Log inSubmit server
ThumbGate logo

ThumbGate

by IgorGanapolsky

Pre-action firewall for AI coding agents that turns feedback into local checks and blocks or warns on risky tool calls.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install ThumbGate

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "igorganapolsky-thumbgate": {
      "command": "npx",
      "args": [
        "-y",
        "thumbgate"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

IgorGanapolsky/ThumbGate evaluates proposed coding-agent tool calls at the PreToolUse boundary before execution. It hard-blocks detected secret leaks and self-disable commands by default, while warning on other risky patterns such as recursive deletion and force-pushes. Operators can capture thumbs-up/down feedback as local lessons, then reuse those lessons as prevention rules and evaluation cases. Reach for it when an agent needs runtime safeguards that work locally without updating model weights or relying on a cloud service.

Use cases

  • Block detected secret leaks before an agent executes a tool call
  • Warn on destructive commands such as recursive deletion or force-pushes
  • Capture thumbs-down feedback as reusable local prevention rules
  • Evaluate accepted feedback as local prompt test cases
  • Verify that an agent's PreToolUse hook is wired correctly

Key features

  • PreToolUse interception before tool execution
  • Local feedback lessons and prevention rules
  • Default hard blocks for secret leaks and self-disable commands
  • Strict mode for converting warnings into denials
  • Stdio MCP server with gate_check
  • Local dashboard and evaluation reports

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

21/21 checks healthy over the last 80d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 12d ago via OSV.dev · thumbgate (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars29Stargazers on the source repository.
npm downloads2.5kPackage downloads in the last 30 days.
Last commit5d agoMost recent push to the default branch.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How ThumbGate works

What IgorGanapolsky/ThumbGate does

IgorGanapolsky/ThumbGate places a local decision point between an AI coding agent's proposed action and the tool that would execute it. It is designed to catch mistakes before they affect a checkout, expose a secret, or alter a repository.

By default, the gate blocks detected secret leaks and two classes of commands intended to disable ThumbGate itself: terminating the gate process and enabling its bypass environment override. Other high-risk patterns, including rm -rf, force-pushes, fetch-and-run commands, and direct edits to guardrails, produce a warning and are logged. Everything else is allowed unless a learned rule matches it.

Thumbs-down feedback can be recorded as a local lesson with context, the failed behavior, and the desired change. Repeated concrete failures can become prevention rules. These rules can promote a warning into a blocking gate without retraining the model.

How it works

The enforcement path runs locally and does not require a cloud service. Agent integrations use either a native pre-tool hook or the MCP interface, depending on the client. Claude Code, Codex, and Gemini CLI use hard PreToolUse-style enforcement; Cursor, Cline, OpenCode, and generic MCP agents use the gate_check MCP tool as an advisory path.

Strict enforcement is controlled with THUMBGATE_STRICT_ENFORCEMENT=1. In that mode, checks that would normally warn and log become hard denials. For example, a saved lesson about avoiding DROP on production tables can cause a later matching proposal to be rejected before execution.

Setup and configuration

Install the command-line package through npm and initialize the agent-specific wiring:

Terminal
npx thumbgate init
npx thumbgate doctor

doctor verifies that the PreToolUse hook is installed. To use ThumbGate as an MCP server, start the stdio transport instead:

Terminal
npx -y thumbgate serve

npx -y thumbgate mcp is an equivalent MCP command. Do not substitute npm start for MCP setup; that command starts the hosted HTTP API rather than the agent-facing stdio server.

A local dashboard can be opened with npx thumbgate dashboard --open. Capture feedback with a command such as:

Terminal
npx thumbgate capture --feedback=down --context="Never run DROP on production tables" --what-went-wrong="agent proposed DROP" --what-to-change="require review for DROP"

Tools and capabilities

  • init configures supported agent hooks or MCP wiring.
  • doctor checks whether the PreToolUse hook is connected.
  • serve and mcp expose the stdio MCP server.
  • gate_check evaluates a proposed action through MCP.
  • capture records accepted feedback as a local lesson.
  • eval converts accepted feedback into reusable evaluation cases and local proof reports.
  • dashboard opens local enforcement statistics.
  • Strict mode changes warning verdicts into denials.

Limitations and notes

ThumbGate intercepts tool calls at runtime; it does not update model weights. The native hook path provides hard enforcement for Claude Code, Codex, and Gemini CLI. Cursor, Cline, OpenCode, and other MCP agents use the advisory MCP gate_check route rather than the same native hard-hook path.

The default policy is intentionally mixed: only certain secret-leak and self-disable classes are blocked immediately, while several destructive or risky command classes warn and log until strict enforcement is enabled. MCP registries and clients must launch the stdio server, not the HTTP API.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about ThumbGate

IgorGanapolsky/ThumbGate is an MCP server that connects AI coding agents to a local pre-action firewall. Its main tools include gate_check for evaluating proposed actions, capture for saving feedback as lessons, and eval for turning feedback into reusable evaluation cases and local proof reports.

Install it with `npx -y thumbgate serve` for the stdio MCP server. Use `npx thumbgate init` for agent-specific wiring, then run `npx thumbgate doctor` to verify the PreToolUse hook. The equivalent MCP command is `npx -y thumbgate mcp`; do not use `npm start` for MCP.

Yes, Cursor is supported through MCP with the `gate_check` tool. The Cursor integration is advisory rather than the native hard PreToolUse enforcement used by some other supported agents. Initialize it with `npx thumbgate init --agent cursor`.

Set `THUMBGATE_STRICT_ENFORCEMENT=1`. In strict mode, warning cases such as `rm -rf`, force-pushes, fetch-and-run commands, and direct guardrail edits become hard denials before tool execution.

Yes, feedback can be captured as local lessons with context, the failed behavior, and the requested change. Repeated concrete failures can become prevention rules, and `npx thumbgate eval` turns accepted feedback into reusable evaluation cases and local proof reports.

Related MCP servers

All in Coding Agents All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewThumbGate AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/igorganapolsky-thumbgate?style=directory)](https://allmcps.com/mcp/igorganapolsky-thumbgate)
HTML Embed
<a href="https://allmcps.com/mcp/igorganapolsky-thumbgate"><img src="https://allmcps.com/api/badge/igorganapolsky-thumbgate?style=directory" alt="ThumbGate on AllMCPs" /></a>