Can You Own the Decision Layer Instead of Renting Jev? — Clef
On 1 October, Cloudflare put Clef, an open decision model built to do the job you rent from Jev for 4.2 cents per million tokens, on Hugging Face under Apache 2.0. I ran it on the Mac Studio on my desk. It fits, it costs more to own than to rent, and shrinking it to 4-bit flipped one agent-safety call.
The Promise
- The decision layer is downloadable now. Clef (27 billion parameters) and Clef-flash (nine billion) ship under Apache 2.0, read text and images, and run on hardware you can put under a desk.
- On a Mac Studio with an M2 Max and 96 GB, full-precision Clef routed a 500-token support ticket in 2.77 seconds. Clef-flash did it in 0.80.
- Self-hosted, every ticket, command and invoice the layer reads stays in your building. No rate limits but your own hardware, and the weights are yours to tune on your own past decisions.
- Cloudflare says its API is Jev-compatible, so testing the swap is a configuration change, not a rewrite.
The Risk
- Owning costs more. Self-hosted Clef on a rented H200 works out around 13 cents per million tokens if the card never idles, three times Jev's price. At a quarter of capacity it is about 12 times.
- Clef-flash at 4-bit flipped `terraform apply -auto-approve` on staging from safe (0.78) to unsafe (0.45). Two independent conversions did the same. Quantisation went in as a memory saving and came out as a different safety answer.
- The backbone is Alibaba's Qwen. The weights don't phone home, but some procurement policies bar Chinese-origin models outright.
- Cloudflare's benchmark lead and latency figures are vendor-reported and not yet independently reproduced.
Rent or own
Jev, TypeSafe’s decision model, charges 4.2 cents to read a million tokens and hand back a decision: route this ticket, block this command, flag this invoice. On 1 October, Cloudflare released Clef, built for the same job, and put the weights on Hugging Face under Apache 2.0.
A decision model doesn’t write. You give it an input and a set of questions with the answers defined in advance, and it returns a probability for every allowed answer. It can’t answer outside the set, because there is no outside the set. (The Jev episode covers how that works and where it fits next to Claude.)
This is turning into a category fast. At its 29 September DevDay, OpenAI launched a Decisions API that points its smaller Luna model at the same job, in limited preview with no published price. That is one more way to rent the layer. Clef is the one you can download: Clef at 27 billion parameters and Clef-flash at nine billion, both post-trained on Alibaba’s Qwen, both reading text and images with a 64,000-token window.
Does it fit?
Weights take parameters times bytes per parameter. Clef is 13.5 GB at 4-bit, 27 GB at 8-bit and 54 GB at full precision. Clef-flash is 4.5 GB at 4-bit and 18 GB at full precision.
Then comes the memory each request needs while the model reads, the key-value cache. Clef is unusual here: only 16 of its 64 layers use full attention, which put my estimate at about 4.5 GB per request at a full 64,000-token window. My Mac corrected that. Full-precision Clef loaded at 55 GB and peaked at 61.2 GB on a 32,000-token request, half the window. For a full window, budget 10 to 12 GB above the weights.
At 4-bit, Clef fit in 17 GB and got slower, which is the opposite of what most people expect. On a Mac, a 4-bit model unpacks its weights while it works. Quantising saves memory and costs speed. One practical note: the PyTorch route started pushing full-precision Clef into swap a third of the way through loading, and I stopped it. Apple’s MLX loaded the same weights without trouble. Every configuration, timing and script is in Labs: Clef on Apple Silicon.
On the two reference rigs:
| RTX 5090 (32 GB) | Mac Studio Ultra (256 GB) | |
|---|---|---|
| Clef 4-bit | Go: peaked at 22.5 GB on a 32,000-token request on my Mac | Go |
| Clef 8-bit | Squeeze: 30 GB for one short ticket | Go |
| Clef full precision | No go: 54 GB of weights | Go, with over 100 GB to spare |
| Clef-flash | Go | Go |
| Jev | No go: weights not published | No go |
Does shrinking it change the answers?
I built 60 synthetic decisions: ticket routing, invoice risk, and 20 agent commands to approve or block. Clef never changed an answer: 60 of 60 at 8-bit, 60 of 60 at 4-bit.
Clef-flash at 4-bit changed one. The command was terraform apply -auto-approve, adding a single tag to staging resources. At full precision, Clef-flash called it safe to run without a human, at 0.78. Two separate 4-bit conversions both flipped it to unsafe, at 0.45, which rules out the conversion. The bigger Clef called it unsafe at every precision.
If your auto-approve line sits at 0.8, neither version of Clef-flash runs that command. The threshold you picked did more work than the precision you picked.
Does owning it save money?
Rental prices, each from the vendor’s own pricing page: Jev 4.2 cents per million input tokens, output free. Clef hosted on Cloudflare 24 cents, Clef-flash nine cents.
Self-hosting a decision model is nearly all reading, at about two operations per parameter per token. NVIDIA rates an H200 at 989 trillion operations a second at 16-bit. Assume you get 40% of that and rent the card at $3.50 an hour (both my assumptions; substitute your own), and Clef costs about 13 cents per million tokens. Three times Jev, and only if the card is busy every hour of every day. At a quarter of capacity you pay 12 times. Clef-flash comes out around 4.4 cents, level with Jev, again only if the card never idles.
My own Mac, running full-precision Clef-flash flat out for an hour, routes about 1,300 of those 500-token tickets. Jev would charge 2.7 cents for the same work. If the question is price, Jev wins by a margin, which means price was the wrong question.
Where the logs live
A decision layer sits in front of everything: every ticket, every command your agent wants to run, every invoice. Rent it, and every one of those leaves your building.
I’ve spent 25 years in cybersecurity watching this with every inspection layer we ever bought, from firewalls to mail filters. The thing that classifies all your traffic sees all your traffic. In the end, the question that mattered was where the inspection happened and who could read the logs. Cloudflare promises it doesn’t read, store or train on requests to hosted Clef. Self-hosted, you don’t need the promise.
If you handle health or payments data and your decision layer today is an API call to a US startup, take this to your security team. If you’re a small team routing a few million tokens a month, stay on Jev or use Cloudflare’s hosted version; a card doesn’t pay at your volume.
Before you deploy, check four things. The licence is Apache 2.0, commercial use allowed. The backbone is Alibaba’s, so check your procurement policy before your engineers do the work. The benchmarks are Cloudflare’s own; they say Clef leads seven of ten decision benchmarks, and nobody has reproduced that yet, so run it on 50 of your own past decisions before you trust it with the next 50,000. And the calibration is yours: someone has to decide which threshold triggers the block, write it down, and recheck it after every quantisation.
Cloudflare’s Michelle Chen and her co-authors wrote that Clef “fits naturally into Cloudflare’s mission of being the agent cloud.” The open weights are real, and so is the on-ramp.
Owning the decision layer costs more than renting it. What you get for the difference is the logs. Before you renew, ask where yours live.