Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Command-line reference

Generated from --help (jevgate 0.19.0). jevgate man COMMAND prints the same text as a man page.

jevgate

Code review gate that asks TypeSafe Jev small, literal questions about your code

JevGate parses the repository locally and builds small evidence units: a function, a file outline, a pair of copies, a test, a documentation section. It asks TypeSafe Jev short, typed questions about each one, and code, not a chat model, composes the answers into findings. Each finding has a location, a probability and a next step, and undecided answers are reported as uncertain instead of hidden.

Rule groups: maintainability (on by default), tests (with --include-tests), and the opt-in security and documentation groups.

Usage: jevgate <COMMAND>

Commands:
  auth         Save, inspect or remove your TypeSafe API credential
  check        Review code with TypeSafe Jev; exit 1 when the gate fails, 2 when the run is incomplete
  baseline     Accept the findings of the last complete check, so later checks fail only on new ones
  rules        List every rule with its group, default and the question it asks
  init         Write a commented jevgate.toml for this repository (offline)
  completions  Print a shell completion script (offline)
  man          Print a man page in roff (offline)
  mcp          Run a Model Context Protocol server on stdin and stdout, for coding agents
  serve        Serve the latest report as read-only JSON on localhost (run alongside `check --watch`)
  help         Print this message or the help of the given subcommand(s)

Options:
  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version

Workflow:
  jevgate init                              Write jevgate.toml: upload scope, rules and gate
  jevgate auth login                        Save an API key (or set TYPESAFE_API_KEY)
  jevgate check --dry-run --show-requests   Print every request body; no key, no network
  jevgate check                             Review and apply the gate
  jevgate baseline                          Accept current findings; later checks fail only on new ones
  jevgate baseline --merge                  Accept a partial check's findings, keeping the rest
  jevgate baseline mark wrong PATH[:LINE]   Record why a finding was accepted; `baseline stats` counts them

For agents and CI:
  jevgate check --base origin/main                   Only files changed since a revision
  jevgate check --base origin/main --format json     The full report, raw probabilities included
  jevgate check --base origin/main --format github   Annotations and a job summary on GitHub
  jevgate rules --format json                        Every rule and the question it asks

Exit codes:
  0      Gate passed, or no supported file changed since --base
  1      Gate failed
  2      Run incomplete (no key, provider rejection, request budget reached), invalid
         configuration or invalid usage
  128+N  Interrupted by signal N

Files (at the repository root):
  jevgate.toml            Configuration; `jevgate init` writes a commented one
  jevgate-baseline.json   Accepted findings; commit it
  .jevgate/cache/         Answers by request hash; safe to restore and save in CI
  .jevgate/latest.json    The last report, the same JSON as --format json
  .jevgate/report.html    HTML dashboard, with --report

Environment:
  TYPESAFE_API_KEY          API key; takes precedence over every saved credential
  JEVGATE_CREDENTIAL_STORE  Where `auth login` saves: auto, keyring or file
  JEVGATE_CONFIG_DIR        Absolute directory for file-stored credentials
  CI                        When set, --report writes the dashboard without opening a browser
  NO_COLOR, CLICOLOR_FORCE  Turn agent output color off or on where --color is auto

`jevgate <command> --help` explains each command; -h prints a summary. `jevgate completions SHELL`
and `jevgate man [COMMAND]` print shell completions and man pages.

jevgate auth

Save, inspect or remove your TypeSafe API credential

A check finds its key in this order: the TYPESAFE_API_KEY environment variable, then the file named by `check --env-file` (by default the repository's `.env`), then the key saved by `jevgate auth login`. In CI, set TYPESAFE_API_KEY from a secret; nothing needs to be saved.

Usage: jevgate auth <COMMAND>

Commands:
  login   Validate a TypeSafe API key and save it for every repository
  status  Show which credential a check would use; exit 0 when it works, 2 otherwise
  logout  Remove saved credentials; TYPESAFE_API_KEY and repository .env files are left alone
  help    Print this message or the help of the given subcommand(s)

Options:
  -h, --help
          Print help (see a summary with '-h')

Examples:
  jevgate auth login                               Hidden prompt; saved in the OS credential store
  jevgate auth login --with-key < key.txt          Read the key from stdin
  jevgate auth status                              Show which key a check would use and verify it
  jevgate auth status --offline --json             Same, without contacting TypeSafe
  jevgate auth logout

jevgate check

Review code with TypeSafe Jev; exit 1 when the gate fails, 2 when the run is incomplete

Parses the selected files locally, sends small evidence units (a function, a file outline, a pair of copies, a test, a documentation section, a code comment) with short questions, and composes the answers into findings. Unchanged units are answered from `.jevgate/cache`, so a re-run only pays for what changed. Every run writes the full report to `.jevgate/latest.json`, whatever the output format.

Findings are `review` (act on it), `consider` (worth a look) or `note` (optional; never fails the gate). A file whose answers stay undecided is `uncertain`; one that cannot be judged without more evidence is `needs-context`.

Settings resolve in this order: flags, then `jevgate.toml`, then defaults. Upload patterns and budgets in the file are ceilings that flags can only narrow.

Usage: jevgate check [OPTIONS] [PATHS]...

Arguments:
  [PATHS]...
          Files or directories to review [default: discovered application source]
          
          Without paths, JevGate walks the repository (respecting .gitignore) and selects application source in Rust, Python, JavaScript, TypeScript, Go, C#, Ruby, PHP and Java. Tests, generated code and vendored files are classified and skipped with a reason. `upload_allow`/`upload_deny` in jevgate.toml still bound what is sent.

Options:
  -h, --help
          Print help (see a summary with '-h')

Scope:
      --base <REVISION>
          Review only files changed against this Git revision (commit, branch or tag)
          
          Includes committed, staged, unstaged and untracked changes. Deleted files are listed in the report. The revision must exist locally: in CI, check out with full history (for example `fetch-depth: 0`). When no supported file changed, the run is complete and exits 0.

      --include-tests
          Also judge tests: test value, redundancy, and shared logic among tests
          
          Without it, test files are judged only for file organization. Also set by `include_tests = true` in jevgate.toml.

      --context <PATH>
          Related file sent as evidence for shared logic, callers and test subjects (repeatable)
          
          The file must be inside the repository and is sent only with the requests it informs. Also set by `context` in jevgate.toml.

      --source-extension <EXT>
          Also review this file extension as text (repeatable, without the dot)

      --config <FILE>
          Read this configuration instead of <repository root>/jevgate.toml
          
          The repository root is still found from the working directory. Use it in CI to apply a reviewed policy that the change under review cannot edit.

Rules and gate:
      --rule <RULE>
          Select a rule ID, key or group (repeatable) [default: the `default` group]
          
          Groups: maintainability, tests, security, documentation, default (every rule on by default) and all. Naming any rule replaces the configured selection, so add `--rule default` to keep the defaults. Test rules also need --include-tests. `jevgate rules` lists every rule.

      --skip-rule <RULE>
          Deselect a rule ID, key or group (repeatable); applied after --rule and jevgate.toml

      --fail-on <[TARGET=]LEVEL>
          What fails the gate: LEVEL for every rule, or TARGET=LEVEL (repeatable) [default: review]
          
          LEVEL is review, consider (also fails on review), uncertain, or none (advisory; `report` is accepted as a synonym). TARGET is a rule ID, key or group, for example `security=consider`; the most specific target wins. Flags replace `fail_on` and `[rules]` levels from jevgate.toml for the rules they address. Notes and baselined findings never fail the gate. An incomplete run exits 2 regardless of the gate.

Output:
      --format <FORMAT>
          Output format [default: agent; jsonl with --watch; json with --show-requests]

          Possible values:
          - agent:  Ranked findings with locations and next steps, for people and coding agents
          - json:   The full report as one pretty-printed JSON document
          - jsonl:  One compact JSON report per line; one per evaluation while watching
          - github: GitHub Actions annotations and a job summary, then the agent text
          - sarif:  A SARIF 2.1.0 log, for GitHub code scanning and other SARIF readers
          - gitlab: A GitLab Code Quality report, for merge request widgets

      --color <WHEN>
          Color agent output: auto, always or never
          
          `auto` colors a terminal unless NO_COLOR is set, and any output when CLICOLOR_FORCE is set; on Windows, only Windows Terminal and terminals that set TERM count. Other formats are never colored.

          Possible values:
          - auto:   On a terminal, unless NO_COLOR is set; CLICOLOR_FORCE turns it on elsewhere
          - always
          - never
          
          [default: auto]

      --verbose
          Show optional notes, every consider finding and per-file detail in agent output

      --report
          Also write .jevgate/report.html and open it in a browser (not opened when CI is set)

      --dry-run
          List the selected files, rules and planned requests without credentials, network or writes
          
          Planned first-pass requests the cache already answers are counted apart and cost nothing; follow-ups depend on the answers and are not known.

      --show-requests
          With --dry-run, include every initial request body (the exact source and questions)
          
          Follow-up requests depend on answers and are not known in advance.

Model, budgets and cache:
      --model <MODEL>
          TypeSafe model; pin a version for repeatable results [default: jev-1.13.0]
          
          Also set by `model` in jevgate.toml. Answers are cached per model, so changing it re-asks every unit.

      --max-requests <N>
          Stop after this many API attempts in this invocation, watch updates included
          
          Reaching the budget leaves the run incomplete (exit 2) rather than passing on partial evidence. `max_requests` in jevgate.toml is a ceiling this flag can only lower.

      --concurrency <N>
          Maximum simultaneous TypeSafe requests (1-8)
          
          [default: 6]

      --max-file-bytes <BYTES>
          Per-file read limit; a larger file is reported as needs-context, never truncated
          
          [default: 262144]

      --max-context-bytes <BYTES>
          Total bytes of --context files per request; context is never truncated
          
          [default: 32768]

      --cache-ttl-secs <SECONDS>
          Cache lifetime for the jev-latest and jev-preview aliases [default: 3600]
          
          Answers from a pinned model version never expire. Also set by `cache_ttl_secs` in jevgate.toml.

      --refresh
          Ignore cached answers for this invocation and ask again

      --cache-only
          Use cached answers only and never contact TypeSafe; unanswered units leave the run incomplete

      --env-file <FILE>
          Credential file holding TYPESAFE_API_KEY [default: <repository root>/.env]
          
          The TYPESAFE_API_KEY environment variable takes precedence.

Watch:
      --watch
          Keep running and re-check the selected files after each save
          
          Writes .jevgate/latest.json after every evaluation and prints one JSON report per line. Pair with `jevgate serve` or --report.

      --debounce-ms <MS>
          Wait this long after the last save before evaluating
          
          [default: 500]

      --poll-ms <MS>
          How often to look for saves
          
          [default: 250]

Examples:
  jevgate check                                    Discovered application source, default rules
  jevgate check src/billing --verbose              One directory, with notes and per-file detail
  jevgate check --base origin/main --format json   Changed files only, machine-readable
  jevgate check --rule default --rule security     Add the opt-in security group
  jevgate check --rule documentation               Agent instruction files, project docs and code comments
  jevgate check --rule comments                    Only code comments: repeated code, filler, narrated edits
  jevgate check --include-tests                    Also judge test value and redundancy
  jevgate check --fail-on none                     Advisory: never exits 1; exits 2 when incomplete
  jevgate check --fail-on review --fail-on security=consider
  jevgate check --dry-run --show-requests          Exactly what would be uploaded, offline
  jevgate check --cache-only                       Replay cached answers; never contact TypeSafe

Reading the JSON report (--format json or .jevgate/latest.json):
  complete           false when any selected file was not judged; the exit code is then 2
  gate               passed, reasons, new_findings, baselined_findings
  files[].status     clear, note, consider, review, uncertain, needs-context,
                     not-applicable, skipped or error
  files[].findings   rule, strength, line, message, action, locations,
                     concern_probability, fingerprint, baselined
  files[].dimensions per rule: status, unit counts and the units left undecided
  files[].judgments  every raw answer, first pass and follow-ups
  api_requests, paid_input_tokens, paid_output_tokens   this run's usage

jevgate baseline

Accept the findings of the last complete check, so later checks fail only on new ones

Writes `jevgate-baseline.json` at the repository root from `.jevgate/latest.json`. Commit the file. Findings are matched by a fingerprint of rule, path, unit and evidence, so unrelated edits keep them accepted. Offline: no source is read or sent.

A single finding can instead be accepted in the code, with a comment `jevgate: allow(RULE) reason` on its line or directly above it.

Each accepted finding can record why it was accepted: `intended` (right about the code, which is meant to be this way), `later` (right, to fix later) or `wrong` (the finding is mistaken). `baseline stats` turns these reasons into each rule's rate of wrong findings.

Usage: jevgate baseline [OPTIONS]
       jevgate baseline <COMMAND>

Commands:
  mark   Record why accepted findings were accepted
  stats  Count accepted findings by rule and reason, with each rule's rate of wrong findings
  help   Print this message or the help of the given subcommand(s)

Options:
      --merge
          Keep earlier accepted findings for files the last check did not cover
          
          Without it, the file is replaced, so after a `--base` or path-limited check the findings accepted for every other file are dropped. With it, entries for files the check covered, or that were deleted, are replaced by what the check found, and the rest are kept.

      --reason <REASON>
          Record this reason on findings accepted now without one
          
          Findings already accepted keep the reason they have.

          Possible values:
          - intended: The finding is right; the code is meant to be this way
          - later:    The finding is right; it will be fixed later
          - wrong:    The finding is mistaken

  -h, --help
          Print help (see a summary with '-h')

Examples:
  jevgate baseline                                  Accept every finding of the last check
  jevgate baseline --merge --reason later           Accept a partial check's findings as known debt
  jevgate baseline mark wrong src/api/search.ts:41  A mistaken finding
  jevgate baseline mark intended scripts --rule maintainability/hardcoded-values
  jevgate baseline stats                            Wrong findings per rule

jevgate rules

List every rule with its group, default and the question it asks

A rule is named by its ID (`maintainability/shared-logic`), its key (`shared_logic`) or its group (`maintainability`, `tests`, `security`, `documentation`, plus `default` and `all`) anywhere a rule is accepted: `--rule`, `--skip-rule`, `--fail-on TARGET=LEVEL` and `[rules]`.

Usage: jevgate rules [OPTIONS]

Options:
      --format <FORMAT>
          `table` for people; `json` adds scope, evidence unit, version and decision policy
          
          [default: table]
          [possible values: table, json]

  -h, --help
          Print help (see a summary with '-h')

jevgate init

Write a commented jevgate.toml for this repository (offline)

Limits uploads to the detected source and test directories and to agent instruction files, denies credential files, and lists every rule group with its gate level. Review the file before the first paid check.

Usage: jevgate init [OPTIONS]

Options:
      --force
          Replace an existing jevgate.toml

  -h, --help
          Print help (see a summary with '-h')

jevgate completions

Print a shell completion script (offline)

Usage: jevgate completions <SHELL>

Arguments:
  <SHELL>
          bash, zsh, fish, elvish or powershell
          
          [possible values: bash, elvish, fish, powershell, zsh]

Options:
  -h, --help
          Print help (see a summary with '-h')

Examples:
  jevgate completions bash > ~/.local/share/bash-completion/completions/jevgate
  jevgate completions zsh > "${fpath[1]}/_jevgate"
  jevgate completions fish > ~/.config/fish/completions/jevgate.fish
  jevgate completions powershell >> $PROFILE

jevgate man

Print a man page in roff (offline)

Without a command, the page for `jevgate`; with one, the page for that command, such as `jevgate-check`.

Usage: jevgate man [COMMAND]

Arguments:
  [COMMAND]
          A command: auth, check, baseline, rules, init, serve, mcp or completions

Options:
  -h, --help
          Print help (see a summary with '-h')

Examples:
  jevgate man > ~/.local/share/man/man1/jevgate.1
  jevgate man check > ~/.local/share/man/man1/jevgate-check.1
  jevgate man check | man -l -                  Read a page without installing it (man-db)

jevgate serve

Serve the latest report as read-only JSON on localhost (run alongside `check --watch`)

Answers GET requests from local tools, never from a browser page: `/snapshot` (the full report), `/evidence` (findings and context per file), `/context-requests` (evidence a file still needs) and `/changes?since=GENERATION` (what changed since a report generation).

Usage: jevgate serve [OPTIONS]

Options:
      --port <PORT>
          Local port to listen on
          
          [default: 47831]

  -h, --help
          Print help (see a summary with '-h')

jevgate mcp

Run a Model Context Protocol server on stdin and stdout, for coding agents

Offers three tools: `jevgate_check` runs a check in the repository and returns its findings, `jevgate_findings` reads the last report, and `jevgate_rules` lists the rules. Register it with an agent as the command `jevgate mcp`, started in the repository.

Usage: jevgate mcp

Options:
  -h, --help
          Print help (see a summary with '-h')

Examples:
  claude mcp add jevgate -- jevgate mcp       Claude Code, in the repository
  {"mcpServers": {"jevgate": {"command": "jevgate", "args": ["mcp"]}}}
                                              Clients configured with JSON, such as Cursor