thumbgate 1.27.11 → 1.27.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/.claude-plugin/plugin.json +1 -1
  2. package/.well-known/llms.txt +2 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +2 -4
  5. package/adapters/claude/.mcp.json +2 -2
  6. package/adapters/mcp/server-stdio.js +1 -1
  7. package/adapters/opencode/opencode.json +1 -1
  8. package/adapters/policy-engine/ethicore-guardian-client.js +68 -0
  9. package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +260 -0
  10. package/bin/cli.js +78 -259
  11. package/config/builtin-lessons.json +23 -0
  12. package/config/gate-templates.json +0 -228
  13. package/config/gates/claim-verification.json +0 -18
  14. package/package.json +35 -25
  15. package/public/assets/brand/thumbgate-logo-transparent.svg +22 -0
  16. package/public/assets/brand/thumbgate-mark-inline-v3.svg +19 -0
  17. package/public/assets/brand/thumbgate-mark.svg +11 -5
  18. package/public/blog.html +0 -30
  19. package/public/brand/thumbgate-mark.svg +9 -5
  20. package/public/chatgpt-app.html +2 -2
  21. package/public/compare.html +2 -1
  22. package/public/dashboard.html +1 -1
  23. package/public/federal.html +1 -1
  24. package/public/index.html +95 -216
  25. package/public/learn.html +59 -35
  26. package/public/lessons.html +1 -1
  27. package/public/numbers.html +2 -2
  28. package/public/pro.html +7 -7
  29. package/scripts/aws-blocks-guardrails.js +228 -0
  30. package/scripts/cli-schema.js +22 -10
  31. package/scripts/dashboard-chat.js +2 -1
  32. package/scripts/document-intake.js +1 -49
  33. package/scripts/durability/step.js +3 -3
  34. package/scripts/gate-stats.js +5 -11
  35. package/scripts/gemini-embedding-policy.js +2 -1
  36. package/scripts/hook-stop-anti-claim.js +116 -184
  37. package/scripts/hosted-config.js +0 -12
  38. package/scripts/llm-client.js +187 -5
  39. package/scripts/plausible-domain-config.js +3 -1
  40. package/scripts/seo-gsd.js +240 -1
  41. package/scripts/tool-registry.js +2 -2
  42. package/scripts/vector-store.js +44 -0
  43. package/scripts/workspace-evolver.js +62 -2
  44. package/src/api/server.js +340 -131
  45. package/public/assets/brand/thumbgate-mark-inline.svg +0 -15
  46. package/public/compare/adopt-ai.html +0 -219
  47. package/public/compare/agentix-labs.html +0 -197
  48. package/public/compare/ai-experience-orchestration.html +0 -216
  49. package/public/compare/anthropic-claude-for-legal.html +0 -260
  50. package/public/compare/anthropic-containment.html +0 -280
  51. package/public/compare/arcade.html +0 -175
  52. package/public/compare/arcjet.html +0 -239
  53. package/public/compare/bumblebee.html +0 -307
  54. package/public/compare/claude-code-hooks.html +0 -294
  55. package/public/compare/databricks-unity-ai-gateway.html +0 -215
  56. package/public/compare/fallow.html +0 -351
  57. package/public/compare/heidi.html +0 -233
  58. package/public/compare/mem0.html +0 -342
  59. package/public/compare/oak-and-sparrow-gatekeeper.html +0 -289
  60. package/public/compare/rein.html +0 -236
  61. package/public/compare/sigmashake.html +0 -256
  62. package/public/compare/speclock.html +0 -342
  63. package/public/guides/agent-harness-optimization.html +0 -342
  64. package/public/guides/agentic-web-governance.html +0 -406
  65. package/public/guides/ai-agent-governance-sprint.html +0 -415
  66. package/public/guides/ai-agent-pre-action-approval-gates.html +0 -401
  67. package/public/guides/ai-agent-workflow-migration-checklist.html +0 -392
  68. package/public/guides/ai-deployment-readiness.html +0 -415
  69. package/public/guides/ai-mode-ads-agent-governance.html +0 -401
  70. package/public/guides/ai-search-topical-presence.html +0 -342
  71. package/public/guides/autoresearch-agent-safety.html +0 -342
  72. package/public/guides/background-agent-governance.html +0 -358
  73. package/public/guides/best-tools-stop-ai-agents-breaking-production.html +0 -363
  74. package/public/guides/browser-automation-safety.html +0 -342
  75. package/public/guides/chatgpt-ads-trust.html +0 -353
  76. package/public/guides/claude-code-feedback.html +0 -339
  77. package/public/guides/claude-code-prevent-repeated-mistakes.html +0 -161
  78. package/public/guides/claude-code-skills-guardrails.html +0 -343
  79. package/public/guides/claude-desktop.html +0 -356
  80. package/public/guides/code-knowledge-graph-guardrails.html +0 -365
  81. package/public/guides/codex-cli-guardrails.html +0 -339
  82. package/public/guides/cursor-agent-guardrails.html +0 -339
  83. package/public/guides/cursor-prevent-repeated-mistakes.html +0 -161
  84. package/public/guides/database-agent-safety.html +0 -406
  85. package/public/guides/deepseek-v4-runtime-guardrails.html +0 -346
  86. package/public/guides/developer-machine-supply-chain-guardrails.html +0 -358
  87. package/public/guides/gcp-mcp-guardrails.html +0 -147
  88. package/public/guides/gemini-cli-feedback-memory.html +0 -339
  89. package/public/guides/gpt-5-5-model-evaluation.html +0 -358
  90. package/public/guides/internal-ai-engineering-stack-guardrails.html +0 -348
  91. package/public/guides/long-running-agent-context-management.html +0 -346
  92. package/public/guides/mcp-tool-governance.html +0 -401
  93. package/public/guides/multica-thumbgate-setup.html +0 -134
  94. package/public/guides/native-messaging-host-security.html +0 -342
  95. package/public/guides/policy-engine-pre-action-gates.html +0 -346
  96. package/public/guides/pre-action-checks.html +0 -342
  97. package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +0 -342
  98. package/public/guides/prompt-tricks-to-workflow-rules.html +0 -365
  99. package/public/guides/proxy-pointer-rag-guardrails.html +0 -352
  100. package/public/guides/rag-precision-tuning-guardrails.html +0 -352
  101. package/public/guides/reasoning-compression-guardrails.html +0 -346
  102. package/public/guides/relational-knowledge-ai-recommendations.html +0 -342
  103. package/public/guides/roo-code-alternative-cline.html +0 -339
  104. package/public/guides/semantic-programmatic-seo-guardrails.html +0 -352
  105. package/public/guides/seo-agent-skills-guardrails.html +0 -344
  106. package/public/guides/stop-repeated-ai-agent-mistakes.html +0 -342
  107. package/public/learn/ac-dc-runtime-enforcement.html +0 -277
  108. package/public/learn/agent-harness-pattern.html +0 -181
  109. package/public/learn/agent-identity-connector-governance.html +0 -146
  110. package/public/learn/agent-swarms-shared-gates.html +0 -173
  111. package/public/learn/agentic-enterprise-context-brain.html +0 -117
  112. package/public/learn/agentic-os-team-governance.html +0 -146
  113. package/public/learn/ai-agent-governance.html +0 -158
  114. package/public/learn/ai-agent-persistent-memory.html +0 -211
  115. package/public/learn/anthropomorphic-claim-gates.html +0 -180
  116. package/public/learn/background-agent-control-layer.html +0 -184
  117. package/public/learn/claude-code-goal-with-rubrics.html +0 -205
  118. package/public/learn/codex-role-plugins-need-governance.html +0 -125
  119. package/public/learn/cost-aware-agent-gate-routing.html +0 -173
  120. package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +0 -157
  121. package/public/learn/deterministic-agent-workflows.html +0 -185
  122. package/public/learn/feedback-loop-vs-decision-layer.html +0 -283
  123. package/public/learn/from-prototype-to-production.html +0 -223
  124. package/public/learn/learn.css +0 -51
  125. package/public/learn/mcp-pre-action-checks-explained.html +0 -172
  126. package/public/learn/pretix-stripe-connect-marketplaces.html +0 -161
  127. package/public/learn/regulated-agent-execution-boundary.html +0 -196
  128. package/public/learn/spec-driven-development.html +0 -168
  129. package/public/learn/stop-ai-agent-force-push.html +0 -134
  130. package/public/learn/vibe-coding-safety-net.html +0 -142
  131. package/scripts/reddit-browser-notification-watch.js +0 -230
package/public/guides/mcp-tool-governance.html DELETED
@@ -1,401 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
- <title>MCP Tool Governance | Pre-Action Gates Before Agents Call Tools</title>
7
- <meta name="description" content="MCP makes tools easy for agents to discover and call. ThumbGate adds the missing governance layer: approval boundaries, evidence requirements, and audit logs..." />
8
- <meta property="og:title" content="MCP Tool Governance | Pre-Action Gates Before Agents Call Tools" />
9
- <meta property="og:description" content="MCP makes tools easy for agents to discover and call. ThumbGate adds the missing governance layer: approval boundaries, evidence requirements, and audit logs..." />
10
- <meta property="og:type" content="article" />
11
- <meta property="og:url" content="https://thumbgate.ai/guides/mcp-tool-governance" />
12
- <link rel="canonical" href="https://thumbgate.ai/guides/mcp-tool-governance" />
13
- <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
- <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
15
- <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
- <meta property="og:image" content="/og.png" />
17
- <style>
18
- :root {
19
- --bg: #0a0a0b;
20
- --bg-raised: #111113;
21
- --bg-card: #161618;
22
- --line: #222225;
23
- --text: #e8e8ec;
24
- --muted: #8b8b96;
25
- --cyan: #22d3ee;
26
- --green: #4ade80;
27
- --red: #f87171;
28
- }
29
- * { box-sizing: border-box; }
30
- body {
31
- margin: 0;
32
- font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
33
- background: var(--bg);
34
- color: var(--text);
35
- line-height: 1.65;
36
- }
37
- a { color: var(--cyan); text-decoration: none; }
38
- a:hover { text-decoration: underline; }
39
- .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
40
- .topbar {
41
- position: sticky;
42
- top: 0;
43
- z-index: 20;
44
- backdrop-filter: blur(12px);
45
- background: rgba(10, 10, 11, 0.88);
46
- border-bottom: 1px solid var(--line);
47
- }
48
- .topbar .container {
49
- display: flex;
50
- justify-content: space-between;
51
- align-items: center;
52
- padding-top: 14px;
53
- padding-bottom: 14px;
54
- }
55
- .brand {
56
- font-weight: 700;
57
- color: var(--text);
58
- display: inline-flex;
59
- align-items: center;
60
- gap: 8px;
61
- text-decoration: none;
62
- }
63
- .brand .logo-mark { width: 28px; height: 28px; display: block; }
64
- .hero { padding: 72px 0 32px; }
65
- .eyebrow {
66
- display: inline-flex;
67
- align-items: center;
68
- gap: 8px;
69
- padding: 6px 12px;
70
- border-radius: 999px;
71
- border: 1px solid rgba(34, 211, 238, 0.22);
72
- background: rgba(34, 211, 238, 0.1);
73
- color: var(--cyan);
74
- text-transform: uppercase;
75
- letter-spacing: 0.08em;
76
- font-size: 12px;
77
- font-weight: 700;
78
- }
79
- h1 {
80
- font-size: clamp(34px, 5vw, 56px);
81
- line-height: 1.06;
82
- letter-spacing: -0.04em;
83
- margin: 16px 0;
84
- max-width: 760px;
85
- }
86
- .hero p {
87
- max-width: 720px;
88
- color: var(--muted);
89
- font-size: 18px;
90
- }
91
- .signal-row {
92
- display: flex;
93
- flex-wrap: wrap;
94
- gap: 12px;
95
- margin: 28px 0 0;
96
- }
97
- .signal-pill {
98
- display: inline-flex;
99
- align-items: center;
100
- gap: 8px;
101
- padding: 10px 14px;
102
- border-radius: 999px;
103
- border: 1px solid var(--line);
104
- background: var(--bg-raised);
105
- font-weight: 600;
106
- font-size: 14px;
107
- }
108
- .signal-pill.up {
109
- border-color: rgba(74, 222, 128, 0.28);
110
- color: #b8f7c8;
111
- background: rgba(74, 222, 128, 0.1);
112
- }
113
- .signal-pill.down {
114
- border-color: rgba(248, 113, 113, 0.28);
115
- color: #ffc0c0;
116
- background: rgba(248, 113, 113, 0.1);
117
- }
118
- .grid {
119
- display: grid;
120
- grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
121
- gap: 24px;
122
- padding-bottom: 72px;
123
- }
124
- .card, .detail-section, .sidebar-card {
125
- background: var(--bg-card);
126
- border: 1px solid var(--line);
127
- border-radius: 16px;
128
- }
129
- .card { padding: 24px; }
130
- .detail-section { padding: 24px; margin-bottom: 18px; }
131
- .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
132
- .detail-section p { color: var(--muted); }
133
- .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
134
- .card h2 { margin-top: 0; }
135
- .sidebar {
136
- display: flex;
137
- flex-direction: column;
138
- gap: 18px;
139
- }
140
- .sidebar-card {
141
- padding: 20px;
142
- }
143
- /* Only the first sidebar card sticks. Stacking multiple stickies at the
144
- same top offset makes them overlap each other on scroll. The related-
145
- pages card flows normally below. */
146
- .sidebar-card:first-child {
147
- position: sticky;
148
- top: 84px;
149
- max-height: calc(100vh - 104px);
150
- overflow-y: auto;
151
- -webkit-overflow-scrolling: touch;
152
- }
153
- .proof-links {
154
- display: flex;
155
- flex-wrap: wrap;
156
- gap: 12px;
157
- margin-top: 16px;
158
- }
159
- .cta-button {
160
- display: inline-flex;
161
- align-items: center;
162
- justify-content: center;
163
- margin-top: 18px;
164
- padding: 12px 16px;
165
- border-radius: 10px;
166
- background: var(--cyan);
167
- color: #071116;
168
- font-weight: 700;
169
- text-decoration: none;
170
- }
171
- .paid-sprint-card {
172
- border-color: rgba(74, 222, 128, 0.32);
173
- background: linear-gradient(180deg, rgba(17, 17, 19, 0.98), rgba(10, 20, 14, 0.96));
174
- }
175
- .paid-sprint-card p {
176
- color: var(--muted);
177
- font-size: 14px;
178
- line-height: 1.55;
179
- }
180
- .paid-offers {
181
- display: grid;
182
- gap: 10px;
183
- margin-top: 16px;
184
- }
185
- .paid-offer {
186
- display: flex;
187
- align-items: center;
188
- justify-content: space-between;
189
- gap: 12px;
190
- padding: 12px;
191
- border: 1px solid rgba(74, 222, 128, 0.28);
192
- border-radius: 10px;
193
- color: var(--fg);
194
- text-decoration: none;
195
- background: rgba(0, 0, 0, 0.22);
196
- }
197
- .paid-offer strong {
198
- color: #9af5b0;
199
- white-space: nowrap;
200
- }
201
- .paid-offer:hover, .paid-offer:focus-visible {
202
- border-color: rgba(74, 222, 128, 0.62);
203
- outline: none;
204
- }
205
- .secondary-cta {
206
- display: inline-flex;
207
- margin-top: 12px;
208
- color: var(--cyan);
209
- font-size: 14px;
210
- font-weight: 700;
211
- text-decoration: none;
212
- }
213
- .faq-item {
214
- border-top: 1px solid var(--line);
215
- padding: 14px 0;
216
- }
217
- .faq-item summary {
218
- cursor: pointer;
219
- font-weight: 600;
220
- }
221
- .faq-item p {
222
- color: var(--muted);
223
- }
224
- .related-card {
225
- display: block;
226
- padding: 14px;
227
- border-radius: 12px;
228
- border: 1px solid var(--line);
229
- background: var(--bg-raised);
230
- margin-top: 12px;
231
- color: var(--text);
232
- }
233
- .related-label {
234
- display: block;
235
- color: var(--muted);
236
- font-size: 12px;
237
- text-transform: uppercase;
238
- letter-spacing: 0.08em;
239
- margin-bottom: 4px;
240
- }
241
- @media (max-width: 860px) {
242
- .grid {
243
- grid-template-columns: 1fr;
244
- }
245
- .sidebar-card:first-child {
246
- position: static;
247
- max-height: none;
248
- overflow: visible;
249
- }
250
- }
251
- </style>
252
- <script type="application/ld+json">
253
- {
254
- "@context": "https://schema.org",
255
- "@type": "TechArticle",
256
- "headline": "MCP tool governance before agents call real systems",
257
- "description": "MCP makes tools easy for agents to discover and call. ThumbGate adds the missing governance layer: approval boundaries, evidence requirements, and audit logs...",
258
- "about": [
259
- "claude code masterclass guardrails",
260
- "cursor prevent repeated mistakes",
261
- "claude code prevent repeated mistakes",
262
- "codex cli guardrails"
263
- ],
264
- "url": "https://thumbgate.ai/guides/mcp-tool-governance",
265
- "publisher": {
266
- "@type": "Organization",
267
- "name": "ThumbGate",
268
- "url": "https://thumbgate.ai"
269
- },
270
- "mainEntityOfPage": "https://thumbgate.ai/guides/mcp-tool-governance"
271
- }
272
- </script>
273
- <script type="application/ld+json">
274
- {
275
- "@context": "https://schema.org",
276
- "@type": "FAQPage",
277
- "mainEntity": [
278
- {
279
- "@type": "Question",
280
- "name": "What is MCP tool governance?",
281
- "acceptedAnswer": {
282
- "@type": "Answer",
283
- "text": "MCP tool governance is the policy, approval, evidence, and audit layer around tools exposed through Model Context Protocol so agents do not call high-risk systems without the right checks."
284
- }
285
- },
286
- {
287
- "@type": "Question",
288
- "name": "How is this different from an MCP server allowlist?",
289
- "acceptedAnswer": {
290
- "@type": "Answer",
291
- "text": "An allowlist says a tool exists or is available. ThumbGate adds runtime context: tool arguments, branch, path, environment, prior feedback, evidence requirements, and whether this exact action should be allowed now."
292
- }
293
- },
294
- {
295
- "@type": "Question",
296
- "name": "Can ThumbGate work across multiple MCP-compatible agents?",
297
- "acceptedAnswer": {
298
- "@type": "Answer",
299
- "text": "Yes. The same local-first lesson and pre-action gate pattern is designed for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, and MCP-compatible workflows."
300
- }
301
- }
302
- ]
303
- }
304
- </script>
305
- </head>
306
- <body>
307
- <div class="topbar">
308
- <div class="container">
309
- <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
310
- <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
311
- </div>
312
- </div>
313
-
314
- <main class="container">
315
- <section class="hero">
316
- <div class="eyebrow">guide | mcp tool governance</div>
317
- <h1>MCP tool governance before agents call real systems</h1>
318
- <p>MCP makes tools easy for agents to discover and call. ThumbGate adds the missing governance layer: approval boundaries, evidence requirements, and audit logs before high-risk MCP tool calls execute.</p>
319
- <div class="signal-row">
320
- <div class="signal-pill up">👍 Thumbs up reinforces good behavior</div>
321
- <div class="signal-pill down">👎 Thumbs down blocks repeated mistakes</div>
322
- </div>
323
- </section>
324
-
325
- <section class="grid">
326
- <div>
327
- <div class="card">
328
- <h2>Why this page exists</h2>
329
- <ul><li>MCP adoption expands what agents can touch, so teams need a tool-call control plane.</li><li>Governance belongs before execution, not only in post-run logs or prompt rules.</li><li>ThumbGate turns feedback, policies, and evidence requirements into enforceable pre-action gates for MCP-compatible agent workflows.</li></ul>
330
- </div>
331
-
332
- <section class="detail-section">
333
- <h2>Why MCP changes the risk model</h2>
334
- <p>MCP turns databases, file systems, browsers, ticketing systems, cloud APIs, and internal tools into surfaces an agent can call. That is useful, but it also means a bad plan can become a real action faster than a human reviewer can notice.</p><p>The governance question is no longer only which tools exist. It is which agent, workflow, branch, file path, command, customer record, or environment is allowed to use each tool under which proof requirements.</p>
335
-
336
- </section>
337
- <section class="detail-section">
338
- <h2>What MCP tool governance needs</h2>
339
-
340
- <ul><li>Tool inventory: know which tools are exposed to which agents and runtimes.</li><li>Risk tiers: classify destructive, customer-facing, production, payment, and data-export tools differently from read-only tools.</li><li>Pre-action checks: require evidence or approval before risky calls execute.</li><li>Feedback loops: turn thumbs-down reviews and incidents into reusable prevention rules.</li><li>Audit proof: log allowed, blocked, and approved tool calls with enough context for review.</li></ul>
341
- </section>
342
- <section class="detail-section">
343
- <h2>Where ThumbGate fits</h2>
344
- <p>ThumbGate sits between generated intent and executed action. The agent can still plan and propose MCP tool calls, but ThumbGate checks the call against learned lessons, policy boundaries, evidence requirements, and workflow risk before the tool runs.</p>
345
-
346
- </section>
347
- <div class="detail-section">
348
- <h2>FAQ</h2>
349
-
350
- <details class="faq-item">
351
- <summary>What is MCP tool governance?</summary>
352
- <p>MCP tool governance is the policy, approval, evidence, and audit layer around tools exposed through Model Context Protocol so agents do not call high-risk systems without the right checks.</p>
353
- </details>
354
- <details class="faq-item">
355
- <summary>How is this different from an MCP server allowlist?</summary>
356
- <p>An allowlist says a tool exists or is available. ThumbGate adds runtime context: tool arguments, branch, path, environment, prior feedback, evidence requirements, and whether this exact action should be allowed now.</p>
357
- </details>
358
- <details class="faq-item">
359
- <summary>Can ThumbGate work across multiple MCP-compatible agents?</summary>
360
- <p>Yes. The same local-first lesson and pre-action gate pattern is designed for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, and MCP-compatible workflows.</p>
361
- </details>
362
- </div>
363
- </div>
364
-
365
- <aside class="sidebar">
366
-
367
-
368
-
369
-
370
-
371
- <div class="sidebar-card">
372
- <h2>GSD execution brief</h2>
373
- <p>This page was prioritized because it captures high-intent demand around mcp tool governance and feeds directly into ThumbGate's proof-led conversion path.</p>
374
- <p><strong>Opportunity score:</strong> 83</p>
375
- <p><strong>Primary persona:</strong> engineering-lead</p>
376
- <p><strong>Keyword cluster:</strong> claude code masterclass guardrails, cursor prevent repeated mistakes, claude code prevent repeated mistakes, codex cli guardrails</p>
377
- <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
378
- <div class="proof-links"><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">Automation proof</a><a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub repository</a></div>
379
- <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=guides_mcp-tool-governance&amp;cta_placement=seo_brief&amp;plan_id=pro" target="_blank" rel="noopener">Go Pro — $19/mo</a>
380
- </div>
381
- <div class="sidebar-card">
382
- <h2>Related pages</h2>
383
-
384
- <a class="related-card" href="/guides/pre-action-checks">
385
- <span class="related-label">Related page</span>
386
- <strong>What Are Pre-Action Checks?</strong>
387
- </a>
388
- <a class="related-card" href="/guides/ai-mode-ads-agent-governance">
389
- <span class="related-label">Related page</span>
390
- <strong>AI Mode ads make agent-governance promotion conversational</strong>
391
- </a>
392
- <a class="related-card" href="/guides/background-agent-governance">
393
- <span class="related-label">Related page</span>
394
- <strong>Background Agent Governance for Agent PRs</strong>
395
- </a>
396
- </div>
397
- </aside>
398
- </section>
399
- </main>
400
- </body>
401
- </html>
package/public/guides/multica-thumbgate-setup.html DELETED
@@ -1,134 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
- <title>Multica + ThumbGate: Pre-Action Checks for Self-Hosted Agent Autopilot</title>
7
- <meta name="description" content="Multica runs Claude Code / OpenCode / Code CLI as scheduled jobs on a self-hosted VPS. Autopilot magnifies tool-call mistakes. ThumbGate adds pre-action checks at the tool-call boundary with a local SQLite lesson DB on the same VPS." />
8
- <meta property="og:title" content="Multica + ThumbGate: Pre-Action Checks for Self-Hosted Agent Autopilot" />
9
- <meta property="og:description" content="Multica runs Claude Code / OpenCode / Code CLI as scheduled jobs on a self-hosted VPS. Autopilot magnifies tool-call mistakes. ThumbGate adds pre-action checks at the tool-call boundary with a local SQLite lesson DB on the same VPS." />
10
- <meta property="og:type" content="article" />
11
- <meta property="og:url" content="https://thumbgate.ai/guides/multica-thumbgate-setup" />
12
- <link rel="canonical" href="https://thumbgate.ai/guides/multica-thumbgate-setup" />
13
- <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
- <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
15
- <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
- <meta property="og:image" content="/og.png" />
17
- <script type="application/ld+json">
18
- {
19
- "@context": "https://schema.org",
20
- "@type": "TechArticle",
21
- "headline": "Multica + ThumbGate: Pre-Action Checks for Self-Hosted Agent Autopilot",
22
- "description": "Multica runs Claude Code / OpenCode / Code CLI as scheduled jobs on a self-hosted VPS. Autopilot magnifies tool-call mistakes. ThumbGate adds pre-action checks at the tool-call boundary with a local SQLite lesson DB on the same VPS.",
23
- "author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" },
24
- "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
25
- "datePublished": "2026-04-22",
26
- "dateModified": "2026-04-22",
27
- "mainEntityOfPage": "https://thumbgate.ai/guides/multica-thumbgate-setup"
28
- }
29
- </script>
30
- <style>
31
- :root { --bg: #0a0a0b; --bg-raised: #111113; --bg-card: #161618; --line: #222225; --text: #e8e8ec; --muted: #8b8b96; --cyan: #22d3ee; --green: #4ade80; --red: #f87171; }
32
- * { box-sizing: border-box; }
33
- body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: var(--bg); color: var(--text); line-height: 1.65; }
34
- a { color: var(--cyan); text-decoration: none; } a:hover { text-decoration: underline; }
35
- .container { max-width: 820px; margin: 0 auto; padding: 0 24px; }
36
- .topbar { position: sticky; top: 0; z-index: 20; backdrop-filter: blur(12px); background: rgba(10,10,11,0.88); border-bottom: 1px solid var(--line); }
37
- .topbar .container { display: flex; justify-content: space-between; align-items: center; padding: 14px 24px; }
38
- .brand { font-weight: 700; color: var(--text); text-decoration: none; }
39
- h1 { font-size: clamp(30px, 5vw, 46px); line-height: 1.15; margin: 40px 0 16px; }
40
- h2 { font-size: 24px; margin: 36px 0 12px; color: var(--cyan); }
41
- h3 { font-size: 18px; margin: 24px 0 8px; }
42
- p, li { font-size: 17px; color: var(--text); }
43
- .muted { color: var(--muted); }
44
- code, pre { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 14px; }
45
- pre { background: var(--bg-card); border: 1px solid var(--line); border-radius: 10px; padding: 16px; overflow-x: auto; }
46
- code.inline { background: var(--bg-card); padding: 2px 6px; border-radius: 4px; color: var(--cyan); }
47
- .eyebrow { display: inline-block; padding: 6px 12px; border-radius: 999px; border: 1px solid rgba(34,211,238,0.22); background: rgba(34,211,238,0.1); color: var(--cyan); text-transform: uppercase; letter-spacing: 0.08em; font-size: 12px; font-weight: 700; }
48
- .cta { display: inline-block; background: var(--cyan); color: #000; padding: 14px 22px; border-radius: 10px; font-weight: 700; margin: 24px 0; }
49
- article { padding: 24px 0 80px; }
50
- footer { border-top: 1px solid var(--line); padding: 32px 0; color: var(--muted); font-size: 14px; }
51
- </style>
52
- </head>
53
- <body>
54
- <header class="topbar">
55
- <div class="container">
56
- <a class="brand" href="/">ThumbGate</a>
57
- <nav><a href="/guides/">Guides</a> · <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a></nav>
58
- </div>
59
- </header>
60
-
61
- <main class="container">
62
- <article>
63
- <span class="eyebrow">Setup Guide</span>
64
- <h1>Multica + ThumbGate: Pre-Action Checks for Self-Hosted Agent Autopilot</h1>
65
- <p class="muted">Multica gives your AI agent a VPS, root shell, and a scheduled cron. The quiet risk: autopilot magnifies tool-call mistakes. This guide shows how to drop ThumbGate in front of your Multica-hosted agent so the wrong pattern never runs twice — much less every morning at 9am.</p>
66
-
67
- <h2>Why Multica needs a guard layer</h2>
68
- <p>Multica is self-hosted agent orchestration: Docker, Postgres, a kanban UI, and CLI agents (Claude Code, OpenCode, Code CLI) running as jobs on your VPS. Autopilot schedules recurring work — "every day at 9am, fetch these RSS feeds, pick the 10 best articles, draft a YouTube video."</p>
69
- <p>That is powerful, and it is exactly where tool-call mistakes get expensive:</p>
70
- <ul>
71
- <li>An agent that force-pushes once is a cleanup.</li>
72
- <li>An agent that force-pushes every morning because a scheduled job hits the same pattern is a production incident on a cron.</li>
73
- <li>Prompt rules (<code class="inline">CLAUDE.md</code>, <code class="inline">.cursorrules</code>) don't survive this. The context window rolls, autopilot fires fresh context, the bad pattern repeats.</li>
74
- </ul>
75
-
76
- <h2>What ThumbGate adds</h2>
77
- <p>ThumbGate is the tool-call-boundary enforcement layer. It runs as an MCP server on the same VPS as your Multica-hosted agent and maintains a local SQLite lesson database at <code class="inline">.thumbgate/memory.sqlite</code>. Every thumbs-down becomes a row. On every subsequent tool call, ThumbGate checks the proposed call against the DB and blocks known-bad patterns — <code class="inline">git push --force</code>, <code class="inline">rm -rf</code>, <code class="inline">curl ... | sh</code>, cloud mutations, writes to <code class="inline">.env</code> and <code class="inline">.git/</code> — before the command executes.</p>
78
- <p>No cloud service, no account, no vendor lock-in. The lesson DB lives next to the agent on your VPS.</p>
79
-
80
- <h2>Install inside Multica</h2>
81
- <p>There is no <code class="inline">--agent multica</code> flag because Multica is a runtime, not an agent. Multica invokes Claude Code or OpenCode as the actual terminal agent. ThumbGate wraps the underlying CLI with the install commands you already know:</p>
82
- <pre><code># On the VPS where Multica runs
83
- cd /path/to/project
84
-
85
- # For Claude Code (most common)
86
- npx thumbgate init --agent claude-code
87
-
88
- # Or OpenCode
89
- npx thumbgate init --agent opencode</code></pre>
90
- <p>The installer writes the MCP server config, wires the PreToolUse hook, creates <code class="inline">.thumbgate/memory.sqlite</code>, and prints every file it touched so you can roll back.</p>
91
-
92
- <h2>Verify it is working</h2>
93
- <pre><code>npx thumbgate verify --agent claude-code</code></pre>
94
- <p>Then in the Multica UI, create a test issue that asks the agent to run <code class="inline">git push --force</code> on a dummy branch. Inspect the execution history — the agent should hit the PreToolUse hook first and refuse. Capture the refusal with a thumbs-up; that teaches ThumbGate your enforcement preference persists.</p>
95
-
96
- <h2>Autopilot + ThumbGate: the right mental model</h2>
97
- <p>Multica's autopilot creates an Issue on each scheduled run, which the assigned agent picks up. The agent runs in a fresh session every time, which is precisely why prompt-level rules decay. ThumbGate's lesson DB is the piece of memory that survives the session reset:</p>
98
- <ul>
99
- <li>Session 1: autopilot fires, agent proposes bad pattern, you thumbs-down.</li>
100
- <li>Session 2 (tomorrow 9am): autopilot fires, agent proposes the same pattern, PreToolUse hook reads the DB, blocks the call, agent tries a different approach — zero token spend on the repeat.</li>
101
- </ul>
102
-
103
- <h2>Local-only vs VPS tradeoffs</h2>
104
- <p>Multica can run local-only or on a Tailscale-protected VPS. ThumbGate works identically in both:</p>
105
- <ul>
106
- <li><strong>Local-only Multica:</strong> <code class="inline">.thumbgate/memory.sqlite</code> lives on your dev machine. Best for sensitive repos.</li>
107
- <li><strong>VPS Multica:</strong> the SQLite file lives on the same VPS as the agent. Backs up as part of your regular VPS snapshots. Survives Multica upgrades, OS rebuilds, even a Multica sunset.</li>
108
- </ul>
109
- <p>The lesson DB is portable by design. If Multica ever gets replaced by the next orchestrator, you copy one file and the institutional memory moves with you.</p>
110
-
111
- <a class="cta" href="https://github.com/IgorGanapolsky/ThumbGate">Install ThumbGate →</a>
112
-
113
- <h2>FAQ</h2>
114
- <h3>Do I need a separate Multica adapter?</h3>
115
- <p>No. Multica invokes Claude Code or OpenCode as subprocesses. Both are first-class ThumbGate-supported agents.</p>
116
-
117
- <h3>Does ThumbGate work with Multica's "Talk directly to agent" mode?</h3>
118
- <p>Yes. The PreToolUse hook runs on every tool call, regardless of whether the call originated from an issue, an autopilot run, or direct chat.</p>
119
-
120
- <h3>What happens if the ThumbGate MCP server is down?</h3>
121
- <p>The PreToolUse hook fails closed by default — tool calls that can't reach the gate are blocked. You can relax to fail-open via <code class="inline">.thumbgate/config.json</code> if your workflow prefers availability over strictness.</p>
122
-
123
- <h3>Does thumbsing down in Multica's UI talk to ThumbGate?</h3>
124
- <p>Not directly. Multica's issue statuses ("In review") are workflow signals, not tool-call feedback. Capture ThumbGate feedback via <code class="inline">npx thumbgate capture down "context"</code> in the agent's shell. Future work: a Multica webhook that forwards issue-close reasons as ThumbGate feedback.</p>
125
- </article>
126
- </main>
127
-
128
- <footer>
129
- <div class="container">
130
- <p>ThumbGate — pre-action checks for AI coding agents. <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> · <a href="/">Home</a></p>
131
- </div>
132
- </footer>
133
- </body>
134
- </html>