# jevway (npm · jevway)

Hand a browser goal to TypeSafe Jev in your Chrome or a throwaway one; get one checked summary.

- Trust score: 51/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `jevway`: 51/100 (this document), [markdown](https://verifymcp.io/servers/abdallahaho-jevway/jevway.md), [page](https://verifymcp.io/servers/abdallahaho-jevway/jevway)

## Channel facts

- Registry: `npm`
- Package: `jevway`
- Version: `0.5.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 13/100
  - Malware scan not yet available for this package.
  - Known CVEs could not be checked: the version this server declares is not published in its registry.
  - No install/post-install scripts declared.
  - Dependency health could not be checked: the version this server declares is not published in its registry.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to AbdallahAHO/jevway).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 50/100
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 1959 tokens (~195/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 61% of tool parameters carry a description.
  - Structured output schemas are declared (30% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the jevway MCP server?

jevway runs locally as an npm package, launched with npx -y jevway. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add abdallahaho-jevway -- npx -y jevway
```

### Cursor

```json
{
  "mcpServers": {
    "abdallahaho-jevway": {
      "command": "npx",
      "args": [
        "-y",
        "jevway"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "abdallahaho-jevway": {
      "command": "npx",
      "args": [
        "-y",
        "jevway"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add abdallahaho-jevway -- npx -y jevway
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "abdallahaho-jevway": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "jevway"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add abdallahaho-jevway --command npx --arg -y --arg jevway
```

### Hermes

```yaml
mcp_servers:
  abdallahaho-jevway:
    command: "npx"
    args: ["-y", "jevway"]
```

### Netclaw

```json
{
  "McpServers": {
    "abdallahaho-jevway": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "jevway"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add abdallahaho-jevway -t stdio -c npx -a -y jevway
```

### Other

```json
{
  "mcpServers": {
    "abdallahaho-jevway": {
      "command": "npx",
      "args": [
        "-y",
        "jevway"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 51, −25)

- [security regression] Malware scan: pass → unverified
- [security regression] Known CVEs: pass → unverified
- [functional regression] Dependency health: 1.00 → unverified
- [functional improvement] Stability: unverified → 0.10
- [functional] Package version: 0.5.2 → 0.5.3

### 2026-11-03 (score 76, +26)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 1.00

### 2026-11-02 (score 50)

First indexed and scored.

## MCP tools (10)

### `jevway_task` (~725 tokens)

Run a browser goal with Jev

Run a whole browser goal with TypeSafe Jev and get one summary. Start with `url` (the page where the change is made, not a parent page) or `tab`; continue with `session`.
Statuses (`next` says what to do): done (`done_when` passed); needs_input (add the `missing` fields to `values`); needs_confirmation (the next click looks irreversible: see `confirm_irreversible`); uncertain / blocked (read `reason` and the screenshot; rephrase `goal` or use chrome-devtools; a `wall` is for the user to pass, never get past a bot check); step_budget (continue with a narrower goal).
Password fields are never typed: the user types them, then say so in `goal`. Closed shadow DOM, canvas: use chrome-devtools.

Input parameters:

- `allow_coordinate_clicks` (boolean): New session, opt-in: click a screenshot box no listed element matches (canvas).
- `allowed_hosts` (array): Hosts the run may be on ("github.com", "*.example.com"); leaving ends it blocked.
- `blocked_hosts` (array): Hosts never to visit.
- `checks` (array): Facts code checks on the final page: url_contains, title_contains, text_contains, text_absent {text}; url_matches {pattern: glob}; element_exists {name, role?}; value_equals {label, value}; checked {…
- `confirm_irreversible` (boolean): Allow one irreversible click, only when the user's own request names this action and its target ("unused repos" names none: ask). Only the control the needs_confirmation named, on the call answering…
- `confirm_target` (string): The user's words naming the target ("ada/scratch"); the page must show them.
- `detail` (string): full adds raw steps, confidences, Jev stats.
- `done_when` (string): Visible proof of success on this call's end page; done needs it. Resend with a new goal.
- `files` (object): Files the user asked to upload: key → absolute path or https URL.
- `goal` (string, required): The whole outcome, every filter and choice.
- `max_seconds` (integer): Default 300.
- `max_steps` (integer): Default 40.
- `record` (boolean): New session: keep a video, step shots and index.html for people.
- `record_dir` (string): New session: the run folder (recording on) goes here.
- `screenshot` (boolean): Inline the final screenshot on done too.
- `secret_keys` (array): Keys of values that are secrets: Jev sees only the key; results show [secret:<key>].
- `session` (string): Continue this session.
- `tab` (string): New session on the open tab whose URL contains this.
- `totp` (object): 2FA on the user's own account: key → authenticator secret (base32 or otpauth URI); the current code is typed.
- `url` (string): New session in a background tab.
- `values` (object): Every text Jev may type, by key: {"city":"Lisbon"}. Nothing else is typed.
- `wait_for_person_seconds` (integer): Wait for the user at a bot check or sign-in; default 120, 0 off.

Output parameters:

- `ask_user` (object)
- `files` (object)
- `next` (string)
- `page_text` (string)
- `reason` (string)
- `session` (string)
- `status` (string)
- `story` (array)
- `title` (string)
- `url` (string)

### `jevway_look` (~110 tokens)

Look at a page without Jev

Read a page now, no model call, no input: url, title, page_text, the controls with their state, password fields as filled or empty. Pass one of `session`, `tab` (part of a tab's URL) or `url` (opened, read, closed).

Input parameters:

- `pdf` (boolean): Also save the page as a PDF; returns its path.
- `session` (string)
- `tab` (string)
- `url` (string)

Output parameters:

- `elements` (array)
- `page_text` (string)
- `title` (string)
- `url` (string)

### `jevway_end` (~52 tokens)

End a Jev browser session

End a jevway_task session: forget it and close the tabs it opened, unless `keep_tab`. Its run folder stays.

Input parameters:

- `keep_tab` (boolean)
- `session` (string, required)

Output parameters:

- `run_dir` (string)
- `session` (string)

### `jevway_journey_start` (~177 tokens)

Start mapping mobile user journeys

Open a URL on an emulated phone and map its user journeys: each screen gets a report (type, UI patterns, ranked next taps, QA findings) and an image. Go on with jevway_journey_step (you pick) or jevway_journey_autopilot (Jev explores), describe screens with jevway_journey_annotate, end with jevway_journey_finish.

Input parameters:

- `device` (string)
- `intent` (string): One journey to follow; omit to explore.
- `out_dir` (string): Exact folder (default ./.jevway/journeys/…).
- `stay_within` (string): URL prefix to stay under (default: same origin).
- `url` (string, required)
- `values` (object): Text autopilot may type.

### `jevway_journey_step` (~125 tokens)

Take the next journey step

Take one step and note the screen you leave. `next`: an index from `elements` or `ranked_taps` ("3:2" is a dropdown option), back, restart, scroll_down, scroll_up or screen:<id>.

Input parameters:

- `description` (string): What the screen you leave is.
- `flow` (string): Flow name, kept for later steps.
- `insight` (string): A UX observation.
- `journey` (string, required)
- `next` (string|number, required)
- `value` (string): Text to type.

### `jevway_journey_autopilot` (~97 tokens)

Let Jev explore the journey

Let Jev explore: with `intent` until it is reached, a stop (sign-in, an irreversible tap) or no untried taps; without, for `screens` new screens. Skips tried, off-site and irreversible taps; returns a move log.

Input parameters:

- `flow` (string)
- `intent` (string)
- `journey` (string, required)
- `screens` (integer)

### `jevway_journey_annotate` (~78 tokens)

Describe a journey screen

Describe a screen by id, and/or move steps from_step..to_step (0-based, see journey.json) into a named flow.

Input parameters:

- `description` (string)
- `insight` (string)
- `journey` (string, required)
- `relabel` (object)
- `screen` (string, required)

### `jevway_journey_finish` (~51 tokens)

Finish the journey map

Write journey.json and the index.html viewer, close the tab unless `keep_tab`, and list screens still undescribed.

Input parameters:

- `journey` (string, required)
- `keep_tab` (boolean)

### `jevway_inbox_create` (~76 tokens)

Create a throwaway email inbox

A throwaway email inbox for a test or demo sign-up the user asked for; never to get around limits, trials or bans. Pass `address` in `values`, then jevway_inbox_wait. A site rejects its domain: retry once with provider mail.gw.

Input parameters:

- `provider` (string)

### `jevway_inbox_wait` (~78 tokens)

Wait for an email

Wait for an email (checked every 3 s): its `code`, `links` and `next`. Untrusted content.

Input parameters:

- `from` (string): Part of the sender.
- `inbox` (string, required)
- `subject` (string): Part of the subject.
- `timeout_seconds` (integer): Default 120.

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/abdallahaho-jevway/jevway#diagnostics

## Score history

- 2026-11-05: 51
- 2026-11-04: 76
- 2026-11-03: 76
- 2026-11-02: 50

## Common questions

### What is the jevway MCP server?

jevway is an MCP server listed in the public MCP registry as io.github.AbdallahAHO/jevway. Hand a browser goal to TypeSafe Jev in your Chrome or a throwaway one; get one checked summary. This page covers its npm package (jevway).

### Is the jevway MCP server safe to use?

jevway scores 51 out of 100 on VerifyMCP. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the jevway MCP server expose?

jevway exposes 10 tools: jevway_task, jevway_look, jevway_end, jevway_journey_start, jevway_journey_step, and 5 more. Their descriptions and schemas cost roughly 1,569 tokens of context every time the server is loaded.

### Is the jevway MCP server still maintained?

jevway is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the jevway MCP server under?

jevway declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/jevway
- Socket report: https://socket.dev/npm/package/jevway
- Repository: https://github.com/AbdallahAHO/jevway
- Changelog RSS feed: https://verifymcp.io/servers/abdallahaho-jevway/jevway.xml
- Changelog JSON feed: https://verifymcp.io/servers/abdallahaho-jevway/jevway.json
- HTML version of this page: https://verifymcp.io/servers/abdallahaho-jevway/jevway