ThumbGate — Claude Code MCP server: what it does, how to install
ThumbGate checks tool calls before execution and stops selected risky actions. Use it when an agent can expose secrets or damage project files.
claude mcp add thumbgate -- npx -y thumbgateWhat ThumbGate does
ThumbGate runs locally as an MCP server and inspects a proposed tool call through the PreToolUse hook before the action starts. Detected secret exposure and commands aimed at disabling the gate are denied by default. Other risky patterns, including rm -rf, force-pushes, fetch-and-run commands, and direct guardrail edits, produce a warning and a log entry.
Accepted feedback is kept as local lessons. Repeated failures can become prevention rules, while npx thumbgate eval turns feedback into reusable checks and local proof reports. Setup starts with npx thumbgate init.
Without THUMBGATE_STRICT_ENFORCEMENT=1, warning-level patterns are not denied, so strict blocking requires that environment setting.
What it helps with
- stop secret leaks before a tool call runs
- catch commands that try to disable the gate
- flag destructive file and Git operations
- turn repeated agent failures into local prevention rules
Example prompts for the agent
- Inspect this tool call before execution and deny it if it exposes a secret.
- Check whether
rm -rf tests/should be allowed. - Run the gate in strict mode with
THUMBGATE_STRICT_ENFORCEMENT=1.
How to install ThumbGate
Platform CLI
claude mcp add thumbgate -- npx -y thumbgatePlatform CLI
codex mcp add thumbgate -- npx -y thumbgateConfig file
{
"mcpServers": {
"thumbgate": {
"command": "npx",
"args": [
"-y",
"thumbgate"
]
}
}
}Config file
{
"servers": {
"thumbgate": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"thumbgate"
]
}
}
}Platform CLI
gemini mcp add thumbgate npx -y thumbgateStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ThumbGate
How do I install ThumbGate in Claude Code?
Run claude mcp add thumbgate -- npx -y thumbgate.
What does ThumbGate do?
It reviews tool calls before execution. The server denies detected secret leaks and self-disable attempts, while other risky patterns are logged with warnings.
Which actions does ThumbGate block by default?
Secret leaks and commands that terminate the gate process or enable its bypass are blocked. rm -rf, git push --force, fetch-and-run, and direct guardrail edits receive warnings by default.
