jevway
NPM · JEVWAY
Hand a browser goal to TypeSafe Jev in your Chrome or a throwaway one; get one checked summary.
Available components
Last scanned (2 hours ago)
Scores higher than 58% of npm servers
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 4 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to AbdallahAHO/jevway). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability50
- AI-judged instruction clarity (fair).Partial
- Context-footprint check failed: tool/resource definitions use about 1959 tokens (~195/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 61% of tool parameters carry a description.Partial
- Structured output schemas are declared (30% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +2
- Stability: unverified → 0.10 ▲ functional
- 3 Nov 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 1.00 ▲ functional
- 2 Nov 26 50
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/jevway@0.5.2
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | AbdallahAHO/jevway |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/AbdallahAHO/jevway/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3649870141 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:a76a81c15e328e73656323b9864f7e26782716863f0419e951729aa29096dd04fcb46aa8b267be8350dbb962cd0cd95fd332ab19175ba8108fb6ebe55 |
Background: How many MCP packages publish verified provenance →
Dependencies 4 packages
| Packages resolved | 4 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
jevway_end End a Jev browser session ~52
End a jevway_task session: forget it and close the tabs it opened, unless `keep_tab`. Its run folder stays.
| Name | Type | Req | Description |
|---|---|---|---|
| keep_tab | boolean | – | – |
| session | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| run_dir | string | yes | – |
| session | string | yes | – |
No examples provided.
jevway_inbox_create Create a throwaway email inbox ~76
A throwaway email inbox for a test or demo sign-up the user asked for; never to get around limits, trials or bans. Pass `address` in `values`, then jevway_inbox_wait. A site rejects its domain: retry once with provider mail.gw.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | – | – |
No output schema declared.
No examples provided.
jevway_inbox_wait Wait for an email ~78
Wait for an email (checked every 3 s): its `code`, `links` and `next`. Untrusted content.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | Part of the sender. |
| inbox | string | yes | – |
| subject | string | – | Part of the subject. |
| timeout_seconds | integer | – | Default 120. |
No output schema declared.
No examples provided.
jevway_journey_annotate Describe a journey screen ~78
Describe a screen by id, and/or move steps from_step..to_step (0-based, see journey.json) into a named flow.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| insight | string | – | – |
| journey | string | yes | – |
| relabel | object | – | – |
| screen | string | yes | – |
No output schema declared.
No examples provided.
jevway_journey_autopilot Let Jev explore the journey ~97
Let Jev explore: with `intent` until it is reached, a stop (sign-in, an irreversible tap) or no untried taps; without, for `screens` new screens. Skips tried, off-site and irreversible taps; returns a move log.
| Name | Type | Req | Description |
|---|---|---|---|
| flow | string | – | – |
| intent | string | – | – |
| journey | string | yes | – |
| screens | integer | – | – |
No output schema declared.
No examples provided.
jevway_journey_finish Finish the journey map ~51
Write journey.json and the index.html viewer, close the tab unless `keep_tab`, and list screens still undescribed.
| Name | Type | Req | Description |
|---|---|---|---|
| journey | string | yes | – |
| keep_tab | boolean | – | – |
No output schema declared.
No examples provided.
jevway_journey_start Start mapping mobile user journeys ~177
Open a URL on an emulated phone and map its user journeys: each screen gets a report (type, UI patterns, ranked next taps, QA findings) and an image. Go on with jevway_journey_step (you pick) or jevway_journey_autopilot (Jev explores), describe screens with jevway_journey_annotate, end with jevway_journey_finish.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | – |
| intent | string | – | One journey to follow; omit to explore. |
| out_dir | string | – | Exact folder (default ./.jevway/journeys/…). |
| stay_within | string | – | URL prefix to stay under (default: same origin). |
| url | string | yes | – |
| values | object | – | Text autopilot may type. |
No output schema declared.
No examples provided.
jevway_journey_step Take the next journey step ~125
Take one step and note the screen you leave. `next`: an index from `elements` or `ranked_taps` ("3:2" is a dropdown option), back, restart, scroll_down, scroll_up or screen:<id>.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | What the screen you leave is. |
| flow | string | – | Flow name, kept for later steps. |
| insight | string | – | A UX observation. |
| journey | string | yes | – |
| next | string|number | yes | – |
| value | string | – | Text to type. |
No output schema declared.
No examples provided.
jevway_look Look at a page without Jev ~110
Read a page now, no model call, no input: url, title, page_text, the controls with their state, password fields as filled or empty. Pass one of `session`, `tab` (part of a tab's URL) or `url` (opened, read, closed).
| Name | Type | Req | Description |
|---|---|---|---|
| boolean | – | Also save the page as a PDF; returns its path. | |
| session | string | – | – |
| tab | string | – | – |
| url | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| elements | array | yes | – |
| page_text | string | yes | – |
| title | string | yes | – |
| url | string | yes | – |
No examples provided.
jevway_task Run a browser goal with Jev ~725
Run a whole browser goal with TypeSafe Jev and get one summary. Start with `url` (the page where the change is made, not a parent page) or `tab`; continue with `session`. Statuses (`next` says what to do): done (`done_when` passed); needs_input (add the `missing` fields to `values`); needs_confirmation (the next click looks irreversible: see `confirm_irreversible`); uncertain / blocked (read `reason` and the screenshot; rephrase `goal` or use chrome-devtools; a `wall` is for the user to pass, never get past a bot check); step_budget (continue with a narrower goal). Password fields are never typed: the user types them, then say so in `goal`. Closed shadow DOM, canvas: use chrome-devtools.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_coordinate_clicks | boolean | – | New session, opt-in: click a screenshot box no listed element matches (canvas). |
| allowed_hosts | array | – | Hosts the run may be on ("github.com", "*.example.com"); leaving ends it blocked. |
| blocked_hosts | array | – | Hosts never to visit. |
| checks | array | – | Facts code checks on the final page: url_contains, title_contains, text_contains, text_absent {text}; url_matches {pattern: glob}; element_exists {name, role?}; value_equals {label, value}; checked {… |
| confirm_irreversible | boolean | – | Allow one irreversible click, only when the user's own request names this action and its target ("unused repos" names none: ask). Only the control the needs_confirmation named, on the call answering… |
| confirm_target | string | – | The user's words naming the target ("ada/scratch"); the page must show them. |
| detail | string | – | full adds raw steps, confidences, Jev stats. |
| done_when | string | – | Visible proof of success on this call's end page; done needs it. Resend with a new goal. |
| files | object | – | Files the user asked to upload: key → absolute path or https URL. |
| goal | string | yes | The whole outcome, every filter and choice. |
| max_seconds | integer | – | Default 300. |
| max_steps | integer | – | Default 40. |
| record | boolean | – | New session: keep a video, step shots and index.html for people. |
| record_dir | string | – | New session: the run folder (recording on) goes here. |
| screenshot | boolean | – | Inline the final screenshot on done too. |
| secret_keys | array | – | Keys of values that are secrets: Jev sees only the key; results show [secret:<key>]. |
| session | string | – | Continue this session. |
| tab | string | – | New session on the open tab whose URL contains this. |
| totp | object | – | 2FA on the user's own account: key → authenticator secret (base32 or otpauth URI); the current code is typed. |
| url | string | – | New session in a background tab. |
| values | object | – | Every text Jev may type, by key: {"city":"Lisbon"}. Nothing else is typed. |
| wait_for_person_seconds | integer | – | Wait for the user at a bot check or sign-in; default 120, 0 off. |
| Name | Type | Req | Description |
|---|---|---|---|
| ask_user | object | – | – |
| files | object | – | – |
| next | string | yes | – |
| page_text | string | yes | – |
| reason | string | yes | – |
| session | string | yes | – |
| status | string | yes | – |
| story | array | yes | – |
| title | string | yes | – |
| url | string | yes | – |
No examples provided.
How do I install the jevway MCP server?
jevway runs locally as an npm package, launched with npx -y jevway. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · jevway
claude mcp add abdallahaho-jevway -- npx -y jevway
What is the jevway MCP server?
jevway is an MCP server listed in the public MCP registry as io.github.AbdallahAHO/jevway. Hand a browser goal to TypeSafe Jev in your Chrome or a throwaway one; get one checked summary. This page covers its npm package (jevway).
Is the jevway MCP server safe to use?
jevway scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the jevway MCP server expose?
jevway exposes 10 tools: jevway_task, jevway_look, jevway_end, jevway_journey_start, jevway_journey_step, and 5 more. Their descriptions and schemas cost roughly 1,569 tokens of context every time the server is loaded.
Is the jevway MCP server still maintained?
jevway is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the jevway MCP server under?
jevway declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.