and raise SENSITIVE_INPUT_REJECTED before _invoke_bridge() can be called.

  • Zero Direct Credential Arguments: call_jev() rejects explicit api_key, token, or secret keyword arguments (DIRECT_CREDENTIALS_DISABLED).

  • Advisory Boundary: Outputs from jev-cognitive-mcp are advisory structured signals; host agents must enforce execution blocking and human approval gates.

  • No Silent Fallbacks: Timeouts, missing bridge runtimes (BRIDGE_MISSING), or malformed responses raise JevIntegrationError with explicit billing_uncertain tracking rather than defaulting to ALLOW or PASS.

License

Released under the MIT License.

Available Tools

5 tools
jev_arbitrateB

Run the offline deterministic 5-factor Meta-Controller to recommend Layer-0 Reflex, System-1 Intuition, System-2 Deep Reasoning, or Human Gate.

ParametersJSON Schema
NameRequiredDescriptionDefault
riskYesEstimated blast-radius risk (0.0 to 1.0).
confidenceYesSystem-1 confidence (0.0 to 1.0).
reversibleYesTrue if two-way door (reversible).
cost_pressureNoToken/latency budget pressure (0.0 to 1.0).
expected_valueNoExpected value of deep reasoning (0.0 to 1.0).
deterministic_matchNo
requires_causal_proofNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full burden, and it does disclose two meaningful traits: the decision is 'offline' and 'deterministic', which implies a pure, side-effect-free computation with no external calls. However it says nothing about the return shape, whether the result is advisory or binding, or why the schema exposes seven parameters while the text claims five factors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the four candidate outputs are placed where they are most useful. It is dense with internal jargon (Layer-0 Reflex, System-1/System-2) that is never unpacked, which costs a little clarity but not length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a seven-parameter, no-annotation, no-output-schema tool, the description is only marginally complete. Enumerating the four possible recommendations partially substitutes for an output schema, but the description never explains how the numeric inputs combine or what the caller receives, leaving real ambiguity for an agent that must act on the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 71%, so the schema documents most inputs (risk, confidence, reversible, plus defaults like cost_pressure and expected_value), and the description adds no parameter-level meaning at all. The '5-factor' phrasing also conflicts with the seven declared parameters, which could confuse an agent about which inputs actually drive the decision.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run the offline deterministic 5-factor Meta-Controller') and enumerates the four possible recommendation outputs, which tells an agent what the tool produces. It does not distinguish itself from the sibling jev_route, which plausibly also makes routing decisions, so sibling differentiation is missing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use or when-not-to-use guidance. With siblings jev_route, jev_guard, jev_verify and jev_rerank in the same family, an agent has no stated condition for choosing arbitration over routing or guarding; usage must be inferred purely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jev_guardA

Provide advisory risk screening for a shell command using Layer-0 deterministic regex rules and (unless reflex_only=true) System-1 probabilistic evaluation. Does not intercept host execution.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesShell command to inspect.
contextNoOptional rationale or context.
reflex_onlyNoIf true, run only offline Layer-0 deterministic screening (requires no external JevBridge runtime).

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that the result is advisory and non-intercepting, and that evaluation is layered (deterministic regex then probabilistic unless reflex_only), plus the offline/runtime implication of reflex_only. It stops short of describing what the screening produces (score, verdict, findings) or latency/cost characteristics, which is a meaningful gap for a tool with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and capped by the non-interception guarantee. No filler, and the parenthetical mode switch is placed where it is needed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description covers the input side and the safety posture but never explains what the agent receives back or how to act on it. The core purpose is clear, yet the informational contract of the call is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented, and the description largely mirrors that (reflex_only's offline meaning is already in the schema). It adds no syntax, format, or example for 'command' or 'context', so it sits at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('risk screening for a shell command') and specifies the two evaluation layers, which is more than a restatement of the name. It does not explicitly differentiate itself from siblings like jev_route or jev_arbitrate, so an agent still has to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'advisory risk screening' and 'Does not intercept host execution' imply a pre-flight, non-blocking checking context, and the reflex_only clause hints at an offline mode. However, there is no explicit when-to-use/when-not guidance and no reference to the sibling tools for alternative needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jev_rerankA

Rank up to 96 candidate text items against a query in batches of 12 (requires JevBridge runtime).

ParametersJSON Schema
NameRequiredDescriptionDefault
itemsYesCandidate texts to rank.
queryYesSearch or triage query.
top_kNoOptional limit on returned items.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure on its own. It does usefully reveal batching granularity (batches of 12), a hard input ceiling (96 items), and a runtime dependency — genuine operational context — but says nothing about ordering of results, determinism, scoring scale, or what happens when the 96-item limit is exceeded.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler: verb, resource, throughput limit, batching behavior, and runtime prerequisite. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description should explain the shape of the result (ranked list with scores? ordering? top_k default behavior). It covers input constraints well but leaves the return-value contract entirely to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented, establishing a baseline of 3. The description adds the 96-item/batch-of-12 constraint relevant to the items array, but adds no new meaning for 'query' or 'top_k' beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb (rank) and resource (candidate text items against a query), plus concrete limits (up to 96 items, batches of 12). It does not differentiate itself from the sibling tools (jev_guard, jev_route, jev_verify, jev_arbitrate), but the names are distinct enough that confusion is unlikely.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description supplies a precondition ('requires JevBridge runtime') which constrains applicability, but gives no explicit when-to-use/when-not guidance or alternative tooling for ranking-like tasks. Usage is only implied by the verb and the prerequisite.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jev_routeB

Provide advisory task complexity and model tier recommendation (requires configured JevBridge runtime).

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoOptional repository or file context.
task_descriptionYesTask description or prompt.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the behavioral burden. It discloses that output is advisory (non-binding) and requires a configured runtime, but omits error behavior, return format, and whether the operation is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with the prerequisite parenthetically placed. It is tight and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter advisory tool with no output schema, the description states the recommendation types but omits return format specifics and sibling-routing context. It is adequate but leaves gaps in what an agent might need for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters fully. The description adds no additional parameter semantics, which is acceptable given the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Provide') and resources ('task complexity and model tier recommendation'), making it clear what the tool returns. However, it does not explicitly differentiate from siblings like jev_guard or jev_verify beyond the distinct action name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description only provides a prerequisite ('requires configured JevBridge runtime') and offers no guidance on when to use this tool versus alternatives such as jev_rerank or jev_arbitrate. Usage context must be inferred entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jev_verifyB

Review caller-supplied task specification, change summary, and test logs for potential evidence gaps (does not run tests or read git diffs directly; requires JevBridge runtime).

ParametersJSON Schema
NameRequiredDescriptionDefault
task_specYesOriginal task requirements.
test_resultsNoOptional caller-supplied test runner output.
implemented_changesYesCaller-supplied summary of diffs or artifacts.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden, and it does add value by stating the tool is purely analytical (does not run tests, does not read diffs) and has a runtime dependency. It still omits whether the operation mutates anything, what happens on incomplete input, and what the review output looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence packs the action, the inputs, the output goal, and the key limitations without redundancy. The parenthetical is dense but does not wander.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter analysis tool with no annotations and no output schema, the definition covers inputs and scope limits but leaves the response shape (what an 'evidence gap' report contains) and failure/edge behavior unexplained. Adequate but with visible gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each of the three parameters is documented in the schema, so the schema does the heavy lifting. The description restates the same three inputs without adding format, size, or content expectations beyond what is already structured.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (review) and the exact inputs it consumes (task specification, change summary, test logs), plus the goal (detect evidence gaps). It is clear what the tool does, though it never contrasts itself with the sibling jev_* tools, so differentiation relies on inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical gives real boundary conditions — it does not run tests or read git diffs, and it requires a JevBridge runtime — which implies when the caller must supply data themselves. However, it offers no guidance on when to choose this over jev_guard, jev_route, jev_rerank, or jev_arbitrate, leaving routing to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.3.1
    • First observedjev_arbitrate
    • First observedjev_guard
    • First observedjev_rerank
    • First observedjev_route
    • First observedjev_verify

TDQS

A3.7/5.0

Scored across 5 tools

Disambiguation4/5

Each tool has a distinct core action: risk screening (guard), complexity/tier routing (route), text ranking (rerank), evidence-gap review (verify), and layer arbitration (arbitrate). The only mild overlap is between route (model tier) and arbitrate (reasoning layer), which could be confused, but descriptions distinguish them adequately.

Naming Consistency5/5

All tools follow a strict 'jev_' prefix plus a single verb pattern (guard, route, rerank, verify, arbitrate). Fully predictable and consistent throughout.

Tool Count5/5

Five tools is well-scoped for a cognitive decision-support server, with each tool earning its place as a distinct cognitive operation. No redundancy or filler.

Completeness4/5

The surface covers the main cognitive advisory steps: screen, route, rank, verify, and arbitrate. Minor gaps exist (e.g., no explicit memory/state or feedback tool), but core workflows for a decision-support layer are covered.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    A zero-trust security gateway for MCP tool calls, inspecting tool identity, arguments, execution decisions, and returned content before risk reaches your coding agent.
    Apache 2.0
  • A
    license
    A
    quality
    B
    maintenance
    Provides advisory AI-governance checks for MCP hosts and coding agents, enabling policy verdicts, PII masking, and audit traces before executing tool calls.
    3
    37 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables coding agents to make structured local decisions, choose bounded browser actions with approvals, and run coding workflows such as file relevance, context pruning, diff screening, and completion checks through MCP or CLI.
    Apache 2.0