A local tool-call guard for Claude Code

When to use this local approach

JevStyle supplies a local Claude Code PreToolUse review integration that proposes allow, ask or deny from a local decision model and explicit rules. It is an additional review signal, not a sandbox. For other fixed-output agent steps, see local replacements for label-only LLM calls.

A hook backed by a local model

This independent JevStyle integration uses a local decision model inside a pre-execution review hook. It adds a scored check to your existing execution controls.

The guard reads a tool’s name and arguments, working directory, project directory, and extracted paths and hosts. It asks four yes/no questions plus a risk score. Configured thresholds and hard rules turn those signals into a verdict.

The strictest applicable verdict wins. Hard rules can make a verdict stricter. Server failure, timeout, or malformed input results in ask. Claude Code’s own permissions still apply.

Start the local server

Use Python 3.10 or newer in a virtual environment. Install the backend for your machine, then keep the server running in this terminal.

# Apple silicon
python -m pip install "jev-style[mlx]"

# Linux, Windows, or an Intel Mac: use this instead
# python -m pip install "jev-style[torch]"

jev-style serve --release 0.8b

The first run downloads the model. Once it is ready, open the local Playground. Run the Python examples in a second terminal with the same environment.

Check the service in a second terminal:

curl -s http://127.0.0.1:8765/healthz
jev-style guard --check "git status"
jev-style guard --check "git push --force origin main"

Install the Claude Code plugin

Inside Claude Code, add the marketplace and install the guard:

/plugin marketplace add lawrence3699/jev-style
/plugin install jev-style-guard@jev-style

Restart Claude Code to load the hook and use /hooks to inspect the installation. Keep the local model server running whenever you use the guard. For project-scoped installation or an explicit hook command, follow the guard setup skill.

Observe before enforcing

Initialize the config file once:

jev-style guard --init-config

In ~/.config/jev-style/guard_config.json, set "dry_run": true to record decisions without enforcing them. Review ~/.local/state/jev-style-guard/guard.jsonl against representative tool calls. When you are satisfied with the configuration, set dry_run back to false.

Replay the bundled labeled calls or provide your own file:

jev-style guard-replay --url http://127.0.0.1:8765 -v
# Your own labelled tool calls:
# jev-style guard-replay --url http://127.0.0.1:8765 --examples my_calls.jsonl -v

Know what the published test establishes

With the 0.8B v3 model and default configuration, the repository reports 77.6% agreement on 49 hand-labeled tool calls. No call labeled deny was allowed; two of sixteen calls labeled ask were allowed. This small authored set tests the bundled examples, not general protection against attacks.

Measure missed unsafe actions and unnecessary prompts separately on your own tool use. Keep the model, rules, thresholds, and test data versioned. The repository describes the test and limitations.

Use it alongside execution controls

A probabilistic guard is an additional review layer, not a sandbox or a security guarantee. Keep operating-system restrictions, tool permissions, and human approval for sensitive actions. Untrusted text inside a tool call can be adversarial; the model can misclassify it.

The guard requires a loopback server by default. Installing the plugin alone does not start the model. If the server stops, expect requests for approval rather than silent permission to proceed.

Common questions

What does the Claude Code guard inspect?

The JevStyle guard examines the proposed tool name and arguments, working and project directories, and extracted paths and hosts. Local model scores and explicit rules produce an allow, ask, or deny result. It supplies a review signal before execution; it does not run the proposed command itself.

Does installing the plugin start the local model?

No. Start the JevStyle local server separately and keep it running while using the guard. The tutorial uses 0.8B v3. The package supports PyTorch on CPU or CUDA and MLX on Apple silicon; use the model selection guide to compare available builds.

What happens when the model server is unavailable?

The guard returns ask on a server failure, timeout, or malformed response. That keeps the failure visible for review. Claude Code’s own permission system still applies; installing this integration does not replace it.

How should I set the guard thresholds?

Begin with dry-run recording, inspect representative proposed tool calls, and label the expected verdicts. Evaluate missed unsafe calls and unnecessary prompts separately before enabling enforcement. Keep the model, hard rules, thresholds, and evaluation data versioned. The published results cover a small authored set and are not a general safety guarantee.

Can a local guard guarantee that a tool call is safe?

No. A probabilistic model can misclassify a call, including one containing adversarial text. This independent JevStyle integration is an additional check. Retain operating-system restrictions, tool permissions, and human approval where required by your workflow; do not use a model score as proof of safety.