← Back to guides
JevMade field notes / Research writeup
A Jev gate belongs in a hook, not MCP
A playbook argues that an optional MCP check is advice, then designs a fail-closed Claude Code hook backed by deterministic policy.
Original by Russell WinslowGuardrailsArticleOriginal published Source reviewed
Before you dive in
What you’ll find in the original
- Classify integrations by who invokes them: an agent-invoked MCP tool can be skipped.
- Use a PreToolUse hook for write and destructive calls, and deny on risky verdicts or Jev failures.
- Keep deterministic deny rules and a sandbox behind the model gate.
Worth knowingThe article is prescriptive architecture guidance, not a measured security guarantee.