# ThumbGate

ThumbGate checks tool calls before execution and stops selected risky actions. Use it when an agent can expose secrets or damage project files.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 29
- Author: IgorGanapolsky
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/IgorGanapolsky/ThumbGate
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/thumbgate

## What it does

ThumbGate runs locally as an MCP server and inspects a proposed tool call through the PreToolUse hook before the action starts. Detected secret exposure and commands aimed at disabling the gate are denied by default. Other risky patterns, including `rm -rf`, force-pushes, fetch-and-run commands, and direct guardrail edits, produce a warning and a log entry.

Accepted feedback is kept as local lessons. Repeated failures can become prevention rules, while `npx thumbgate eval` turns feedback into reusable checks and local proof reports. Setup starts with `npx thumbgate init`.

Without `THUMBGATE_STRICT_ENFORCEMENT=1`, warning-level patterns are not denied, so strict blocking requires that environment setting.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add thumbgate -- npx -y thumbgate
```

### Codex

**Platform CLI**
```bash
codex mcp add thumbgate -- npx -y thumbgate
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "thumbgate": {
            "command": "npx",
            "args": [
                "-y",
                "thumbgate"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "thumbgate": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "thumbgate"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add thumbgate npx -y thumbgate
```

## When to use it
- stop secret leaks before a tool call runs
- catch commands that try to disable the gate
- flag destructive file and Git operations
- turn repeated agent failures into local prevention rules

## Example prompts
- Inspect this tool call before execution and deny it if it exposes a secret.
- Check whether `rm -rf tests/` should be allowed.
- Run the gate in strict mode with `THUMBGATE_STRICT_ENFORCEMENT=1`.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [browser-use](https://affpapa.org/en/nevibecode/mcp/browser-use.md) — MCP server · ★ 119160
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47392
- [mcp-server](https://affpapa.org/en/nevibecode/mcp/mcp-server.md) — MCP server · ★ 43872

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md