jev-code-mode

Typed Jev judgments behind two MCP tools: search and execute.

Agents skip cheap checks such as "is this page an injection?", "does the evidence support this claim?", and "which of these 30 docs answers the question?". A frontier model is too slow and costly to run them on every item, and one MCP tool per check means one model round trip per call.

Promise: one execute call runs a small JavaScript program that composes several validated Jev judgments through your Cloudflare AI Gateway. It returns only schema-checked results.

Quick start

bun install
export JEV_GATEWAY_URL=https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/workers-ai/run/typesafe/jev
export JEV_GATEWAY_TOKEN=<token>
bun start

Register the server with any MCP client:

{ "mcpServers": { "jev": { "command": "bun", "args": ["/path/to/jev-code-mode/src/bin.ts"],
  "env": { "JEV_GATEWAY_URL": "…", "JEV_GATEWAY_TOKEN": "…" } } } }

The model sees two tools. Inside execute:

const screen = await tools.screen_text({ text: page, purpose: 'find pricing' });
if (screen.recommendation !== 'pass') return screen;
return await tools.check_claims({ claims, evidence: page });

Related MCP server: decisions-judge-mcp

Tools reachable inside execute

search returns each tool's JSON Schema input and output.

How it works

MCP client --2026-07-28--> serveStdio / createMcpHandler (MCP TS SDK v2)
  -> mcp-code-mode: search | execute (worker sandbox, tool allowlist)
    -> zod input validation         (reject before any network call)
    -> Jev questions -> AI Gateway  (Workers AI typesafe/jev)
    -> answer validation            (labels, argmax, sum≈1, [0,1])
    -> zod output validation        (reject before returning)

The load-bearing primitive is the three-gate tool wrapper in src/server.ts#callJudgment: input schema, answer validation, output schema. A malformed model answer becomes status: "invalid_response" with action: "review". It never becomes a confident verdict.

Proof

bun run verify          # tsc + biome + 43 tests
bun run gateway:stub &  # deterministic local gateway
JEV_GATEWAY_URL=http://localhost:8791/ JEV_GATEWAY_TOKEN=x bun run prove

The tests connect a real SDK v2 client over Streamable HTTP. The endpoint is strict and modern-only, and the client is pinned to protocol 2026-07-28. Every tool is checked three ways: valid input yields schema-valid output; invalid input is rejected with zero Jev calls; malformed answers fail closed.

bun run prove spawns the real stdio binary. It negotiates 2026-07-28 through server/discover, calls every tool through execute, and writes a receipt to receipts/.

Receipts in this repo:

• receipts/stub-2026-09-23T23-53-07-619Z.json: all six tools pass over stdio against the stub gateway.

• receipts/live-2026-09-23T23-53-11-462Z.json: negative result. The live AI Gateway routed to typesafe/jev and returned 402 Insufficient balance (code 2021). The server surfaced the error as a tool error; it produced no verdict. A live pass is still unproven.

What it does not do

• It enforces nothing. Recommendations are advisory; your agent decides.

• It is not a hostile-code sandbox. execute uses the mcp-code-mode worker VM, which is defense-in-depth. Only the six judgment tools are reachable.

• It does not retry. Network errors surface once with secrets redacted.

• It does not store keys or run a gateway. You provide both.

Edit behavior

Thresholds and limits live in src/policy.ts. Question wording and result shapes live in src/tools.ts.

What this makes possible next

callJudgment works with any { input, output, run } tool. Another notebook can add a judgment by writing one defineTool block, and it gets MCP v2, code mode, and fail-closed validation for free. Unproven until a second consumer exists.

Configure

MIT. Independent project, not affiliated with TypeSafe.