LabscoMCP early access ↗
IgorGanapolskyMCP SERVER · OFFICIAL PROJECT

ThumbGate

A pre-action gate for coding agents: it reads the proposed tool call before it runs, blocks secret leaks outright, and turns your thumbs-down into a rule that fires next time.

by IgorGanapolsky ↗Agent Guardrails, Content Safety & Audit✓ Official

LABSCO SUMMARY

Rules that came from your own corrections, checked before the command runs.

The honest part is stated in the README itself: nothing here updates model weights, it intercepts tool calls at runtime. That is also why it works — a lesson captured on Tuesday is a pattern match, not a hope that the prompt survived compaction. Note the split by client: Claude Code, Codex, Gemini CLI and ForgeCode get real pre-execution hooks; Cursor, Cline and other MCP clients get advisory checks through gate_check.

What it is

ThumbGate, a local-first check that sits in the PreToolUse hook of a coding agent. It evaluates the command the model is about to run, and feedback you give afterwards becomes a stored lesson that can be promoted from a warning into a block.

What you get

  • gate_check reads a proposed tool call and returns a verdict before the agent executes it
  • Detected secret leaks are hard-blocked by default, as are the two command classes that would kill the gate process or set its bypass override
  • Rm -rf, git push --force, fetch-and-run and direct edits to the guardrails warn and log by default; THUMBGATE_STRICT_ENFORCEMENT=1 turns those warnings into denials
  • Feedback capture records what went wrong and what to change, and matching commands later surface the check with the pattern that fired and where it came from
  • A local dashboard shows what has been captured and what has fired
  • Installs its hooks machine-wide into ~/.claude/settings.json, or per-project with --project so lessons stay inside one repository

Requirements

The npm package thumbgate, version 1.35.0, started as npx -y thumbgate serve over stdio — not npm start, which launches the hosted HTTP API instead. Nothing to sign up for; the enforcement path runs locally. THUMBGATE_MCP_PROFILE optionally widens or narrows the exposed tool set beyond the default least-privilege profile.

Setup effort

One command — npx -y thumbgate serve

See installation options