Command-line reference
Generated from --help (jevgate 0.19.0). jevgate man COMMAND prints the same text as a man page.
jevgate
Code review gate that asks TypeSafe Jev small, literal questions about your code
JevGate parses the repository locally and builds small evidence units: a function, a file outline, a pair of copies, a test, a documentation section. It asks TypeSafe Jev short, typed questions about each one, and code, not a chat model, composes the answers into findings. Each finding has a location, a probability and a next step, and undecided answers are reported as uncertain instead of hidden.
Rule groups: maintainability (on by default), tests (with --include-tests), and the opt-in security and documentation groups.
Usage: jevgate <COMMAND>
Commands:
auth Save, inspect or remove your TypeSafe API credential
check Review code with TypeSafe Jev; exit 1 when the gate fails, 2 when the run is incomplete
baseline Accept the findings of the last complete check, so later checks fail only on new ones
rules List every rule with its group, default and the question it asks
init Write a commented jevgate.toml for this repository (offline)
completions Print a shell completion script (offline)
man Print a man page in roff (offline)
mcp Run a Model Context Protocol server on stdin and stdout, for coding agents
serve Serve the latest report as read-only JSON on localhost (run alongside `check --watch`)
help Print this message or the help of the given subcommand(s)
Options:
-h, --help
Print help (see a summary with '-h')
-V, --version
Print version
Workflow:
jevgate init Write jevgate.toml: upload scope, rules and gate
jevgate auth login Save an API key (or set TYPESAFE_API_KEY)
jevgate check --dry-run --show-requests Print every request body; no key, no network
jevgate check Review and apply the gate
jevgate baseline Accept current findings; later checks fail only on new ones
jevgate baseline --merge Accept a partial check's findings, keeping the rest
jevgate baseline mark wrong PATH[:LINE] Record why a finding was accepted; `baseline stats` counts them
For agents and CI:
jevgate check --base origin/main Only files changed since a revision
jevgate check --base origin/main --format json The full report, raw probabilities included
jevgate check --base origin/main --format github Annotations and a job summary on GitHub
jevgate rules --format json Every rule and the question it asks
Exit codes:
0 Gate passed, or no supported file changed since --base
1 Gate failed
2 Run incomplete (no key, provider rejection, request budget reached), invalid
configuration or invalid usage
128+N Interrupted by signal N
Files (at the repository root):
jevgate.toml Configuration; `jevgate init` writes a commented one
jevgate-baseline.json Accepted findings; commit it
.jevgate/cache/ Answers by request hash; safe to restore and save in CI
.jevgate/latest.json The last report, the same JSON as --format json
.jevgate/report.html HTML dashboard, with --report
Environment:
TYPESAFE_API_KEY API key; takes precedence over every saved credential
JEVGATE_CREDENTIAL_STORE Where `auth login` saves: auto, keyring or file
JEVGATE_CONFIG_DIR Absolute directory for file-stored credentials
CI When set, --report writes the dashboard without opening a browser
NO_COLOR, CLICOLOR_FORCE Turn agent output color off or on where --color is auto
`jevgate <command> --help` explains each command; -h prints a summary. `jevgate completions SHELL`
and `jevgate man [COMMAND]` print shell completions and man pages.
jevgate auth
Save, inspect or remove your TypeSafe API credential
A check finds its key in this order: the TYPESAFE_API_KEY environment variable, then the file named by `check --env-file` (by default the repository's `.env`), then the key saved by `jevgate auth login`. In CI, set TYPESAFE_API_KEY from a secret; nothing needs to be saved.
Usage: jevgate auth <COMMAND>
Commands:
login Validate a TypeSafe API key and save it for every repository
status Show which credential a check would use; exit 0 when it works, 2 otherwise
logout Remove saved credentials; TYPESAFE_API_KEY and repository .env files are left alone
help Print this message or the help of the given subcommand(s)
Options:
-h, --help
Print help (see a summary with '-h')
Examples:
jevgate auth login Hidden prompt; saved in the OS credential store
jevgate auth login --with-key < key.txt Read the key from stdin
jevgate auth status Show which key a check would use and verify it
jevgate auth status --offline --json Same, without contacting TypeSafe
jevgate auth logout
jevgate check
Review code with TypeSafe Jev; exit 1 when the gate fails, 2 when the run is incomplete
Parses the selected files locally, sends small evidence units (a function, a file outline, a pair of copies, a test, a documentation section, a code comment) with short questions, and composes the answers into findings. Unchanged units are answered from `.jevgate/cache`, so a re-run only pays for what changed. Every run writes the full report to `.jevgate/latest.json`, whatever the output format.
Findings are `review` (act on it), `consider` (worth a look) or `note` (optional; never fails the gate). A file whose answers stay undecided is `uncertain`; one that cannot be judged without more evidence is `needs-context`.
Settings resolve in this order: flags, then `jevgate.toml`, then defaults. Upload patterns and budgets in the file are ceilings that flags can only narrow.
Usage: jevgate check [OPTIONS] [PATHS]...
Arguments:
[PATHS]...
Files or directories to review [default: discovered application source]
Without paths, JevGate walks the repository (respecting .gitignore) and selects application source in Rust, Python, JavaScript, TypeScript, Go, C#, Ruby, PHP and Java. Tests, generated code and vendored files are classified and skipped with a reason. `upload_allow`/`upload_deny` in jevgate.toml still bound what is sent.
Options:
-h, --help
Print help (see a summary with '-h')
Scope:
--base <REVISION>
Review only files changed against this Git revision (commit, branch or tag)
Includes committed, staged, unstaged and untracked changes. Deleted files are listed in the report. The revision must exist locally: in CI, check out with full history (for example `fetch-depth: 0`). When no supported file changed, the run is complete and exits 0.
--include-tests
Also judge tests: test value, redundancy, and shared logic among tests
Without it, test files are judged only for file organization. Also set by `include_tests = true` in jevgate.toml.
--context <PATH>
Related file sent as evidence for shared logic, callers and test subjects (repeatable)
The file must be inside the repository and is sent only with the requests it informs. Also set by `context` in jevgate.toml.
--source-extension <EXT>
Also review this file extension as text (repeatable, without the dot)
--config <FILE>
Read this configuration instead of <repository root>/jevgate.toml
The repository root is still found from the working directory. Use it in CI to apply a reviewed policy that the change under review cannot edit.
Rules and gate:
--rule <RULE>
Select a rule ID, key or group (repeatable) [default: the `default` group]
Groups: maintainability, tests, security, documentation, default (every rule on by default) and all. Naming any rule replaces the configured selection, so add `--rule default` to keep the defaults. Test rules also need --include-tests. `jevgate rules` lists every rule.
--skip-rule <RULE>
Deselect a rule ID, key or group (repeatable); applied after --rule and jevgate.toml
--fail-on <[TARGET=]LEVEL>
What fails the gate: LEVEL for every rule, or TARGET=LEVEL (repeatable) [default: review]
LEVEL is review, consider (also fails on review), uncertain, or none (advisory; `report` is accepted as a synonym). TARGET is a rule ID, key or group, for example `security=consider`; the most specific target wins. Flags replace `fail_on` and `[rules]` levels from jevgate.toml for the rules they address. Notes and baselined findings never fail the gate. An incomplete run exits 2 regardless of the gate.
Output:
--format <FORMAT>
Output format [default: agent; jsonl with --watch; json with --show-requests]
Possible values:
- agent: Ranked findings with locations and next steps, for people and coding agents
- json: The full report as one pretty-printed JSON document
- jsonl: One compact JSON report per line; one per evaluation while watching
- github: GitHub Actions annotations and a job summary, then the agent text
- sarif: A SARIF 2.1.0 log, for GitHub code scanning and other SARIF readers
- gitlab: A GitLab Code Quality report, for merge request widgets
--color <WHEN>
Color agent output: auto, always or never
`auto` colors a terminal unless NO_COLOR is set, and any output when CLICOLOR_FORCE is set; on Windows, only Windows Terminal and terminals that set TERM count. Other formats are never colored.
Possible values:
- auto: On a terminal, unless NO_COLOR is set; CLICOLOR_FORCE turns it on elsewhere
- always
- never
[default: auto]
--verbose
Show optional notes, every consider finding and per-file detail in agent output
--report
Also write .jevgate/report.html and open it in a browser (not opened when CI is set)
--dry-run
List the selected files, rules and planned requests without credentials, network or writes
Planned first-pass requests the cache already answers are counted apart and cost nothing; follow-ups depend on the answers and are not known.
--show-requests
With --dry-run, include every initial request body (the exact source and questions)
Follow-up requests depend on answers and are not known in advance.
Model, budgets and cache:
--model <MODEL>
TypeSafe model; pin a version for repeatable results [default: jev-1.13.0]
Also set by `model` in jevgate.toml. Answers are cached per model, so changing it re-asks every unit.
--max-requests <N>
Stop after this many API attempts in this invocation, watch updates included
Reaching the budget leaves the run incomplete (exit 2) rather than passing on partial evidence. `max_requests` in jevgate.toml is a ceiling this flag can only lower.
--concurrency <N>
Maximum simultaneous TypeSafe requests (1-8)
[default: 6]
--max-file-bytes <BYTES>
Per-file read limit; a larger file is reported as needs-context, never truncated
[default: 262144]
--max-context-bytes <BYTES>
Total bytes of --context files per request; context is never truncated
[default: 32768]
--cache-ttl-secs <SECONDS>
Cache lifetime for the jev-latest and jev-preview aliases [default: 3600]
Answers from a pinned model version never expire. Also set by `cache_ttl_secs` in jevgate.toml.
--refresh
Ignore cached answers for this invocation and ask again
--cache-only
Use cached answers only and never contact TypeSafe; unanswered units leave the run incomplete
--env-file <FILE>
Credential file holding TYPESAFE_API_KEY [default: <repository root>/.env]
The TYPESAFE_API_KEY environment variable takes precedence.
Watch:
--watch
Keep running and re-check the selected files after each save
Writes .jevgate/latest.json after every evaluation and prints one JSON report per line. Pair with `jevgate serve` or --report.
--debounce-ms <MS>
Wait this long after the last save before evaluating
[default: 500]
--poll-ms <MS>
How often to look for saves
[default: 250]
Examples:
jevgate check Discovered application source, default rules
jevgate check src/billing --verbose One directory, with notes and per-file detail
jevgate check --base origin/main --format json Changed files only, machine-readable
jevgate check --rule default --rule security Add the opt-in security group
jevgate check --rule documentation Agent instruction files, project docs and code comments
jevgate check --rule comments Only code comments: repeated code, filler, narrated edits
jevgate check --include-tests Also judge test value and redundancy
jevgate check --fail-on none Advisory: never exits 1; exits 2 when incomplete
jevgate check --fail-on review --fail-on security=consider
jevgate check --dry-run --show-requests Exactly what would be uploaded, offline
jevgate check --cache-only Replay cached answers; never contact TypeSafe
Reading the JSON report (--format json or .jevgate/latest.json):
complete false when any selected file was not judged; the exit code is then 2
gate passed, reasons, new_findings, baselined_findings
files[].status clear, note, consider, review, uncertain, needs-context,
not-applicable, skipped or error
files[].findings rule, strength, line, message, action, locations,
concern_probability, fingerprint, baselined
files[].dimensions per rule: status, unit counts and the units left undecided
files[].judgments every raw answer, first pass and follow-ups
api_requests, paid_input_tokens, paid_output_tokens this run's usage
jevgate baseline
Accept the findings of the last complete check, so later checks fail only on new ones
Writes `jevgate-baseline.json` at the repository root from `.jevgate/latest.json`. Commit the file. Findings are matched by a fingerprint of rule, path, unit and evidence, so unrelated edits keep them accepted. Offline: no source is read or sent.
A single finding can instead be accepted in the code, with a comment `jevgate: allow(RULE) reason` on its line or directly above it.
Each accepted finding can record why it was accepted: `intended` (right about the code, which is meant to be this way), `later` (right, to fix later) or `wrong` (the finding is mistaken). `baseline stats` turns these reasons into each rule's rate of wrong findings.
Usage: jevgate baseline [OPTIONS]
jevgate baseline <COMMAND>
Commands:
mark Record why accepted findings were accepted
stats Count accepted findings by rule and reason, with each rule's rate of wrong findings
help Print this message or the help of the given subcommand(s)
Options:
--merge
Keep earlier accepted findings for files the last check did not cover
Without it, the file is replaced, so after a `--base` or path-limited check the findings accepted for every other file are dropped. With it, entries for files the check covered, or that were deleted, are replaced by what the check found, and the rest are kept.
--reason <REASON>
Record this reason on findings accepted now without one
Findings already accepted keep the reason they have.
Possible values:
- intended: The finding is right; the code is meant to be this way
- later: The finding is right; it will be fixed later
- wrong: The finding is mistaken
-h, --help
Print help (see a summary with '-h')
Examples:
jevgate baseline Accept every finding of the last check
jevgate baseline --merge --reason later Accept a partial check's findings as known debt
jevgate baseline mark wrong src/api/search.ts:41 A mistaken finding
jevgate baseline mark intended scripts --rule maintainability/hardcoded-values
jevgate baseline stats Wrong findings per rule
jevgate rules
List every rule with its group, default and the question it asks
A rule is named by its ID (`maintainability/shared-logic`), its key (`shared_logic`) or its group (`maintainability`, `tests`, `security`, `documentation`, plus `default` and `all`) anywhere a rule is accepted: `--rule`, `--skip-rule`, `--fail-on TARGET=LEVEL` and `[rules]`.
Usage: jevgate rules [OPTIONS]
Options:
--format <FORMAT>
`table` for people; `json` adds scope, evidence unit, version and decision policy
[default: table]
[possible values: table, json]
-h, --help
Print help (see a summary with '-h')
jevgate init
Write a commented jevgate.toml for this repository (offline)
Limits uploads to the detected source and test directories and to agent instruction files, denies credential files, and lists every rule group with its gate level. Review the file before the first paid check.
Usage: jevgate init [OPTIONS]
Options:
--force
Replace an existing jevgate.toml
-h, --help
Print help (see a summary with '-h')
jevgate completions
Print a shell completion script (offline)
Usage: jevgate completions <SHELL>
Arguments:
<SHELL>
bash, zsh, fish, elvish or powershell
[possible values: bash, elvish, fish, powershell, zsh]
Options:
-h, --help
Print help (see a summary with '-h')
Examples:
jevgate completions bash > ~/.local/share/bash-completion/completions/jevgate
jevgate completions zsh > "${fpath[1]}/_jevgate"
jevgate completions fish > ~/.config/fish/completions/jevgate.fish
jevgate completions powershell >> $PROFILE
jevgate man
Print a man page in roff (offline)
Without a command, the page for `jevgate`; with one, the page for that command, such as `jevgate-check`.
Usage: jevgate man [COMMAND]
Arguments:
[COMMAND]
A command: auth, check, baseline, rules, init, serve, mcp or completions
Options:
-h, --help
Print help (see a summary with '-h')
Examples:
jevgate man > ~/.local/share/man/man1/jevgate.1
jevgate man check > ~/.local/share/man/man1/jevgate-check.1
jevgate man check | man -l - Read a page without installing it (man-db)
jevgate serve
Serve the latest report as read-only JSON on localhost (run alongside `check --watch`)
Answers GET requests from local tools, never from a browser page: `/snapshot` (the full report), `/evidence` (findings and context per file), `/context-requests` (evidence a file still needs) and `/changes?since=GENERATION` (what changed since a report generation).
Usage: jevgate serve [OPTIONS]
Options:
--port <PORT>
Local port to listen on
[default: 47831]
-h, --help
Print help (see a summary with '-h')
jevgate mcp
Run a Model Context Protocol server on stdin and stdout, for coding agents
Offers three tools: `jevgate_check` runs a check in the repository and returns its findings, `jevgate_findings` reads the last report, and `jevgate_rules` lists the rules. Register it with an agent as the command `jevgate mcp`, started in the repository.
Usage: jevgate mcp
Options:
-h, --help
Print help (see a summary with '-h')
Examples:
claude mcp add jevgate -- jevgate mcp Claude Code, in the repository
{"mcpServers": {"jevgate": {"command": "jevgate", "args": ["mcp"]}}}
Clients configured with JSON, such as Cursor