How do I get access to Jev?
Quick recap if you're arriving cold: Jev is TypeSafe AI's "System One" model. It's non-autoregressive — it doesn't generate tokens — and it returns a typed decision with a calibrated confidence instead of text. If you want the conceptual background first, read what Jev is and how it differs from an LLM; this post assumes you already want to wire it in.
Jev went into early access on September 15, 2026, and the waitlist was dropped around September 21, 2026 — so as of this writing, access is open. You have four ways in:
- • TypeSafe API directly. Sign up, get a
TYPESAFE_API_KEY, and call the API. This is the canonical path and the one the LangChain and Pydantic integrations sit on top of. - • OpenRouter. If you already route model calls through OpenRouter, Jev is listed there.
- • Cloudflare Workers AI. Model id
typesafe/jev— and notably, usable without a TypeSafe key, which makes it the lowest-friction way to try it if you're already on Workers. See the Cloudflare model page. - • Composio. Available as part of Composio's tool catalogue if that's your integration layer.
Pricing, as verified at launch: $0.042 per million input tokens, output free, with a 32,000-token context window. Output being free follows from the architecture — there are no output tokens to bill, just a decision.
What does Jev actually return? The three output types
Everything about using Jev well comes back to this: you pick the shape of the answer up front, and Jev is guaranteed to return something of that shape. There are three shapes:
- • Choice. Pick one label from a set you define — up to 255 of them. This is your router ("simple" / "complex"), your guardrail ("block" / "allow"), and your classifier ("billing" / "bug" / "feature-request" / …).
- • Score. A number. Useful when you want a ranking or a threshold you tune yourself rather than a fixed label.
- • Calibrated probability. A probability for a yes/no question — "is this command dangerous?" — that is meant to be calibrated, i.e. a 0.8 should be right about 80% of the time.
Every answer comes with a confidence. TypeSafe's own example is {label: "fraud", confidence: 0.87}. Two things to internalise before you build on it. First, "cannot hallucinate" means the shape, not the value. You will always get a valid label from your list; the label can still be the wrong one. Second, the calibration is imperfect: an independent measurement put the expected calibration error at roughly 0.107, and confidence is shakiest in the 0.3–0.8 mid-range. In practice that means confidences near 0 or 1 are worth acting on; confidences in the middle are a signal to fall back to a rule, a bigger model, or a human.
What you do not get: reasoning, explanations, or free text of any kind. Jev also can't reliably count or compare dates. If your decision depends on arithmetic, do the arithmetic in code and hand Jev the result as a field.
Which integrations exist? LangChain, Pydantic, and Cloudflare
You can call the raw API, but the three integrations below are where most engineers will actually touch Jev. I'm keeping these high-level on purpose — the SDKs are a week old and signatures will move, so check the current docs for the exact calls.
- • LangChain —
TypeSafeClassifier. You give it the agent's current state plus the questions you want decided, and get typed decisions back. LangChain's own write-up (Building a harness with Jev) uses it for exactly the two jobs this post is about: routing by complexity, and blocking risky tool calls before they execute. - • Pydantic-typed outputs. Jev's results are Pydantic-typed, and it accepts Pydantic schemas as output constraints. So the decision arrives in your code already validated — no
json.loads, no regex, no "the model wrapped it in markdown again." - • Cloudflare Workers AI —
typesafe/jev. The zero-signup path if you're already on Workers. Fits naturally at the edge: classify or gate a request before it ever reaches your origin.
A note on where this sits architecturally. If you've read our MCP vs API piece: MCP is how an agent discovers and calls tools. Jev is a candidate for the step just before that — deciding whether a given call should go through at all. They're different layers and they compose.
What are the real use cases for Jev?
Four patterns are documented so far, either by TypeSafe, by LangChain, or in the demos coverage has reported on. Each row is the same shape: what Jev decides, why it's a fit, and the thing that will bite you.
| Use case | What Jev decides | Why Jev fits | Watch out |
|---|---|---|---|
| Agent routing | Is this query simple or complex? (a Choice) — so a small model handles the easy ones and the big model gets the rest | The decision is cheap, fast (TypeSafe claims ~70–500 ms), and typed, so the router is a one-line branch instead of a prompt-and-parse step | Mid-range confidence (roughly 0.3–0.8) is where calibration is weakest; route those to the safer, bigger path by default |
| Tool-call guardrail | Should this proposed tool call be blocked or allowed? (a Choice or a probability) before your runtime executes it | Sits between the planning LLM and the executor; a non-autoregressive verdict adds little latency to every step | Prompt injection can move the verdict. Never let unguarded untrusted text into a gate on a destructive action; keep a hard rule or a human there |
| Classification / moderation | Which label applies — category, urgency flag, policy violation — from up to 255 labels, plus a confidence | Output is a valid label every time, with output tokens free and input at $0.042 per million tokens, so high-volume triage is cheap | A valid label is not a correct label. Sample and audit; treat low and mid confidences as 'needs review', not as a decision |
| Real-time game / robot loop | The next discrete action or a Score for the current state, tens of times per session | Reported demo costs are tiny (about $0.01 for a 2-minute Minecraft session, about $0.10 for a 15-minute drone sim, per coverage) and latency fits a control loop | Jev cannot count or compare dates reliably and gives no reasoning — keep physics, safety limits, and anything arithmetic in ordinary code |
The real-time row deserves a word. The demos that got attention — a Minecraft bot, a Subway Surfers bot, drone and robot simulations — work because Jev is being asked a small discrete question many times per second, not because it "understands" the game. The cost figures (about $0.01 for a two-minute Minecraft session, about $0.10 for a fifteen-minute drone sim) are reported demo numbers, not benchmarks; take them as an order of magnitude.
On the vendor's headline claims: TypeSafe says Jev is up to ~193.6× faster and ~444.6× cheaper than the alternatives, with ~70–500 ms latency. Those are TypeSafe's own numbers on vendor-selected workflows. The 444.6× figure in particular uses the average of two other models as its reference answer — so it measures agreement with those models, not accuracy against ground truth. Useful directionally; not something to put in a design doc without your own measurement.
Get the weekly AI engineering brief
Agents, guardrails, routing, and the tools worth using — one practical email a week. Plus the free roadmap PDF.
By subscribing you agree to receive emails from AI Engineer Insights. Unsubscribe anytime. See our Privacy Policy.
A worked pattern: routing plus a tool-call guardrail
Here is the pattern I'd actually ship, in prose first. It's the same shape LangChain describes, and it's how I'd slot Jev into an AI agent loop — or into an orchestration setup like the one in our Hermes + Claude Code post, where Jev can act as the routing and guardrail decision layer in front of the agent runtimes.
- Route on arrival. When a request comes in, ask Jev one Choice question: is this simple or complex? High-confidence "simple" goes to a small, cheap model. Everything else — including every mid-range confidence — goes to the big model. Bias the fallback toward the safer path.
- Let the planning model plan. The LLM proposes a tool call as usual — a shell command, a database write, an API call with side effects.
- Gate before execution. Before your executor runs the call, ask Jev a calibrated-probability question: should this be blocked? Pass it the structured call — tool name, arguments, the task context your own code assembled — not raw user text.
- Apply hard rules on top. Some actions are never allowed regardless of what any model says (deleting the repo, sending money, touching production). Those are plain
ifstatements in code, checked before and independently of Jev. - Escalate the middle. If the block probability lands in the mushy 0.3–0.8 band on a high-impact action, don't decide — hand it to a human, or refuse and let the agent re-plan.
- Log the decision and the confidence. You will want this to measure Jev's accuracy on your traffic, and to spot when the confidence distribution shifts.
The same thing as pseudocode. This is illustrative only — it shows the shape of the control flow, not real SDK calls. Check the current TypeSafe and LangChain docs for exact syntax.
# ILLUSTRATIVE PSEUDOCODE — not real API syntax.
# See current TypeSafe / LangChain docs for the actual calls.
decision = jev.decide(question="simple or complex?", input=request)
model = small_model if (decision.label == "simple" and decision.confidence > 0.9) else big_model
proposed_call = model.plan(request)
if violates_hard_rule(proposed_call): # plain code, runs first, no model involved
refuse(proposed_call)
verdict = jev.decide(question="block this call?", input=structured(proposed_call))
log(proposed_call, verdict)
if verdict.probability > 0.8:
refuse(proposed_call)
elif verdict.probability > 0.3 and is_high_impact(proposed_call):
escalate_to_human(proposed_call) # the mid-range is not a decision
else:
execute(proposed_call)Notice what Jev is and isn't doing here. It makes two cheap, fast, typed decisions per turn. It is not the last line of defence, and it never sees unfiltered user text on the gate that matters. That brings us to the caveat.
The security caveat: prompt injection moves Jev's verdict
This is the part to read twice. Because Jev returns a structured decision rather than text, it is tempting to assume it's immune to prompt injection — there's no output for an attacker to hijack. That assumption is wrong. Adversarial text in the input moves the decision.
VentureBeat reported on this, and an engineer at Octomind demonstrated it concretely: a "block this command?" question returned a block probability of 0.76. After adding a fake user pre-approved field to the input, the same question returned 0.48 — below any sensible threshold. Nothing about the command changed. A string did. TypeSafe's own limitations page is candid about it: adversarial content "can move the answer."
The practical rules that fall out of that:
- • Never let unguarded untrusted input flow into a Jev decision that gates a real action. Untrusted means anything a user typed, anything scraped from the web, anything read from a file or a tool result. Structure it, strip it, or summarise it with code before it reaches the gate.
- • Keep a hard rule or a human on every high-impact gate. Jev can be the fast filter that handles the 95% of obvious cases; it should not be the only thing between an injected instruction and a destructive tool call.
- • Assume the confidence can be gamed too. An attacker who can lower a block probability from 0.76 to 0.48 can also push it under whatever threshold you picked. Thresholds are not security boundaries.
- • Don't pass fields the model shouldn't trust. If "pre-approved" is a real concept in your system, it should be a value your code sets from an authenticated source — never something that appears inside the text Jev reads.
None of this is unique to Jev; every model-based guardrail has the same problem. But Jev's pitch — a decision layer you can trust because it's typed — makes it easier to forget. Typed is not the same as trustworthy.
When should you not use Jev?
- • When you need an explanation. Jev gives you a label and a number. If a user, an auditor, or a downstream agent needs to know why, you need an LLM (or you need to log enough context to reconstruct the why yourself).
- • When the decision is arithmetic. Counting, date comparison, "is this over budget" — Jev can't do these reliably. Compute the answer in code and, if anything, hand Jev the result as a feature.
- • When the input is adversarial by design and the action is irreversible. A public-facing bot deciding whether to run a shell command on untrusted text is exactly the scenario from the section above. Use a hard allowlist, not a probability.
- • When you haven't measured it on your data. The 444.6× figure measures agreement with other models, not accuracy. Until you've run Jev against a labelled sample of your own traffic, you don't know its error rate — and its confidence won't reliably tell you, especially in the 0.3–0.8 band.
- • When a plain rule already works. If a regex or a lookup table decides it correctly, that is faster, cheaper, and has no calibration error at all.
Practical tips for getting Jev right
- • Ask small questions. One Choice with a handful of clear labels beats one Choice with 200 fuzzy ones. Jev supports up to 255 labels; that doesn't mean you should use them.
- • Design the fallback before the happy path. Decide what happens at mid-range confidence first. That single decision is most of your risk.
- • Feed structure, not prose. Assemble the input from fields your code controls. The less free text Jev reads, the less an attacker can move.
- • Use the free output tokens. Because output is free and input is $0.042 per million tokens, it's cheap to ask several questions per turn. Routing plus guardrail plus an urgency flag is still a rounding error.
- • Start on Cloudflare if you just want to try it.
typesafe/jevon Workers AI needs no TypeSafe key. Move to the direct API when you want the LangChain and Pydantic integrations. - • Log every decision with its confidence. Then sample and label. Within a week you'll know Jev's real accuracy on your traffic, and you'll notice drift when it happens.
- • Know who built it, and what they didn't claim. TypeSafe AI was founded in 2024 in San Francisco with a $40M seed from DCVC. CEO Diogo Almeida was previously at OpenAI and Google Brain, is a co-inventor of RLHF and InstructGPT, and contributed to GPT-4. Solid pedigree; still, evaluate the model, not the résumé.
Frequently Asked Questions
How do I get access to Jev?
Jev entered early access on September 15, 2026 and the waitlist was dropped around September 21, 2026, so access is open. You can call it directly through the TypeSafe API with a TYPESAFE_API_KEY, or through OpenRouter, Cloudflare Workers AI (model id typesafe/jev, which does not require a TypeSafe key), or Composio. Pick whichever platform your stack already talks to.
What does Jev return instead of text?
A typed decision plus a calibrated confidence. There are three output types: a Choice (one label from a set of up to 255), a Score (a number), and a calibrated probability. A typical response looks like {label: 'fraud', confidence: 0.87}. Your code branches on the label and the confidence directly, with no parsing and no 'answer only yes or no' prompt.
Does Jev work with LangChain and Pydantic?
Yes. LangChain has a TypeSafeClassifier integration: you pass it state plus the questions you want decided and get typed decisions back, which LangChain uses for agent routing and tool-call risk blocking. Jev's outputs are Pydantic-typed, and it accepts Pydantic schemas as output constraints, so the decision lands in your code already validated. Check the current TypeSafe and LangChain docs for exact signatures.
How much does Jev cost?
Verified pricing is $0.042 per million input tokens, with output free, and a 32,000-token context window. TypeSafe's headline comparisons (up to about 193.6x faster and about 444.6x cheaper than LLM alternatives) are vendor claims on vendor-selected workflows, and the 444.6x figure uses the average of two other models as its reference answer, which measures agreement rather than accuracy.
Can Jev hallucinate?
The shape cannot be wrong: you always get a valid label, score, or probability of the type you asked for. The value can still be wrong. 'Cannot hallucinate' is a claim about type safety, not about correctness, so treat Jev like any classifier: measure its accuracy on your own data before trusting it, and watch the confidence.
Is it safe to let Jev decide whether an agent's tool call runs?
Only with guards around it. VentureBeat reported, and an Octomind engineer demonstrated, that injected text moves Jev's verdict: a 'block this command?' probability of 0.76 fell to 0.48 after a fake 'user pre-approved' field was added to the input. TypeSafe's own limitations page says adversarial content can move the answer. Use Jev as a fast first filter, never as the only thing standing between untrusted input and a destructive action.
References
- • TypeSafe AI — Introducing System One models and Jev
- • LangChain — Building a harness with Jev (TypeSafeClassifier for routing and tool-call blocking)
- • Cloudflare Workers AI — typesafe/jev model page
- • VentureBeat — Companies are putting Jev in charge of AI agent decisions, and prompt injection can influence the verdict
- • Wikipedia — Jev (AI model)