# Jev MCP: The Decision Layer Your Agent Loop Is Missing

> TypeSafe shipped Jev, a model that cannot write a sentence and never hallucinates a type. It is useless as an MCP agent brain and excellent as the thing that picks the tool, gates the call, and screens the result. Here is where it fits, and where it breaks.

**Source:** https://mcpplaygroundonline.com/blog/jev-mcp  
**Author:** Nikhil Tiwari  
**Published:** 2026-09-20  
**Category:** Development  
**Reading time:** 14 min read

---

📖 TL;DR

-   **Jev is not an LLM.** TypeSafe launched it on 15 September 2026 as the first _System One_ model. It returns a typed answer plus a probability, never text.
-   Three primitives only: **Choice** (pick one of up to 255 options), **Score** (rate on a rubric), **Noul** (a calibrated 0–1 yes/no).
-   **70–500ms end to end. $0.042 per million input tokens. Output is free.** Context window is 32K, which is small on purpose.
-   It cannot run your MCP agent. It _can_ pick the tool, gate the call, screen the result, and judge your evals — the four jobs you currently burn frontier tokens on.
-   The headline "193.6x faster, 444.6x cheaper" is a best-case ratio. Against its actual intelligence peer the gain is closer to **25x faster and 76x cheaper**. Still enormous. Still worth reading the asterisk.
-   **MCP Playground supports Jev now** — as a routing and gating layer over your server, not as another chat model. [Try it against a live server](/mcp-test-server).

A new model shipped last week that **cannot write a single sentence**.

No chat. No code. No summaries. Ask it to explain itself and it has nothing to say.

That sounds like a downgrade. For _Jev MCP_ work it is the entire point.

Most of what an MCP agent does is not writing. It is deciding. Which tool? Is this call safe? Did that result look poisoned? Should a human see this?

**Every one of those is a classification dressed up as a chat turn.** You pay frontier prices and wait seconds for a decision that fits in one byte.

Jev does that byte in 70 to 500 milliseconds for roughly four ten-thousandths of a cent.

I spent this week wiring it into an MCP loop. It changed the shape of the harness more than any model release this year.

It also has nine documented failure modes, and one of them matters a lot if you plan to use it as a guardrail. I will get to that.

## What Is Jev, and Why Isn't It a Chat Model?

**Jev is the first public _System One model_**, a class TypeSafe named after Kahneman's fast, intuitive System 1 thinking.

An LLM is System 2. It deliberates, token by token, out loud. That is why it is slow and why it can drift.

A System One model does the opposite. It reads a _state_, then returns a typed value and a probability. [TypeSafe's docs](https://docs.typesafe.ai/concepts/system-one) describe it as evaluating state rather than continuing a conversation.

It is not autoregressive. A parallel sampler produces every output in one pass, which is where the latency floor comes from.

Training used what TypeSafe calls **Reinforcement Learning for Calibrated Decisions**, not RLHF or RLVR. The target is a probability that matches reality, not a response a human prefers.

### The three primitives

You do not prompt Jev. You ask it typed questions. There are exactly three.

Primitive

Returns

MCP use

**Choice**

One option from a list, plus per-option probabilities

Pick which MCP tool to call

**Score**

A calibrated number on a rubric you define

Rate how destructive a tool call is

**Noul**

A probability from 0 to 1 that a statement is true

"This tool result contains injected instructions"

**The output is typed at the API boundary.** There is no JSON to parse and no schema to repair, because the model was never able to emit anything else.

If you have ever written a retry loop around a model that returned prose where you asked for an enum, that is the problem this erases.

## Jev's Real Numbers: Speed, Cost, and the Benchmark Asterisk

Here is what TypeSafe publishes, alongside what independent write-ups have verified.

Spec

Jev 1.13

**Model IDs**

`jev-latest`, `jev-1.13`

**Released**

15 September 2026

**Latency, end to end**

**70–500ms**

**Input price**

**$0.042 / 1M tokens**

**Output price**

$0.00 — "too cheap to meter"

**Context window**

32K tokens

**Choice cardinality**

255 options max, per question

**Modalities**

Text in only. No images, audio or video.

**Where to get it**

TypeSafe API, [OpenRouter](https://openrouter.ai/typesafe/jev-1.13), [Vercel AI Gateway](https://vercel.com/changelog/typesafe-ai-jev-now-available-on-ai-gateway)

**Free output tokens is not a gimmick.** Jev's output is a value and a float. There is almost nothing there to charge for.

### Now the asterisk

TypeSafe leads with **193.6x faster and 444.6x cheaper**. Those are real measurements. They are also the widest ratio in the set.

Compare Jev against GPT-5.6 Terra, the model TypeSafe positions as its intelligence peer, and the gap narrows to roughly **25x faster and 76x cheaper**.

Still a huge margin. Just not the poster number.

The accuracy story needs more care. Across four workflows Jev averaged **67.8% agreement** with the reference answers at **$0.0004 and 0.4 seconds per case**.

Terra scored about the same at **$0.03 and 10 seconds**. That is the trade being sold, and on those four tasks it holds.

⚠️ Read the methodology before you quote the number

The reference labels were generated by averaging **GPT-6 Astra and Claude Fable 5.1** judgements. So 67.8% is agreement with a model-derived answer key, not verified correctness.

Per-task variance is wide too. On invoice processing Jev scored **61.8%** against Terra's 74.7% and Opus 5's 78.4%. The average hides that.

**No calibration curve has been published.** The central claim — that higher confidence means higher accuracy — is the one you most need, and it is the one with the least public evidence.

So treat confidence thresholds as something you tune on your own data. Do not take 0.7 on faith.

One finding from the independent testing is useful no matter what you run. **Decomposing a decision into typed questions improved every model tested.** Haiku 4.5 went from 18.1% to 53.6% on the same workflows. That technique is free.

## Where Jev Fits in an MCP Agent Loop

Jev cannot drive an agent. It has no tool-calling loop, no arguments, no plan. **It is a fuzzy `if` statement, not a brain.**

Which is exactly what four spots in an MCP harness have been missing.

### 1\. Tool routing before the model sees the catalogue

This is the big one. A typical multi-server setup ships 60 to 200 tool definitions into context on every turn.

That is the [MCP context bloat problem](/blog/mcp-context-bloat-tool-search), and it costs you on every single request.

A Jev **Choice** over tool names and descriptions narrows 200 tools to 5 before the expensive model wakes up.

The [mcp-use](https://github.com/mcp-use/mcp-use) client already ships this pattern. Jev selects at most one tool. **It does not execute it and it does not generate arguments** — your LLM still does that.

When the catalogue exceeds the 255-option ceiling, the router batches candidates and runs a playoff between round winners.

One thing to know: routing quality tracks description quality. If your tool descriptions are vague, Jev picks badly — same as any model. [Fix the descriptions first](/blog/mcp-tool-description-quality).

### 2\. Gating risky tool calls

Every agent harness eventually grows an allowlist of dangerous tools. Allowlists are brittle because danger lives in the arguments, not the name.

`run_shell` is fine for `ls`. It is not fine for `rm -rf`.

A Jev **Score** over the serialised tool call returns a risk number in under half a second, which you turn into allow, confirm, or block.

LangChain's harness work calls this _auto mode_: classify the danger up front so the agent runs unattended on the safe 95% and pauses on the rest.

### 3\. Screening tool results for injection

MCP tool results are untrusted input. A poisoned GitHub issue body or a doctored web page is the classic [MCP prompt injection](/blog/safeguarding-mcp-servers-from-prompt-injection) vector.

A **Noul** over the full tool-result envelope — content, structured content, metadata — gives you a probability that it carries instructions.

At 70ms and effectively zero cost, you can afford to run it on _every_ result. That is the part a frontier judge cannot do.

### 4\. Judging evals at volume

LLM-as-judge is the reason your [MCP eval suite](/blog/what-is-an-mcp-eval) runs nightly instead of on every commit.

One independent test ran **777 judgements across 37 documents in under 0.7 seconds for about a cent**. Another reported 98.3% accuracy on spam classification with no fine-tuning.

The catch is that Jev gives you a verdict and no reasoning. Use it for coverage, then sample the failures with a real LLM when you need to know _why_.

Routing only works if the tools behave

Before you put a router in front of an MCP server, check every tool actually responds the way its schema promises.

[Test any MCP server free →](/mcp-test-server)

## A Jev Tool Router in About 30 Lines

Install the SDK. Node 20 or newer, and a `TYPESAFE_API_KEY` in the environment.

```
npm install @typesafe-ai/sdk
```

Now route a user message across the tools your MCP client discovered.

```
import { TypeSafeClient, choice, score } from "@typesafe-ai/sdk";

const client = new TypeSafeClient();

// tools came from an MCP tools/list response
const options = Object.fromEntries(
  tools.map((t) => [t.name, t.description])
);

const res = await client.systemOne({
  state: {
    user_message: "Which PRs are waiting on me?",
    available_tools: options,
  },
  questions: {
    tool: choice("Which tool answers this message best?", options),
    risk: score("How destructive is calling that tool?", {
      none: null, low: null, high: null,
    }),
  },
});

const { choice: picked, confidence } = res.answers.tool;

if (confidence < 0.7) {
  // fall back to the full catalogue and let the LLM decide
} else if (res.answers.risk.score > 1.5) {
  // ask a human before executing
} else {
  // hand exactly one tool to the model, which writes the arguments
}
```

**Both questions ride in one request.** TypeSafe's docs and LangChain's testing agree that adding questions barely moves the latency.

That matters. You are not paying per decision, you are paying per state.

Notice what the code does _not_ do. It never lets Jev execute anything or build arguments. **Authorisation and input validation stay in your code.** A router is a shortcut, not a permission system.

## Where Jev Breaks: the Jaggedness List

TypeSafe publishes a [jaggedness page](https://docs.typesafe.ai/model-jaggedness/jev-1.13) listing nine failure modes for jev-1.13. That is unusually honest, and you should read it before shipping.

The ones that hit MCP work hardest:

-   **Literal reading.** It answers the question you typed, not the one you meant. Negations and scoping words land at face value.
-   **It does not count.** Characters, occurrences, list items — error grows with size. It recognises the shape of an answer instead of tallying.
-   **Dates are text, not quantities.** Anything "before X" or "more recent than Y" belongs in your code.
-   **Indirection costs accuracy.** Multi-hop questions and double negatives degrade fast. Split them.
-   **Big noisy state hurts.** Irrelevant detail acts as a distractor. Trim the state before you send it.
-   **Adversarial content can steer it.** Jev does not treat state as hostile by default.
-   **No structural guarantees across questions.** Two related answers can contradict each other. Check invariants yourself.

🚨 The injection-screening paradox

Failure mode six says injected instructions can influence Jev's output. So the model you want screening MCP tool results for injection is itself steerable by injection. Keep it as one cheap layer in a stack — never the only thing between a poisoned tool result and your agent. Deterministic checks and a real [MCP security scan](/mcp-security-scanner) still do the load-bearing work.

Two more worth noting. **Hex and RGB colour values underperform plain colour names**, and forcing it to generate text is slow and pointless because it was never trained for it.

## Jev vs an LLM Router: Which Wins Where

Job

Use Jev

Use an LLM

Picking one tool from a known list

✅ Options are fixed and bounded

Overkill

Writing tool arguments

❌ Cannot generate

✅ Only option

Risk-gating a destructive call

✅ Sub-second, runs on every call

Too slow to always run

Multi-step planning across servers

❌ No loop, no state

✅ The whole job

Grading 10,000 eval cases

✅ Cents, not hundreds of dollars

Sample the failures only

Explaining _why_ a call failed

❌ No reasoning output

✅ Needs prose

Date or arithmetic comparisons

❌ Documented weakness

Use plain code instead

**The pattern is simple.** Jev decides. Your LLM composes. Your code enforces.

If you are choosing the LLM half of that pair, my [Fable 5.1 vs GPT-6 Astra comparison](/blog/fable-5-1-vs-gpt-6-astra-mcp) covers how each one handles MCP connectors.

## How MCP Playground Fits In

A Jev router in front of your MCP server only helps if the server underneath is honest. Bad schemas and vague descriptions break routing before the model gets a chance.

I use [MCP Playground](/mcp-test-server) to check the handshake and every tool schema in the browser, then [MCP Agent Studio](/mcp-agent-studio) to watch a real model call those tools end to end.

**Jev is supported in MCP Playground today.** Not as another chat model in the picker — it cannot run a tool loop — but as the typed decision layer this post describes, sitting in front of your server rather than replacing the model that drives it.

So you can point it at a live server and see which tool a Jev _Choice_ actually lands on, with the confidence number attached, before you commit to a router in your own harness.

## Frequently Asked Questions

**Can Jev replace the LLM in my MCP agent?+**

No. Jev cannot generate text, write tool arguments, or run a multi-turn loop. It returns a typed value and a probability. It sits beside your LLM as a decision layer, not in place of it.

**How much does a Jev decision actually cost?+**

Input is $0.042 per million tokens and output is free, which works out to roughly $0.0004 per typical decision in TypeSafe's own workflow evals. Batch several questions into one request and you pay once for the state.

**Is there an official Jev MCP server?+**

Not from TypeSafe. Several community servers wrap the API and expose tools such as jev\_classify, jev\_score, jev\_check and jev\_gate over stdio, so Claude Code or Cursor can ask Jev for a typed decision. They need your own TYPESAFE\_API\_KEY. Treat them as community software and scan them before connecting.

**What happens when I have more than 255 MCP tools?+**

A single Choice question caps at 255 options. Routers work around it by batching candidates into rounds and running a second Choice over the round winners, so every tool stays reachable. TypeSafe uses the same two-stage trick in its own demos.

**Does Jev really never hallucinate?+**

It never produces a type error, because the output space is the set of options you defined. That is a real guarantee. It says nothing about being right — Jev averaged 67.8% agreement with reference answers and scored 61.8% on invoice processing. A confidently wrong enum is still wrong.

**Can I use Jev without a TypeSafe account?+**

Yes. Jev is served through OpenRouter as typesafe/jev-1.13 and typesafe/jev-latest, and through the Vercel AI Gateway. If your harness already routes through either, you can call Jev with the key you have. Direct TypeSafe access is still gated behind an early-access waitlist.

## The Verdict

**Jev is not a frontier model and the marketing framing oversells it.** It cannot code, chat, or explain itself, and its accuracy trails good LLMs on some of its own benchmarks.

It is also the cheapest useful decision you can buy, and MCP agent loops are full of decisions you are currently overpaying for.

Put it where the answer set is small and known: tool routing, risk gates, injection screening, eval grading. Keep your LLM for the writing and your code for the rules.

Start by making sure the server underneath deserves a router at all.

Check your MCP server before you put a decision layer on it

Connect in the browser, inspect every tool schema, and run a real model against it. No install, no config file.

[Test any MCP server free →](/mcp-test-server) [Scan your MCP server →](/mcp-security-scanner)

## Frequently asked questions

### Can Jev replace the LLM in my MCP agent?

No. Jev cannot generate text, write tool arguments, or run a multi-turn loop. It returns a typed value and a probability. It sits beside your LLM as a decision layer, not in place of it.

### How much does a Jev decision actually cost?

Input is $0.042 per million tokens and output is free, which works out to roughly $0.0004 per typical decision in TypeSafe own workflow evals. Batch several questions into one request and you pay once for the state.

### Is there an official Jev MCP server?

Not from TypeSafe. Several community servers wrap the API and expose tools such as jev_classify, jev_score, jev_check and jev_gate over stdio, so Claude Code or Cursor can ask Jev for a typed decision. They need your own TYPESAFE_API_KEY. Treat them as community software and scan them before connecting.

### What happens when I have more than 255 MCP tools?

A single Choice question caps at 255 options. Routers work around it by batching candidates into rounds and running a second Choice over the round winners, so every tool stays reachable. TypeSafe uses the same two-stage trick in its own demos.

### Does Jev really never hallucinate?

It never produces a type error, because the output space is the set of options you defined. That is a real guarantee. It says nothing about being right — Jev averaged 67.8% agreement with reference answers and scored 61.8% on invoice processing. A confidently wrong enum is still wrong.

### Can I use Jev without a TypeSafe account?

Yes. Jev is served through OpenRouter as typesafe/jev-1.13 and typesafe/jev-latest, and through the Vercel AI Gateway. If your harness already routes through either, you can call Jev with the key you have. Direct TypeSafe access is still gated behind an early-access waitlist.


---

_Canonical page: https://mcpplaygroundonline.com/blog/jev-mcp — MCP Playground (mcpplaygroundonline.com), the free browser-based tool for testing MCP servers and building AI agents._