jev-cognitive-mcp
Provides advisory cognitive-hierarchy tools for OpenAI Codex CLI coding agents over MCP: pre-execution command risk screening (DLP/destructive pattern guards), 5-factor escalation arbitration, task routing across OpenAI model tiers (codex-mini-latest, gpt-4o-mini, gpt-4.1, gpt-4o, o3, codex-1), completion verification, and candidate reranking. Includes jev-kit init-codex for generating the Codex config.toml/JSON MCP wiring.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@jev-cognitive-mcpscreen this command for credential leaks: export TOKEN=ghp_abc123"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
jev-cognitive-mcp
English · 简体中文
Advisory 3+1 Cognitive Hierarchy Toolkit & Model Context Protocol (MCP) Server for Coding Agents (OpenAI Codex CLI, Claude Code, Cursor, Antigravity).
jev-cognitive-mcp provides deterministic Layer-0 DLP/destructive command pre-screening, 5-factor Meta-Controller escalation arbitration, and optional System-1 probabilistic triage (guard, route, verify, rerank) over stdio MCP. All verdicts and routing signals are advisory—the host agent remains responsible for enforcing command blocking, sandboxing, and human-in-the-loop approval gates.
Architecture: The 3+1 Cognitive Hierarchy
flowchart LR
A["Incoming Agent Action / Task"] --> L0["Layer 0: Deterministic Reflex<br/>(0 network / 0 token cost)<br/>DLP regex & destructive pattern screen"]
L0 -->|Blocked / Matched| OUT0["Immediate Advisory Verdict"]
L0 -->|Needs Semantic Triage| S1["System 1: Probabilistic Intuition (JEV)<br/>(Requires external JevBridge)<br/>Guard / Route / Rerank / Verify"]
S1 --> MC{"Meta-Controller<br/>5-Factor Arbitration"}
MC -->|High Confidence & Two-Way Door| OUT1["Advisory Fast Path"]
MC -->|Low Confidence / High Risk| S2["System 2: Host Frontier LLM<br/>(Codex / o3 / Sonnet Thinking)"]
MC -->|One-Way Door & High Risk| HG["Explicit Human Gate Required"]Layer | Role | Execution Mode | Responsibility |
Layer 0 (Reflex) | Deterministic Code | Local offline ( | Pre-egress regex DLP credential screening ( |
System 1 (Intuition) | Probabilistic JEV | External | Multi-head |
System 2 (Reasoning) | Host Frontier LLM | Host agent runtime | Complex causal reasoning, multi-file architecture design, subtle debugging |
Meta-Controller | Control Plane | Local offline ( | Arbitrates escalation using 5 quantitative signals: Confidence, Risk, Reversibility, Expected Value, and Cost Pressure |
Related MCP server: ToolBastion
Core Modules & MCP Tools
jev_guard(jev_kit.guard) — Advisory Pre-Tool Command Risk ScreenEvaluates shell commands before execution and returns an advisory action (
ALLOW,INSPECT,ESCALATE_HUMAN, orBLOCK).Layer 0 (
reflex_only=trueor pre-screen): Blocks literal credential egress (SENSITIVE_INPUT_REJECTED) and known destructive shell/PowerShell patterns locally with zero network calls.System 1 (when
reflex_only=false): Evaluatesis_destructive,is_rce_or_exfil, andis_secret_leakprobabilities viaJevBridge.
jev_arbitrate(jev_kit.controller) — Offline 5-Factor Meta-ControllerPurely deterministic calculation of expected escalation utility from
(confidence, risk, reversible, expected_value, cost_pressure). Recommendshuman_gateon irreversible high-risk actions. Works completely offline.
jev_route(jev_kit.router) — Advisory Task & Model Tier RouterClassifies incoming coding prompts into
FAST(codex-mini-latest,gpt-4o-mini),STANDARD(gpt-4.1,gpt-4o), orDEEP_REASONING(o3,codex-1) tiers while estimating architectural scope.
jev_verify(jev_kit.verifier) — Caller-Supplied Completion & Acceptance ReviewReviews caller-supplied
task_spec,implemented_changessummary, andtest_resultslogs to returnPASS,ADVISORY, orNEEDS_REVISION. Does not inspect git repositories or run test suites directly.
jev_rerank(jev_kit.reranker) — Bounded Semantic Candidate RerankerRanks up to 96 caller-supplied code snippets or issue candidates in deterministic batches of 12 while preserving full provenance and failing closed on partial batch errors.
Offline Deterministic Mode vs. External JevBridge Requirement
Works 100% Offline (Zero External Dependencies):
jev_arbitrate(5-factor Meta-Controller)jev_guardwithreflex_only=true(jev-kit guard "<cmd>" --reflex-only)jev-kit init-codex(configuration generator for OpenAI Codex CLI and MCP clients)Pre-egress credential DLP screening inside
call_jev()(blocks sensitive tokens before any bridge lookup)
Requires External
JevBridgeRuntime:jev_guard(whenreflex_only=falseand Layer 0 does not match),jev_route,jev_verify, andjev_rerankinvokejev_cli.pyfrom the localJevBridgeruntime directory.Set
JEV_BRIDGE_DIR=/path/to/JevBridge/runtime(defaults to%LOCALAPPDATA%\JevBridge\runtimeon Windows or~/.local/share/JevBridge/runtimeon Linux/macOS). If the bridge runtime is not installed, these tools fail closed withJevIntegrationError(code="BRIDGE_MISSING").
Quick Start
1. Installation
git clone https://github.com/17671454333/jev-cognitive-mcp.git
cd jev-cognitive-mcp
pip install -e ".[dev]"2. Wire into OpenAI Codex CLI (~/.codex/config.toml)
Generate the exact TOML snippet with jev-kit init-codex --format toml and add it to ~/.codex/config.toml:
[mcp_servers.jev_cognitive]
command = "jev-mcp"
args = []3. Wire into JSON MCP Clients (Claude Code, Cursor, Antigravity)
Generate with jev-kit init-codex --format json:
{
"mcpServers": {
"jev-cognitive": {
"command": "jev-mcp",
"args": []
}
}
}4. CLI Usage & Verification
# Generate OpenAI Codex CLI config.toml snippet
jev-kit init-codex --format toml
# Layer-0 deterministic reflex screen (offline, 0 tokens)
jev-kit guard "rm -rf -- /" --reflex-only
# 5-factor Meta-Controller arbitration (offline, 0 tokens)
jev-kit arbitrate --confidence 0.62 --risk 0.75 --irreversible --value 0.85
# Run deterministic unit test suite
python -m unittest discover -s tests -vSecurity & Reliability Boundaries
Pre-Egress Credential DLP Chokepoint: Both
local_reflex_screen()andcall_jev()screen serialized inputs for literal secrets (sk-*,ghp_*,glpat-*,AKIA*,Bearer,password=,secret=,api_key=,token=, PEM private keys, and URL userinfo credentials) and raiseSENSITIVE_INPUT_REJECTEDbefore_invoke_bridge()can be called.Zero Direct Credential Arguments:
call_jev()rejects explicitapi_key,token, orsecretkeyword arguments (DIRECT_CREDENTIALS_DISABLED).Advisory Boundary: Outputs from
jev-cognitive-mcpare advisory structured signals; host agents must enforce execution blocking and human approval gates.No Silent Fallbacks: Timeouts, missing bridge runtimes (
BRIDGE_MISSING), or malformed responses raiseJevIntegrationErrorwith explicitbilling_uncertaintracking rather than defaulting toALLOWorPASS.
License
Released under the MIT License.
Available Tools
5 toolsjev_arbitrateB
Run the offline deterministic 5-factor Meta-Controller to recommend Layer-0 Reflex, System-1 Intuition, System-2 Deep Reasoning, or Human Gate.
| Name | Required | Description | Default |
|---|---|---|---|
| risk | Yes | Estimated blast-radius risk (0.0 to 1.0). | |
| confidence | Yes | System-1 confidence (0.0 to 1.0). | |
| reversible | Yes | True if two-way door (reversible). | |
| cost_pressure | No | Token/latency budget pressure (0.0 to 1.0). | |
| expected_value | No | Expected value of deep reasoning (0.0 to 1.0). | |
| deterministic_match | No | ||
| requires_causal_proof | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden, and it does disclose two meaningful traits: the decision is 'offline' and 'deterministic', which implies a pure, side-effect-free computation with no external calls. However it says nothing about the return shape, whether the result is advisory or binding, or why the schema exposes seven parameters while the text claims five factors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the four candidate outputs are placed where they are most useful. It is dense with internal jargon (Layer-0 Reflex, System-1/System-2) that is never unpacked, which costs a little clarity but not length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a seven-parameter, no-annotation, no-output-schema tool, the description is only marginally complete. Enumerating the four possible recommendations partially substitutes for an output schema, but the description never explains how the numeric inputs combine or what the caller receives, leaving real ambiguity for an agent that must act on the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 71%, so the schema documents most inputs (risk, confidence, reversible, plus defaults like cost_pressure and expected_value), and the description adds no parameter-level meaning at all. The '5-factor' phrasing also conflicts with the seven declared parameters, which could confuse an agent about which inputs actually drive the decision.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run the offline deterministic 5-factor Meta-Controller') and enumerates the four possible recommendation outputs, which tells an agent what the tool produces. It does not distinguish itself from the sibling jev_route, which plausibly also makes routing decisions, so sibling differentiation is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use or when-not-to-use guidance. With siblings jev_route, jev_guard, jev_verify and jev_rerank in the same family, an agent has no stated condition for choosing arbitration over routing or guarding; usage must be inferred purely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jev_guardA
Provide advisory risk screening for a shell command using Layer-0 deterministic regex rules and (unless reflex_only=true) System-1 probabilistic evaluation. Does not intercept host execution.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Shell command to inspect. | |
| context | No | Optional rationale or context. | |
| reflex_only | No | If true, run only offline Layer-0 deterministic screening (requires no external JevBridge runtime). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that the result is advisory and non-intercepting, and that evaluation is layered (deterministic regex then probabilistic unless reflex_only), plus the offline/runtime implication of reflex_only. It stops short of describing what the screening produces (score, verdict, findings) or latency/cost characteristics, which is a meaningful gap for a tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and capped by the non-interception guarantee. No filler, and the parenthetical mode switch is placed where it is needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers the input side and the safety posture but never explains what the agent receives back or how to act on it. The core purpose is clear, yet the informational contract of the call is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented, and the description largely mirrors that (reflex_only's offline meaning is already in the schema). It adds no syntax, format, or example for 'command' or 'context', so it sits at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('risk screening for a shell command') and specifies the two evaluation layers, which is more than a restatement of the name. It does not explicitly differentiate itself from siblings like jev_route or jev_arbitrate, so an agent still has to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'advisory risk screening' and 'Does not intercept host execution' imply a pre-flight, non-blocking checking context, and the reflex_only clause hints at an offline mode. However, there is no explicit when-to-use/when-not guidance and no reference to the sibling tools for alternative needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jev_rerankA
Rank up to 96 candidate text items against a query in batches of 12 (requires JevBridge runtime).
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Candidate texts to rank. | |
| query | Yes | Search or triage query. | |
| top_k | No | Optional limit on returned items. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavioral disclosure on its own. It does usefully reveal batching granularity (batches of 12), a hard input ceiling (96 items), and a runtime dependency — genuine operational context — but says nothing about ordering of results, determinism, scoring scale, or what happens when the 96-item limit is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler: verb, resource, throughput limit, batching behavior, and runtime prerequisite. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description should explain the shape of the result (ranked list with scores? ordering? top_k default behavior). It covers input constraints well but leaves the return-value contract entirely to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented, establishing a baseline of 3. The description adds the 96-item/batch-of-12 constraint relevant to the items array, but adds no new meaning for 'query' or 'top_k' beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb (rank) and resource (candidate text items against a query), plus concrete limits (up to 96 items, batches of 12). It does not differentiate itself from the sibling tools (jev_guard, jev_route, jev_verify, jev_arbitrate), but the names are distinct enough that confusion is unlikely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description supplies a precondition ('requires JevBridge runtime') which constrains applicability, but gives no explicit when-to-use/when-not guidance or alternative tooling for ranking-like tasks. Usage is only implied by the verb and the prerequisite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jev_routeB
Provide advisory task complexity and model tier recommendation (requires configured JevBridge runtime).
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Optional repository or file context. | |
| task_description | Yes | Task description or prompt. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the behavioral burden. It discloses that output is advisory (non-binding) and requires a configured runtime, but omits error behavior, return format, and whether the operation is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with the prerequisite parenthetically placed. It is tight and wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter advisory tool with no output schema, the description states the recommendation types but omits return format specifics and sibling-routing context. It is adequate but leaves gaps in what an agent might need for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters fully. The description adds no additional parameter semantics, which is acceptable given the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Provide') and resources ('task complexity and model tier recommendation'), making it clear what the tool returns. However, it does not explicitly differentiate from siblings like jev_guard or jev_verify beyond the distinct action name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only provides a prerequisite ('requires configured JevBridge runtime') and offers no guidance on when to use this tool versus alternatives such as jev_rerank or jev_arbitrate. Usage context must be inferred entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jev_verifyB
Review caller-supplied task specification, change summary, and test logs for potential evidence gaps (does not run tests or read git diffs directly; requires JevBridge runtime).
| Name | Required | Description | Default |
|---|---|---|---|
| task_spec | Yes | Original task requirements. | |
| test_results | No | Optional caller-supplied test runner output. | |
| implemented_changes | Yes | Caller-supplied summary of diffs or artifacts. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden, and it does add value by stating the tool is purely analytical (does not run tests, does not read diffs) and has a runtime dependency. It still omits whether the operation mutates anything, what happens on incomplete input, and what the review output looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence packs the action, the inputs, the output goal, and the key limitations without redundancy. The parenthetical is dense but does not wander.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter analysis tool with no annotations and no output schema, the definition covers inputs and scope limits but leaves the response shape (what an 'evidence gap' report contains) and failure/edge behavior unexplained. Adequate but with visible gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each of the three parameters is documented in the schema, so the schema does the heavy lifting. The description restates the same three inputs without adding format, size, or content expectations beyond what is already structured.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (review) and the exact inputs it consumes (task specification, change summary, test logs), plus the goal (detect evidence gaps). It is clear what the tool does, though it never contrasts itself with the sibling jev_* tools, so differentiation relies on inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical gives real boundary conditions — it does not run tests or read git diffs, and it requires a JevBridge runtime — which implies when the caller must supply data themselves. However, it offers no guidance on when to choose this over jev_guard, jev_route, jev_rerank, or jev_arbitrate, leaving routing to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.3.1- First observed
jev_arbitrate - First observed
jev_guard - First observed
jev_rerank - First observed
jev_route - First observed
jev_verify
TDQS
Scored across 5 tools
Each tool has a distinct core action: risk screening (guard), complexity/tier routing (route), text ranking (rerank), evidence-gap review (verify), and layer arbitration (arbitrate). The only mild overlap is between route (model tier) and arbitrate (reasoning layer), which could be confused, but descriptions distinguish them adequately.
All tools follow a strict 'jev_' prefix plus a single verb pattern (guard, route, rerank, verify, arbitrate). Fully predictable and consistent throughout.
Five tools is well-scoped for a cognitive decision-support server, with each tool earning its place as a distinct cognitive operation. No redundancy or filler.
The surface covers the main cognitive advisory steps: screen, route, rank, verify, and arbitrate. Minor gaps exist (e.g., no explicit memory/state or feedback tool), but core workflows for a decision-support layer are covered.
Maintenance
Related MCP Connectors
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
- gatewayOAuthai.sealgate
MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceRuntime safety guardrails for AI coding agents. Checks file access, validates shell commands, and scores your repo's AI safety — all via MCP.6 npm8MIT
- AlicenseNot gradedqualityCmaintenanceA zero-trust security gateway for MCP tool calls, inspecting tool identity, arguments, execution decisions, and returned content before risk reaches your coding agent.Apache 2.0
- AlicenseAqualityBmaintenanceProvides advisory AI-governance checks for MCP hosts and coding agents, enabling policy verdicts, PII masking, and audit traces before executing tool calls.337 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables coding agents to make structured local decisions, choose bounded browser actions with approvals, and run coding workflows such as file relevance, context pruning, diff screening, and completion checks through MCP or CLI.Apache 2.0