thumbgate 1.27.12 → 1.27.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (132) hide show
  1. package/.claude-plugin/plugin.json +1 -1
  2. package/.well-known/llms.txt +2 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +2 -4
  5. package/adapters/claude/.mcp.json +2 -2
  6. package/adapters/mcp/server-stdio.js +1 -1
  7. package/adapters/opencode/opencode.json +1 -1
  8. package/adapters/policy-engine/ethicore-guardian-client.js +68 -0
  9. package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +260 -0
  10. package/bin/cli.js +78 -259
  11. package/config/gate-templates.json +0 -228
  12. package/config/gates/claim-verification.json +0 -18
  13. package/package.json +35 -25
  14. package/public/assets/brand/thumbgate-logo-transparent.svg +22 -0
  15. package/public/assets/brand/thumbgate-mark-inline-v3.svg +19 -0
  16. package/public/assets/brand/thumbgate-mark.svg +11 -5
  17. package/public/blog.html +0 -30
  18. package/public/brand/thumbgate-mark.svg +9 -5
  19. package/public/chatgpt-app.html +2 -2
  20. package/public/compare.html +2 -1
  21. package/public/dashboard.html +1 -1
  22. package/public/federal.html +1 -1
  23. package/public/index.html +95 -216
  24. package/public/learn.html +59 -35
  25. package/public/lessons.html +1 -1
  26. package/public/numbers.html +2 -2
  27. package/public/pro.html +7 -7
  28. package/scripts/aws-blocks-guardrails.js +228 -0
  29. package/scripts/cli-schema.js +22 -10
  30. package/scripts/dashboard-chat.js +2 -1
  31. package/scripts/document-intake.js +1 -49
  32. package/scripts/durability/step.js +3 -3
  33. package/scripts/gate-stats.js +5 -11
  34. package/scripts/gates-engine.js +0 -49
  35. package/scripts/gemini-embedding-policy.js +2 -1
  36. package/scripts/hook-stop-anti-claim.js +116 -184
  37. package/scripts/hosted-config.js +0 -12
  38. package/scripts/lesson-search.js +1 -15
  39. package/scripts/llm-client.js +187 -5
  40. package/scripts/plausible-domain-config.js +3 -1
  41. package/scripts/seo-gsd.js +240 -1
  42. package/scripts/tool-registry.js +2 -2
  43. package/scripts/vector-store.js +44 -0
  44. package/scripts/workspace-evolver.js +62 -2
  45. package/src/api/server.js +340 -131
  46. package/public/assets/brand/thumbgate-mark-inline.svg +0 -15
  47. package/public/compare/adopt-ai.html +0 -219
  48. package/public/compare/agentix-labs.html +0 -197
  49. package/public/compare/ai-experience-orchestration.html +0 -216
  50. package/public/compare/anthropic-claude-for-legal.html +0 -260
  51. package/public/compare/anthropic-containment.html +0 -280
  52. package/public/compare/arcade.html +0 -175
  53. package/public/compare/arcjet.html +0 -239
  54. package/public/compare/bumblebee.html +0 -307
  55. package/public/compare/claude-code-hooks.html +0 -294
  56. package/public/compare/databricks-unity-ai-gateway.html +0 -215
  57. package/public/compare/fallow.html +0 -351
  58. package/public/compare/heidi.html +0 -233
  59. package/public/compare/mem0.html +0 -342
  60. package/public/compare/oak-and-sparrow-gatekeeper.html +0 -289
  61. package/public/compare/rein.html +0 -236
  62. package/public/compare/sigmashake.html +0 -256
  63. package/public/compare/speclock.html +0 -342
  64. package/public/guides/agent-harness-optimization.html +0 -342
  65. package/public/guides/agentic-web-governance.html +0 -406
  66. package/public/guides/ai-agent-governance-sprint.html +0 -415
  67. package/public/guides/ai-agent-pre-action-approval-gates.html +0 -401
  68. package/public/guides/ai-agent-workflow-migration-checklist.html +0 -392
  69. package/public/guides/ai-deployment-readiness.html +0 -415
  70. package/public/guides/ai-mode-ads-agent-governance.html +0 -401
  71. package/public/guides/ai-search-topical-presence.html +0 -342
  72. package/public/guides/autoresearch-agent-safety.html +0 -342
  73. package/public/guides/background-agent-governance.html +0 -358
  74. package/public/guides/best-tools-stop-ai-agents-breaking-production.html +0 -363
  75. package/public/guides/browser-automation-safety.html +0 -342
  76. package/public/guides/chatgpt-ads-trust.html +0 -353
  77. package/public/guides/claude-code-feedback.html +0 -339
  78. package/public/guides/claude-code-prevent-repeated-mistakes.html +0 -161
  79. package/public/guides/claude-code-skills-guardrails.html +0 -343
  80. package/public/guides/claude-desktop.html +0 -356
  81. package/public/guides/code-knowledge-graph-guardrails.html +0 -365
  82. package/public/guides/codex-cli-guardrails.html +0 -339
  83. package/public/guides/cursor-agent-guardrails.html +0 -339
  84. package/public/guides/cursor-prevent-repeated-mistakes.html +0 -161
  85. package/public/guides/database-agent-safety.html +0 -406
  86. package/public/guides/deepseek-v4-runtime-guardrails.html +0 -346
  87. package/public/guides/developer-machine-supply-chain-guardrails.html +0 -358
  88. package/public/guides/gcp-mcp-guardrails.html +0 -147
  89. package/public/guides/gemini-cli-feedback-memory.html +0 -339
  90. package/public/guides/gpt-5-5-model-evaluation.html +0 -358
  91. package/public/guides/internal-ai-engineering-stack-guardrails.html +0 -348
  92. package/public/guides/long-running-agent-context-management.html +0 -346
  93. package/public/guides/mcp-tool-governance.html +0 -401
  94. package/public/guides/multica-thumbgate-setup.html +0 -134
  95. package/public/guides/native-messaging-host-security.html +0 -342
  96. package/public/guides/policy-engine-pre-action-gates.html +0 -346
  97. package/public/guides/pre-action-checks.html +0 -342
  98. package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +0 -342
  99. package/public/guides/prompt-tricks-to-workflow-rules.html +0 -365
  100. package/public/guides/proxy-pointer-rag-guardrails.html +0 -352
  101. package/public/guides/rag-precision-tuning-guardrails.html +0 -352
  102. package/public/guides/reasoning-compression-guardrails.html +0 -346
  103. package/public/guides/relational-knowledge-ai-recommendations.html +0 -342
  104. package/public/guides/roo-code-alternative-cline.html +0 -339
  105. package/public/guides/semantic-programmatic-seo-guardrails.html +0 -352
  106. package/public/guides/seo-agent-skills-guardrails.html +0 -344
  107. package/public/guides/stop-repeated-ai-agent-mistakes.html +0 -342
  108. package/public/learn/ac-dc-runtime-enforcement.html +0 -277
  109. package/public/learn/agent-harness-pattern.html +0 -181
  110. package/public/learn/agent-identity-connector-governance.html +0 -146
  111. package/public/learn/agent-swarms-shared-gates.html +0 -173
  112. package/public/learn/agentic-enterprise-context-brain.html +0 -117
  113. package/public/learn/agentic-os-team-governance.html +0 -146
  114. package/public/learn/ai-agent-governance.html +0 -158
  115. package/public/learn/ai-agent-persistent-memory.html +0 -211
  116. package/public/learn/anthropomorphic-claim-gates.html +0 -180
  117. package/public/learn/background-agent-control-layer.html +0 -184
  118. package/public/learn/claude-code-goal-with-rubrics.html +0 -205
  119. package/public/learn/codex-role-plugins-need-governance.html +0 -125
  120. package/public/learn/cost-aware-agent-gate-routing.html +0 -173
  121. package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +0 -157
  122. package/public/learn/deterministic-agent-workflows.html +0 -185
  123. package/public/learn/feedback-loop-vs-decision-layer.html +0 -283
  124. package/public/learn/from-prototype-to-production.html +0 -223
  125. package/public/learn/learn.css +0 -51
  126. package/public/learn/mcp-pre-action-checks-explained.html +0 -172
  127. package/public/learn/pretix-stripe-connect-marketplaces.html +0 -161
  128. package/public/learn/regulated-agent-execution-boundary.html +0 -196
  129. package/public/learn/spec-driven-development.html +0 -168
  130. package/public/learn/stop-ai-agent-force-push.html +0 -134
  131. package/public/learn/vibe-coding-safety-net.html +0 -142
  132. package/scripts/reddit-browser-notification-watch.js +0 -230
package/public/compare/fallow.html DELETED
@@ -1,351 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
- <title>ThumbGate vs Fallow | Static Analysis vs Agent Action Enforcement</title>
7
- <meta name="description" content="Fallow finds JS/TS code health issues: dead code, duplication, complexity, and architecture drift. ThumbGate is action-boundary enforcement for AI agents, st..." />
8
- <meta property="og:title" content="ThumbGate vs Fallow | Static Analysis vs Agent Action Enforcement" />
9
- <meta property="og:description" content="Fallow finds JS/TS code health issues: dead code, duplication, complexity, and architecture drift. ThumbGate is action-boundary enforcement for AI agents, st..." />
10
- <meta property="og:type" content="article" />
11
- <meta property="og:url" content="https://thumbgate.ai/compare/fallow" />
12
- <link rel="canonical" href="https://thumbgate.ai/compare/fallow" />
13
- <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
- <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
15
- <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
- <meta property="og:image" content="/og.png" />
17
- <style>
18
- :root {
19
- --bg: #0a0a0b;
20
- --bg-raised: #111113;
21
- --bg-card: #161618;
22
- --line: #222225;
23
- --text: #e8e8ec;
24
- --muted: #8b8b96;
25
- --cyan: #22d3ee;
26
- --green: #4ade80;
27
- --red: #f87171;
28
- }
29
- * { box-sizing: border-box; }
30
- body {
31
- margin: 0;
32
- font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
33
- background: var(--bg);
34
- color: var(--text);
35
- line-height: 1.65;
36
- }
37
- a { color: var(--cyan); text-decoration: none; }
38
- a:hover { text-decoration: underline; }
39
- .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
40
- .topbar {
41
- position: sticky;
42
- top: 0;
43
- z-index: 20;
44
- backdrop-filter: blur(12px);
45
- background: rgba(10, 10, 11, 0.88);
46
- border-bottom: 1px solid var(--line);
47
- }
48
- .topbar .container {
49
- display: flex;
50
- justify-content: space-between;
51
- align-items: center;
52
- padding-top: 14px;
53
- padding-bottom: 14px;
54
- }
55
- .brand {
56
- font-weight: 700;
57
- color: var(--text);
58
- display: inline-flex;
59
- align-items: center;
60
- gap: 8px;
61
- text-decoration: none;
62
- }
63
- .brand .logo-mark { width: 28px; height: 28px; display: block; }
64
- .hero { padding: 72px 0 32px; }
65
- .eyebrow {
66
- display: inline-flex;
67
- align-items: center;
68
- gap: 8px;
69
- padding: 6px 12px;
70
- border-radius: 999px;
71
- border: 1px solid rgba(34, 211, 238, 0.22);
72
- background: rgba(34, 211, 238, 0.1);
73
- color: var(--cyan);
74
- text-transform: uppercase;
75
- letter-spacing: 0.08em;
76
- font-size: 12px;
77
- font-weight: 700;
78
- }
79
- h1 {
80
- font-size: clamp(34px, 5vw, 56px);
81
- line-height: 1.06;
82
- letter-spacing: -0.04em;
83
- margin: 16px 0;
84
- max-width: 760px;
85
- }
86
- .hero p {
87
- max-width: 720px;
88
- color: var(--muted);
89
- font-size: 18px;
90
- }
91
- .signal-row {
92
- display: flex;
93
- flex-wrap: wrap;
94
- gap: 12px;
95
- margin: 28px 0 0;
96
- }
97
- .signal-pill {
98
- display: inline-flex;
99
- align-items: center;
100
- gap: 8px;
101
- padding: 10px 14px;
102
- border-radius: 999px;
103
- border: 1px solid var(--line);
104
- background: var(--bg-raised);
105
- font-weight: 600;
106
- font-size: 14px;
107
- }
108
- .signal-pill.up {
109
- border-color: rgba(74, 222, 128, 0.28);
110
- color: #b8f7c8;
111
- background: rgba(74, 222, 128, 0.1);
112
- }
113
- .signal-pill.down {
114
- border-color: rgba(248, 113, 113, 0.28);
115
- color: #ffc0c0;
116
- background: rgba(248, 113, 113, 0.1);
117
- }
118
- .grid {
119
- display: grid;
120
- grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
121
- gap: 24px;
122
- padding-bottom: 72px;
123
- }
124
- .card, .detail-section, .sidebar-card {
125
- background: var(--bg-card);
126
- border: 1px solid var(--line);
127
- border-radius: 16px;
128
- }
129
- .card { padding: 24px; }
130
- .detail-section { padding: 24px; margin-bottom: 18px; }
131
- .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
132
- .detail-section p { color: var(--muted); }
133
- .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
134
- .card h2 { margin-top: 0; }
135
- .sidebar {
136
- display: flex;
137
- flex-direction: column;
138
- gap: 18px;
139
- }
140
- .sidebar-card {
141
- padding: 20px;
142
- }
143
- /* Only the first sidebar card sticks. Stacking multiple stickies at the
144
- same top offset makes them overlap each other on scroll. The related-
145
- pages card flows normally below. */
146
- .sidebar-card:first-child {
147
- position: sticky;
148
- top: 84px;
149
- max-height: calc(100vh - 104px);
150
- overflow-y: auto;
151
- -webkit-overflow-scrolling: touch;
152
- }
153
- .proof-links {
154
- display: flex;
155
- flex-wrap: wrap;
156
- gap: 12px;
157
- margin-top: 16px;
158
- }
159
- .cta-button {
160
- display: inline-flex;
161
- align-items: center;
162
- justify-content: center;
163
- margin-top: 18px;
164
- padding: 12px 16px;
165
- border-radius: 10px;
166
- background: var(--cyan);
167
- color: #071116;
168
- font-weight: 700;
169
- text-decoration: none;
170
- }
171
- .faq-item {
172
- border-top: 1px solid var(--line);
173
- padding: 14px 0;
174
- }
175
- .faq-item summary {
176
- cursor: pointer;
177
- font-weight: 600;
178
- }
179
- .faq-item p {
180
- color: var(--muted);
181
- }
182
- .related-card {
183
- display: block;
184
- padding: 14px;
185
- border-radius: 12px;
186
- border: 1px solid var(--line);
187
- background: var(--bg-raised);
188
- margin-top: 12px;
189
- color: var(--text);
190
- }
191
- .related-label {
192
- display: block;
193
- color: var(--muted);
194
- font-size: 12px;
195
- text-transform: uppercase;
196
- letter-spacing: 0.08em;
197
- margin-bottom: 4px;
198
- }
199
- @media (max-width: 860px) {
200
- .grid {
201
- grid-template-columns: 1fr;
202
- }
203
- .sidebar-card:first-child {
204
- position: static;
205
- max-height: none;
206
- overflow: visible;
207
- }
208
- }
209
- </style>
210
- <script type="application/ld+json">
211
- {
212
- "@context": "https://schema.org",
213
- "@type": "TechArticle",
214
- "headline": "ThumbGate vs Fallow",
215
- "description": "Fallow finds JS/TS code health issues: dead code, duplication, complexity, and architecture drift. ThumbGate is action-boundary enforcement for AI agents, st...",
216
- "about": [
217
- "thumbgate vs speclock",
218
- "thumbgate vs mem0",
219
- "thumbgate vs fallow",
220
- "roo code alternative cline"
221
- ],
222
- "url": "https://thumbgate.ai/compare/fallow",
223
- "publisher": {
224
- "@type": "Organization",
225
- "name": "ThumbGate",
226
- "url": "https://thumbgate.ai"
227
- },
228
- "mainEntityOfPage": "https://thumbgate.ai/compare/fallow"
229
- }
230
- </script>
231
- <script type="application/ld+json">
232
- {
233
- "@context": "https://schema.org",
234
- "@type": "FAQPage",
235
- "mainEntity": [
236
- {
237
- "@type": "Question",
238
- "name": "Is Fallow a competitor to ThumbGate?",
239
- "acceptedAnswer": {
240
- "@type": "Answer",
241
- "text": "Partly adjacent, but mostly complementary. Fallow analyzes JS/TS code health. ThumbGate enforces AI-agent actions before execution. They solve different parts of the agent workflow."
242
- }
243
- },
244
- {
245
- "@type": "Question",
246
- "name": "Should ThumbGate integrate with Fallow output?",
247
- "acceptedAnswer": {
248
- "@type": "Answer",
249
- "text": "Yes. Fallow JSON is useful input for ThumbGate gates, especially duplication, complexity, changed-file audit results, and architecture-boundary warnings."
250
- }
251
- }
252
- ]
253
- }
254
- </script>
255
- </head>
256
- <body>
257
- <div class="topbar">
258
- <div class="container">
259
- <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
260
- <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
261
- </div>
262
- </div>
263
-
264
- <main class="container">
265
- <section class="hero">
266
- <div class="eyebrow">comparison | thumbgate vs fallow</div>
267
- <h1>ThumbGate vs Fallow</h1>
268
- <p>Fallow finds JS/TS code health issues: dead code, duplication, complexity, and architecture drift. ThumbGate is action-boundary enforcement for AI agents, stopping agents from acting on those signals unsafely.</p>
269
- <div class="signal-row">
270
- <div class="signal-pill up">👍 Thumbs up reinforces good behavior</div>
271
- <div class="signal-pill down">👎 Thumbs down blocks repeated mistakes</div>
272
- </div>
273
- </section>
274
-
275
- <section class="grid">
276
- <div>
277
- <div class="card">
278
- <h2>Why this page exists</h2>
279
- <ul><li>Fallow is complementary, not a direct replacement: it finds dead code, duplication, complexity, and architecture drift.</li><li>ThumbGate governs the next agent action: refactor scope, risky edits, CI proof, team lessons, and pre-action blocks.</li><li>Together, Fallow output can become ThumbGate gates so agents do not blindly refactor everything a static analyzer flags.</li></ul>
280
- </div>
281
-
282
- <section class="detail-section">
283
- <h2>The product difference in one sentence</h2>
284
- <p>Fallow tells you where a JavaScript or TypeScript codebase may be unhealthy. ThumbGate governs what AI agents are allowed to do next: make the next edit, command, PR, or publish action.</p><p>That distinction matters because analyzer output can be useful and dangerous at the same time. A duplicated block can be safe to refactor, or it can be intentional domain duplication where an agent should stop and ask for evidence.</p>
285
-
286
- </section>
287
- <section class="detail-section">
288
- <h2>Choose Fallow when</h2>
289
-
290
- <ul><li>You want static reports for unused code, duplicate blocks, complexity hotspots, circular dependencies, or architecture drift.</li><li>You need JSON diagnostics an agent can inspect before proposing cleanup work.</li><li>Your immediate goal is code health visibility in JS/TS repositories.</li></ul>
291
- </section>
292
- <section class="detail-section">
293
- <h2>Choose ThumbGate when</h2>
294
-
295
- <ul><li>You need pre-action enforcement before an AI agent applies analyzer-driven refactors.</li><li>You want CI and human feedback to become durable prevention rules across Claude Code, Cursor, Codex, Gemini, Amp, Cline, and OpenCode.</li><li>You need audit evidence that a risky cleanup, dependency update, or cross-layer refactor was checked before execution.</li></ul>
296
- </section>
297
- <section class="detail-section">
298
- <h2>Best together</h2>
299
- <p>The highest-ROI workflow is Fallow for deterministic codebase signals and ThumbGate for agent governance. Run the analyzer, pass the changed-file and complexity signals into a ThumbGate gate, then require proof before the agent edits central files or opens a PR.</p>
300
-
301
- </section>
302
- <div class="detail-section">
303
- <h2>FAQ</h2>
304
-
305
- <details class="faq-item">
306
- <summary>Is Fallow a competitor to ThumbGate?</summary>
307
- <p>Partly adjacent, but mostly complementary. Fallow analyzes JS/TS code health. ThumbGate enforces AI-agent actions before execution. They solve different parts of the agent workflow.</p>
308
- </details>
309
- <details class="faq-item">
310
- <summary>Should ThumbGate integrate with Fallow output?</summary>
311
- <p>Yes. Fallow JSON is useful input for ThumbGate gates, especially duplication, complexity, changed-file audit results, and architecture-boundary warnings.</p>
312
- </details>
313
- </div>
314
- </div>
315
-
316
- <aside class="sidebar">
317
-
318
-
319
-
320
-
321
- <div class="sidebar-card">
322
- <h2>GSD execution brief</h2>
323
- <p>This page was prioritized because it captures high-intent demand around thumbgate vs fallow and feeds directly into ThumbGate's proof-led conversion path.</p>
324
- <p><strong>Opportunity score:</strong> 100</p>
325
- <p><strong>Primary persona:</strong> tool-evaluator</p>
326
- <p><strong>Keyword cluster:</strong> thumbgate vs speclock, thumbgate vs mem0, thumbgate vs fallow, roo code alternative cline</p>
327
- <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
328
- <div class="proof-links"><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">Automation proof</a><a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub repository</a></div>
329
- <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=compare_fallow&amp;cta_placement=seo_brief&amp;plan_id=pro" target="_blank" rel="noopener">Go Pro — $19/mo</a>
330
- </div>
331
- <div class="sidebar-card">
332
- <h2>Related pages</h2>
333
-
334
- <a class="related-card" href="/guides/code-knowledge-graph-guardrails">
335
- <span class="related-label">Related page</span>
336
- <strong>Code Graphs Are Context. ThumbGate Is Execution Control.</strong>
337
- </a>
338
- <a class="related-card" href="/guides/agent-harness-optimization">
339
- <span class="related-label">Related page</span>
340
- <strong>AI Agent Harness Optimization That Blocks Repeat Failures</strong>
341
- </a>
342
- <a class="related-card" href="/guides/pre-action-checks">
343
- <span class="related-label">Related page</span>
344
- <strong>What Are Pre-Action Checks?</strong>
345
- </a>
346
- </div>
347
- </aside>
348
- </section>
349
- </main>
350
- </body>
351
- </html>
package/public/compare/heidi.html DELETED
@@ -1,233 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
- <title>ThumbGate vs HEIDI | Behavior Enforcement vs Supply-Chain Scanning</title>
7
- <meta name="description" content="HEIDI (by Meterian) scans your dependency manifests for known CVEs. ThumbGate blocks AI agents from repeating tool-call mistakes. Different layers, both local-first, both free at base tier." />
8
- <meta property="og:title" content="ThumbGate vs HEIDI | Behavior Enforcement vs Supply-Chain Scanning" />
9
- <meta property="og:description" content="A practical comparison for devs deciding which AI-coding safety layer to install — or whether to install both." />
10
- <meta property="og:type" content="article" />
11
- <meta property="og:url" content="https://thumbgate.ai/compare/heidi" />
12
- <link rel="canonical" href="https://thumbgate.ai/compare/heidi" />
13
- <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
- <link rel="icon" type="image/png" href="/thumbgate-icon.png" />
15
- <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
- <meta property="og:image" content="/og.png" />
17
- <style>
18
- :root { --bg: #0a0a0b; --bg-raised: #111113; --bg-card: #161618; --line: #222225; --text: #e8e8ec; --muted: #8b8b96; --cyan: #22d3ee; --green: #4ade80; --amber: #fbbf24; }
19
- * { box-sizing: border-box; }
20
- body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: var(--bg); color: var(--text); line-height: 1.65; }
21
- a { color: var(--cyan); text-decoration: none; }
22
- a:hover { text-decoration: underline; }
23
- .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
24
- .topbar { position: sticky; top: 0; z-index: 20; backdrop-filter: blur(12px); background: rgba(10, 10, 11, 0.88); border-bottom: 1px solid var(--line); }
25
- .topbar .container { display: flex; justify-content: space-between; align-items: center; padding-top: 14px; padding-bottom: 14px; }
26
- .brand { font-weight: 700; color: var(--text); display: inline-flex; align-items: center; gap: 8px; text-decoration: none; }
27
- .brand .logo-mark { width: 28px; height: 28px; display: block; }
28
- .hero { padding: 72px 0 32px; }
29
- .eyebrow { display: inline-flex; align-items: center; gap: 8px; padding: 6px 12px; border-radius: 999px; border: 1px solid rgba(34, 211, 238, 0.22); background: rgba(34, 211, 238, 0.1); color: var(--cyan); text-transform: uppercase; letter-spacing: 0.08em; font-size: 12px; font-weight: 700; }
30
- h1 { font-size: clamp(34px, 5vw, 56px); line-height: 1.06; letter-spacing: -0.04em; margin: 16px 0; max-width: 820px; }
31
- .hero p { max-width: 760px; color: var(--muted); font-size: 18px; }
32
- .grid { display: grid; grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr); gap: 24px; padding-bottom: 72px; }
33
- .card, .detail-section, .sidebar-card { background: var(--bg-card); border: 1px solid var(--line); border-radius: 16px; }
34
- .card { padding: 24px; }
35
- .detail-section { padding: 24px; margin-bottom: 18px; }
36
- .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
37
- .detail-section p, .detail-section li, .sidebar-card p { color: var(--muted); }
38
- .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
39
- .comparison-table { width: 100%; border-collapse: collapse; margin-top: 16px; font-size: 14px; }
40
- .comparison-table th, .comparison-table td { border: 1px solid var(--line); padding: 12px; text-align: left; vertical-align: top; }
41
- .comparison-table th { background: var(--bg-raised); color: var(--cyan); }
42
- .pill-row { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 24px; }
43
- .pill { border: 1px solid var(--line); background: var(--bg-raised); border-radius: 999px; padding: 10px 14px; font-size: 14px; font-weight: 650; }
44
- .pill.good { color: #b8f7c8; border-color: rgba(74, 222, 128, 0.28); background: rgba(74, 222, 128, 0.1); }
45
- .pill.warn { color: #ffe2a4; border-color: rgba(251, 191, 36, 0.28); background: rgba(251, 191, 36, 0.1); }
46
- .sidebar { display: flex; flex-direction: column; gap: 18px; }
47
- .sidebar-card { padding: 20px; }
48
- .sidebar-card:first-child { position: sticky; top: 84px; max-height: calc(100vh - 104px); overflow-y: auto; -webkit-overflow-scrolling: touch; }
49
- .cta-button { display: inline-flex; align-items: center; justify-content: center; margin-top: 18px; padding: 12px 16px; border-radius: 10px; background: var(--cyan); color: #071116; font-weight: 700; text-decoration: none; }
50
- .related-card { display: block; padding: 14px; border-radius: 12px; border: 1px solid var(--line); background: var(--bg-raised); margin-top: 12px; color: var(--text); }
51
- .related-label { display: block; color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; margin-bottom: 4px; }
52
- .faq-item { border-top: 1px solid var(--line); padding: 14px 0; }
53
- .faq-item summary { cursor: pointer; font-weight: 600; }
54
- .faq-item p { color: var(--muted); }
55
- @media (max-width: 860px) { .grid { grid-template-columns: 1fr; } .sidebar-card:first-child { position: static; max-height: none; overflow: visible; } }
56
- </style>
57
- <script type="application/ld+json">
58
- {
59
- "@context": "https://schema.org",
60
- "@type": "TechArticle",
61
- "headline": "ThumbGate vs HEIDI",
62
- "description": "HEIDI scans dependency manifests for CVEs. ThumbGate blocks AI agents from repeating tool-call mistakes. Different surfaces, both local-first, both free at base tier.",
63
- "about": ["thumbgate vs heidi", "supply chain security vs agent behavior", "AI coding safety stack"],
64
- "url": "https://thumbgate.ai/compare/heidi",
65
- "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
66
- "mainEntityOfPage": "https://thumbgate.ai/compare/heidi"
67
- }
68
- </script>
69
- <script type="application/ld+json">
70
- {
71
- "@context": "https://schema.org",
72
- "@type": "FAQPage",
73
- "mainEntity": [
74
- {
75
- "@type": "Question",
76
- "name": "Is HEIDI a direct ThumbGate competitor?",
77
- "acceptedAnswer": {
78
- "@type": "Answer",
79
- "text": "No. HEIDI scans dependency manifests for known CVEs in npm/pip/maven packages. ThumbGate intercepts AI agent tool calls before they fire and blocks ones matching previously-seen failure patterns. Same buyer category (devs using AI coding assistants who care about safety), but different threat surfaces. Both can run on the same machine without overlapping."
80
- }
81
- },
82
- {
83
- "@type": "Question",
84
- "name": "Should I install HEIDI or ThumbGate?",
85
- "acceptedAnswer": {
86
- "@type": "Answer",
87
- "text": "Install both if you ship AI-generated code to production. HEIDI catches AI assistants suggesting deps with known CVEs. ThumbGate catches AI agents about to repeat the same broken tool call you saw last week. They address different failure modes and don't conflict."
88
- }
89
- }
90
- ]
91
- }
92
- </script>
93
- </head>
94
- <body>
95
- <div class="topbar">
96
- <div class="container">
97
- <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
98
- <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
99
- </div>
100
- </div>
101
-
102
- <main class="container">
103
- <section class="hero">
104
- <div class="eyebrow">comparison | thumbgate vs heidi</div>
105
- <h1>ThumbGate vs HEIDI</h1>
106
- <p>HEIDI (Meterian) scans dependency manifests for known CVEs and feeds live vulnerability data to AI assistants via MCP. ThumbGate intercepts AI agent tool calls before they fire and blocks ones matching previously-seen failure patterns. Same audience, different layers.</p>
107
- <div class="pill-row">
108
- <div class="pill good">ThumbGate: agent behavior enforcement (PreToolUse hook)</div>
109
- <div class="pill warn">HEIDI: supply-chain scanning (manifest + MCP)</div>
110
- </div>
111
- </section>
112
-
113
- <section class="grid">
114
- <div>
115
- <div class="detail-section">
116
- <h2>The short answer</h2>
117
- <p>Not a direct competitor. HEIDI answers "is this package vulnerable?" ThumbGate answers "did the AI just repeat a mistake we already saw?" Different threat surfaces. Both local-first. Both free at base tier. Run both if you ship AI-generated code to production.</p>
118
- </div>
119
-
120
- <div class="detail-section">
121
- <h2>Comparison table</h2>
122
- <table class="comparison-table">
123
- <tr><th>Dimension</th><th>HEIDI (Meterian)</th><th>ThumbGate</th></tr>
124
- <tr>
125
- <td>Question it answers</td>
126
- <td>Is this package vulnerable?</td>
127
- <td>Did the AI just repeat a mistake?</td>
128
- </tr>
129
- <tr>
130
- <td>Surface scanned</td>
131
- <td>Manifest files (package.json, requirements.txt, etc.)</td>
132
- <td>AI agent tool calls (Bash, Edit, Write, etc.)</td>
133
- </tr>
134
- <tr>
135
- <td>Integration model</td>
136
- <td>Passive — AI assistant queries HEIDI via MCP for vuln data</td>
137
- <td>Active — PreToolUse hook intercepts tool call before execution</td>
138
- </tr>
139
- <tr>
140
- <td>Threat category</td>
141
- <td>Supply chain (CVE-driven)</td>
142
- <td>Behavioral (lesson-DB-driven from your thumbs-up/down)</td>
143
- </tr>
144
- <tr>
145
- <td>IDE / agent support</td>
146
- <td>VS Code, JetBrains, Cursor, Windsurf, Claude Code, Copilot, Gemini CLI, Codex CLI</td>
147
- <td>Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode (via MCP / PreToolUse hooks)</td>
148
- </tr>
149
- <tr>
150
- <td>Source code stance</td>
151
- <td>Scans only manifest files; source stays on-machine</td>
152
- <td>Local-first; lesson DB stays on-machine; no source uploaded</td>
153
- </tr>
154
- <tr>
155
- <td>Pricing</td>
156
- <td>Free</td>
157
- <td>Free CLI (3 active rules, 2 captures/day) → $19/mo Pro for unlimited</td>
158
- </tr>
159
- <tr>
160
- <td>Maker</td>
161
- <td>Meterian (established supply-chain security firm)</td>
162
- <td>ThumbGate (open-source devtool)</td>
163
- </tr>
164
- </table>
165
- </div>
166
-
167
- <div class="detail-section">
168
- <h2>When to install HEIDI</h2>
169
- <ul>
170
- <li>Your AI assistant keeps suggesting deps with known CVEs.</li>
171
- <li>You want live vulnerability data injected into Copilot / Cursor / Claude Code at suggest-time, not after.</li>
172
- <li>You need a free, IDE-native CVE scanner for npm / pip / maven manifests.</li>
173
- <li>You care about supply-chain attestation more than agent-behavior repeat-prevention.</li>
174
- </ul>
175
- </div>
176
-
177
- <div class="detail-section">
178
- <h2>When to install ThumbGate</h2>
179
- <ul>
180
- <li>You've watched the same class of AI-agent failure recur across runs (wrong path, wrong env, repeated lint failure, file overwrites).</li>
181
- <li>You want failure patterns blocked at the tool-call layer, not caught post-hoc by CI.</li>
182
- <li>You're running 5+ agents and need shared lesson memory across them.</li>
183
- <li>You want a thumbs-down → prevention-rule loop instead of writing rules manually.</li>
184
- </ul>
185
- </div>
186
-
187
- <div class="detail-section">
188
- <h2>Running both</h2>
189
- <p>HEIDI's MCP server and ThumbGate's PreToolUse hook do not conflict. A reasonable stack for a serious AI-coding workflow:</p>
190
- <ul>
191
- <li><strong>HEIDI</strong> — query layer your AI assistant calls to check CVEs before suggesting a dep.</li>
192
- <li><strong>ThumbGate</strong> — gate layer that blocks the agent's tool call if it matches a known-bad pattern from your own feedback history.</li>
193
- <li>Both run local-first. Both are free at base tier. Together they cover supply-chain risk + behavioral risk for under 10 minutes of setup.</li>
194
- </ul>
195
- </div>
196
-
197
- <div class="detail-section">
198
- <h2>FAQ</h2>
199
- <details class="faq-item">
200
- <summary>Is HEIDI a direct ThumbGate competitor?</summary>
201
- <p>No. Different threat surfaces. Same buyer category, but addressing distinct failure modes. Heidi is from Meterian, an established supply-chain security firm; ThumbGate is an independent open-source devtool focused on agent behavior.</p>
202
- </details>
203
- <details class="faq-item">
204
- <summary>Should I install HEIDI or ThumbGate first?</summary>
205
- <p>If your blocker is "the AI keeps suggesting vulnerable packages," install HEIDI first. If your blocker is "the AI keeps making the same tool-call mistake," install ThumbGate first. Most teams shipping AI-generated code need both eventually.</p>
206
- </details>
207
- <details class="faq-item">
208
- <summary>Can ThumbGate import HEIDI's CVE data?</summary>
209
- <p>Not today. Both expose MCP servers, so a future integration where ThumbGate consults HEIDI's vulnerability index before allowing a `npm install <package>` tool call is technically feasible. We're open to that conversation.</p>
210
- </details>
211
- </div>
212
-
213
- </div>
214
-
215
- <aside class="sidebar">
216
- <div class="sidebar-card">
217
- <h3 style="margin-top:0;">Get ThumbGate in 30 seconds</h3>
218
- <p>One install command. Works with Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode.</p>
219
- <pre style="background:var(--bg);padding:12px;border-radius:8px;font-size:13px;overflow-x:auto;"><code>npx thumbgate init</code></pre>
220
- <a class="cta-button" href="https://github.com/IgorGanapolsky/ThumbGate">View on GitHub</a>
221
- <a class="cta-button" href="/pricing" style="background:transparent;color:var(--cyan);border:1px solid var(--cyan);">See pricing</a>
222
- </div>
223
-
224
- <div class="sidebar-card">
225
- <span class="related-label">Other comparisons</span>
226
- <a class="related-card" href="/compare/agentix-labs">ThumbGate vs Agentix Labs</a>
227
- <a class="related-card" href="/compare">All comparisons</a>
228
- </div>
229
- </aside>
230
- </section>
231
- </main>
232
- </body>
233
- </html>