thumbgate 1.27.7 → 1.27.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (106) hide show
  1. package/.well-known/llms.txt +1 -2
  2. package/README.md +0 -2
  3. package/bin/cli.js +259 -78
  4. package/package.json +12 -18
  5. package/public/blog.html +30 -0
  6. package/public/compare/adopt-ai.html +219 -0
  7. package/public/compare/agentix-labs.html +197 -0
  8. package/public/compare/ai-experience-orchestration.html +216 -0
  9. package/public/compare/anthropic-claude-for-legal.html +260 -0
  10. package/public/compare/anthropic-containment.html +280 -0
  11. package/public/compare/arcade.html +175 -0
  12. package/public/compare/arcjet.html +239 -0
  13. package/public/compare/bumblebee.html +307 -0
  14. package/public/compare/claude-code-hooks.html +294 -0
  15. package/public/compare/databricks-unity-ai-gateway.html +215 -0
  16. package/public/compare/fallow.html +351 -0
  17. package/public/compare/heidi.html +233 -0
  18. package/public/compare/mem0.html +342 -0
  19. package/public/compare/oak-and-sparrow-gatekeeper.html +289 -0
  20. package/public/compare/rein.html +236 -0
  21. package/public/compare/sigmashake.html +256 -0
  22. package/public/compare/speclock.html +342 -0
  23. package/public/compare.html +2 -0
  24. package/public/guides/agent-harness-optimization.html +342 -0
  25. package/public/guides/agentic-web-governance.html +406 -0
  26. package/public/guides/ai-agent-governance-sprint.html +415 -0
  27. package/public/guides/ai-agent-pre-action-approval-gates.html +401 -0
  28. package/public/guides/ai-agent-workflow-migration-checklist.html +392 -0
  29. package/public/guides/ai-deployment-readiness.html +415 -0
  30. package/public/guides/ai-mode-ads-agent-governance.html +401 -0
  31. package/public/guides/ai-search-topical-presence.html +342 -0
  32. package/public/guides/autoresearch-agent-safety.html +342 -0
  33. package/public/guides/background-agent-governance.html +358 -0
  34. package/public/guides/best-tools-stop-ai-agents-breaking-production.html +363 -0
  35. package/public/guides/browser-automation-safety.html +342 -0
  36. package/public/guides/chatgpt-ads-trust.html +353 -0
  37. package/public/guides/claude-code-feedback.html +339 -0
  38. package/public/guides/claude-code-prevent-repeated-mistakes.html +161 -0
  39. package/public/guides/claude-code-skills-guardrails.html +343 -0
  40. package/public/guides/claude-desktop.html +356 -0
  41. package/public/guides/code-knowledge-graph-guardrails.html +365 -0
  42. package/public/guides/codex-cli-guardrails.html +339 -0
  43. package/public/guides/cursor-agent-guardrails.html +339 -0
  44. package/public/guides/cursor-prevent-repeated-mistakes.html +161 -0
  45. package/public/guides/database-agent-safety.html +406 -0
  46. package/public/guides/deepseek-v4-runtime-guardrails.html +346 -0
  47. package/public/guides/developer-machine-supply-chain-guardrails.html +358 -0
  48. package/public/guides/gcp-mcp-guardrails.html +147 -0
  49. package/public/guides/gemini-cli-feedback-memory.html +339 -0
  50. package/public/guides/gpt-5-5-model-evaluation.html +358 -0
  51. package/public/guides/internal-ai-engineering-stack-guardrails.html +348 -0
  52. package/public/guides/long-running-agent-context-management.html +346 -0
  53. package/public/guides/mcp-tool-governance.html +401 -0
  54. package/public/guides/multica-thumbgate-setup.html +134 -0
  55. package/public/guides/native-messaging-host-security.html +342 -0
  56. package/public/guides/policy-engine-pre-action-gates.html +346 -0
  57. package/public/guides/pre-action-checks.html +342 -0
  58. package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +342 -0
  59. package/public/guides/prompt-tricks-to-workflow-rules.html +365 -0
  60. package/public/guides/proxy-pointer-rag-guardrails.html +352 -0
  61. package/public/guides/rag-precision-tuning-guardrails.html +352 -0
  62. package/public/guides/reasoning-compression-guardrails.html +346 -0
  63. package/public/guides/relational-knowledge-ai-recommendations.html +342 -0
  64. package/public/guides/roo-code-alternative-cline.html +339 -0
  65. package/public/guides/semantic-programmatic-seo-guardrails.html +352 -0
  66. package/public/guides/seo-agent-skills-guardrails.html +344 -0
  67. package/public/guides/stop-repeated-ai-agent-mistakes.html +342 -0
  68. package/public/index.html +10 -48
  69. package/public/learn/ac-dc-runtime-enforcement.html +277 -0
  70. package/public/learn/agent-harness-pattern.html +181 -0
  71. package/public/learn/agent-swarms-shared-gates.html +173 -0
  72. package/public/learn/agentic-enterprise-context-brain.html +117 -0
  73. package/public/learn/agentic-os-team-governance.html +146 -0
  74. package/public/learn/ai-agent-governance.html +158 -0
  75. package/public/learn/ai-agent-persistent-memory.html +211 -0
  76. package/public/learn/background-agent-control-layer.html +184 -0
  77. package/public/learn/claude-code-goal-with-rubrics.html +205 -0
  78. package/public/learn/codex-role-plugins-need-governance.html +125 -0
  79. package/public/learn/cost-aware-agent-gate-routing.html +173 -0
  80. package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +157 -0
  81. package/public/learn/deterministic-agent-workflows.html +185 -0
  82. package/public/learn/feedback-loop-vs-decision-layer.html +283 -0
  83. package/public/learn/from-prototype-to-production.html +223 -0
  84. package/public/learn/learn.css +51 -0
  85. package/public/learn/mcp-pre-action-checks-explained.html +172 -0
  86. package/public/learn/pretix-stripe-connect-marketplaces.html +161 -0
  87. package/public/learn/regulated-agent-execution-boundary.html +196 -0
  88. package/public/learn/spec-driven-development.html +168 -0
  89. package/public/learn/stop-ai-agent-force-push.html +134 -0
  90. package/public/learn/vibe-coding-safety-net.html +142 -0
  91. package/public/learn.html +6 -50
  92. package/public/pro.html +6 -6
  93. package/scripts/cli-schema.js +10 -22
  94. package/scripts/dashboard-chat.js +1 -2
  95. package/scripts/document-intake.js +49 -1
  96. package/scripts/gemini-embedding-policy.js +1 -2
  97. package/scripts/hosted-config.js +12 -0
  98. package/scripts/plausible-domain-config.js +1 -3
  99. package/scripts/reddit-browser-notification-watch.js +230 -0
  100. package/scripts/seo-gsd.js +0 -239
  101. package/scripts/vector-store.js +0 -44
  102. package/scripts/workspace-evolver.js +2 -62
  103. package/src/api/server.js +124 -335
  104. package/adapters/policy-engine/ethicore-guardian-client.js +0 -68
  105. package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +0 -260
  106. package/scripts/hook-stop-anti-claim.js +0 -227
package/public/compare/arcade.html ADDED
@@ -0,0 +1,175 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>ThumbGate vs Arcade — Coding-Agent Guardrails vs Enterprise API Auth Delegation</title>
7
+ <script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
8
+ <meta name="description" content="ThumbGate vs Arcade for AI agent governance. Arcade is a cloud-hosted OAuth proxy for enterprise production agents accessing SaaS APIs. ThumbGate is a local-first, feedback-driven pre-action check firewall for coding agents.">
9
+ <meta name="keywords" content="AI agent governance, Arcade.dev, ThumbGate, runtime governance, pre-action hooks, agent decorator, coding agent guardrails, OAuth proxy, MCP authorization">
10
+ <meta property="og:title" content="ThumbGate vs Arcade — Coding-Agent Guardrails vs Enterprise API Auth Delegation">
11
+ <meta property="og:description" content="Both intercept agent actions before damage. Different layers, different deployment models, different target loops. Honest side-by-side.">
12
+ <meta property="og:type" content="article">
13
+ <meta property="og:url" content="https://thumbgate.ai/compare/arcade">
14
+ <link rel="canonical" href="https://thumbgate.ai/compare/arcade">
15
+
16
+ <script type="application/ld+json">
17
+ {
18
+ "@context": "https://schema.org",
19
+ "@type": "TechArticle",
20
+ "headline": "ThumbGate vs Arcade — Coding-Agent Guardrails vs Enterprise API Auth Delegation",
21
+ "description": "Side-by-side comparison of two governance layers for AI agents. ThumbGate is a local-first pre-action check firewall specialized for AI coding agents. Arcade is a cloud-hosted auth proxy for enterprise production agents.",
22
+ "author": {
23
+ "@type": "Person",
24
+ "name": "Igor Ganapolsky",
25
+ "url": "https://github.com/IgorGanapolsky"
26
+ },
27
+ "publisher": {
28
+ "@type": "Organization",
29
+ "name": "ThumbGate",
30
+ "url": "https://thumbgate.ai"
31
+ },
32
+ "datePublished": "2026-06-17",
33
+ "dateModified": "2026-06-17",
34
+ "mainEntityOfPage": "https://thumbgate.ai/compare/arcade"
35
+ }
36
+ </script>
37
+
38
+ <script type="application/ld+json">
39
+ {
40
+ "@context": "https://schema.org",
41
+ "@type": "FAQPage",
42
+ "mainEntity": [
43
+ {
44
+ "@type": "Question",
45
+ "name": "What's the difference between Arcade and ThumbGate?",
46
+ "acceptedAnswer": {
47
+ "@type": "Answer",
48
+ "text": "Both address the 'accountability gap' in AI agents, but they focus on different parts of the stack. Arcade is a cloud-hosted auth proxy built to delegate user identities (via OAuth) to downstream SaaS APIs for production enterprise agents. ThumbGate is a local-first pre-action check firewall built to prevent coding agents (Claude Code, Cursor, Cline) from making filesystem mistakes or breaking builds. Arcade targets enterprise SaaS integration; ThumbGate targets the developer's inner loop."
49
+ }
50
+ },
51
+ {
52
+ "@type": "Question",
53
+ "name": "Does Arcade support MCP?",
54
+ "acceptedAnswer": {
55
+ "@type": "Answer",
56
+ "text": "Yes. Arcade authored the Model Context Protocol (MCP) authorization spec to delegate OAuth tokens to APIs. ThumbGate operates as a local MCP server that enforces rule boundaries directly at the developer's tool-call execution level."
57
+ }
58
+ },
59
+ {
60
+ "@type": "Question",
61
+ "name": "Do I need to rewrite code to integrate ThumbGate or Arcade?",
62
+ "acceptedAnswer": {
63
+ "@type": "Answer",
64
+ "text": "ThumbGate requires zero code changes — it auto-configures PreToolUse hooks via a CLI command (npx thumbgate init) to run out-of-process. Arcade requires routing agent API calls through their auth proxy or utilizing their SDK in your agent application backend."
65
+ }
66
+ }
67
+ ]
68
+ }
69
+ </script>
70
+
71
+ <link rel="stylesheet" href="/learn/learn.css">
72
+ <style>
73
+ .matrix { width: 100%; border-collapse: collapse; margin: 1.5rem 0; font-size: 0.95rem; }
74
+ .matrix th, .matrix td { padding: 12px 14px; text-align: left; border-bottom: 1px solid var(--border); vertical-align: top; }
75
+ .matrix th { background: var(--bg-card); font-weight: 600; }
76
+ .matrix td:nth-child(2) { color: var(--muted); }
77
+ .matrix td:nth-child(3) { color: var(--text); }
78
+ .verdict { font-weight: 600; color: var(--green); }
79
+ .pair { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin: 1.5rem 0; }
80
+ .pair > div { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; }
81
+ @media (max-width: 700px) { .pair { grid-template-columns: 1fr; } }
82
+ </style>
83
+ </head>
84
+ <body>
85
+
86
+ <nav>
87
+ <a href="/" class="brand"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
88
+ <a href="/pricing">Pricing</a>
89
+ <a href="/case-studies">Case Studies</a>
90
+ <a href="/compare">Compare</a>
91
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
92
+ </nav>
93
+
94
+ <div class="container">
95
+ <div class="breadcrumb"><a href="/compare">Compare</a> / ThumbGate vs Arcade</div>
96
+ <h1>ThumbGate vs Arcade.dev</h1>
97
+ <p style="color:var(--muted);">5 min read · For teams evaluating AI agent security, auth, and guardrail layers</p>
98
+
99
+ <div class="tldr"><strong>TL;DR:</strong> Arcade is a cloud-hosted auth proxy built to delegate user identities (OAuth) to SaaS APIs for production-facing enterprise agents. ThumbGate is a local-first, feedback-driven pre-action check firewall built to prevent coding agents (Claude Code, Cursor, Cline) from making filesystem mistakes or breaking builds. Arcade secures API identity delegation; ThumbGate secures local tool-call execution.</div>
100
+
101
+ <h2>Different Layers, Different Goals</h2>
102
+ <p>Arcade recently announced a $60M Series A (led by SYN Ventures with Morgan Stanley and Wipro) to address the authorization accountability gap in production AI agents. While both products focus on the AI agent security space, they are designed for completely separate loops.</p>
103
+
104
+ <p>If you're building a production agent that needs to draft emails, update Salesforce records, or post to Slack on behalf of real users, Arcade's token delegation is the industry standard. If you are a developer using Claude Code or Cursor and want to make sure the agent doesn't delete your files, leak API keys, or run unsafe commands, ThumbGate's local PreToolUse firewall is built for you.</p>
105
+
106
+ <h2>Side-by-Side Comparison</h2>
107
+
108
+ <table class="matrix">
109
+ <thead>
110
+ <tr><th style="width:28%;">Dimension</th><th style="width:36%;">Arcade.dev</th><th style="width:36%;">ThumbGate</th></tr>
111
+ </thead>
112
+ <tbody>
113
+ <tr>
114
+ <td><strong>Primary Value Prop</strong></td>
115
+ <td>Secure identity/token delegation and auth propagation for production agents.</td>
116
+ <td>Local pre-action checks preventing coding-agent mistakes and directory destruction.</td>
117
+ </tr>
118
+ <tr>
119
+ <td><strong>Integration layer</strong></td>
120
+ <td>Cloud auth proxy between agent application and downstream SaaS APIs.</td>
121
+ <td>Out-of-process PreToolUse hook intercepting tool calls at the agent runtime boundary (Claude Code / Cursor / Codex / Gemini / Amp / Cline / OpenCode).</td>
122
+ </tr>
123
+ <tr>
124
+ <td><strong>Deployment mode</strong></td>
125
+ <td>Cloud-hosted service or self-hosted gateway.</td>
126
+ <td>Local-first, runs on the developer's machine with SQLite/JSON persistence.</td>
127
+ </tr>
128
+ <tr>
129
+ <td><strong>Identity &amp; Auth Model</strong></td>
130
+ <td>OAuth 2.0 user identity propagation.</td>
131
+ <td>Policy-based rules derived from human feedback (thumbs-down rules) and Thompson Sampling.</td>
132
+ </tr>
133
+ <tr>
134
+ <td><strong>Primary target tools</strong></td>
135
+ <td>SaaS APIs (Slack, Salesforce, GitHub, Gmail, Jira).</td>
136
+ <td>Local system tools (filesystem write, terminal execute, git push, package install).</td>
137
+ </tr>
138
+ <tr>
139
+ <td><strong>MCP Integration</strong></td>
140
+ <td>Authored the MCP authorization specification for API token delegation.</td>
141
+ <td>Operates as a local MCP server controlling local tool execution permissions.</td>
142
+ </tr>
143
+ <tr>
144
+ <td><strong>Setup Friction</strong></td>
145
+ <td>Requires configuring OAuth providers, redirect URIs, and deploying API proxy.</td>
146
+ <td>Installs in 30 seconds via <code>npx thumbgate init</code> with zero infrastructure.</td>
147
+ </tr>
148
+ </tbody>
149
+ </table>
150
+
151
+ <h2>Complementary, Not Conflicting</h2>
152
+ <p>Because they operate at different layers, ThumbGate and Arcade are complementary:</p>
153
+ <ul>
154
+ <li>Use <strong>Arcade</strong> to securely hook your company's production customer support agent into Gmail and Salesforce.</li>
155
+ <li>Use <strong>ThumbGate</strong> to keep your software engineers' local AI coding assistants from introducing security bugs, breaking builds, or deleting files.</li>
156
+ </ul>
157
+
158
+ <h2>Get Started with Local Guardrails</h2>
159
+ <div class="card">
160
+ <p>Install ThumbGate locally in one command:</p>
161
+ <pre><code>npx thumbgate init</code></pre>
162
+ <p>Then give thumbs-up/down feedback to let the firewall learn your boundaries. Core CLI + local hooks are MIT licensed.</p>
163
+ <p>
164
+ <a href="https://www.npmjs.com/package/thumbgate" class="cta">View on npm</a>
165
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" style="color:var(--cyan); margin-left:1.5rem; text-decoration:underline;">View on GitHub</a>
166
+ </p>
167
+ </div>
168
+ </div>
169
+
170
+ <footer>
171
+ <p>ThumbGate -- Pre-action checks for AI coding agents</p>
172
+ <p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> | <a href="https://www.npmjs.com/package/thumbgate">npm</a> | <a href="/compare">Compare</a> | <a href="/dashboard">Dashboard</a></p>
173
+ </footer>
174
+ </body>
175
+ </html>
package/public/compare/arcjet.html ADDED
@@ -0,0 +1,239 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>ThumbGate vs Arcjet | Agent-Outbound Gate Pairs With App-Inbound Firewall</title>
7
+ <meta name="description" content="Arcjet is a runtime SDK that protects your Node/Python application from inbound attacks (bots, rate-limit, prompt-injection, DLP). ThumbGate is a PreToolUse hook inside the AI coding agent that gates outbound tool calls before they fire. Different sides of the same agentic perimeter — use both at regulated firms." />
8
+ <meta property="og:title" content="ThumbGate vs Arcjet | Agent-Outbound Gate Pairs With App-Inbound Firewall" />
9
+ <meta property="og:description" content="Arcjet shields your application from what an agent might send IN. ThumbGate shields your engineering org from what the dev's AI coding agent might send OUT. Complementary, not competitive." />
10
+ <meta property="og:type" content="article" />
11
+ <meta property="og:url" content="https://thumbgate.ai/compare/arcjet" />
12
+ <link rel="canonical" href="https://thumbgate.ai/compare/arcjet" />
13
+ <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
+ <link rel="icon" type="image/png" href="/thumbgate-icon.png" />
15
+ <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
+ <meta property="og:image" content="/og.png" />
17
+ <style>
18
+ :root { --bg: #0a0a0b; --bg-raised: #111113; --bg-card: #161618; --line: #222225; --text: #e8e8ec; --muted: #8b8b96; --cyan: #22d3ee; --green: #4ade80; --amber: #fbbf24; }
19
+ * { box-sizing: border-box; }
20
+ body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: var(--bg); color: var(--text); line-height: 1.65; }
21
+ a { color: var(--cyan); text-decoration: none; }
22
+ a:hover { text-decoration: underline; }
23
+ .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
24
+ .topbar { position: sticky; top: 0; z-index: 20; backdrop-filter: blur(12px); background: rgba(10, 10, 11, 0.88); border-bottom: 1px solid var(--line); }
25
+ .topbar .container { display: flex; justify-content: space-between; align-items: center; padding-top: 14px; padding-bottom: 14px; }
26
+ .brand { font-weight: 700; color: var(--text); display: inline-flex; align-items: center; gap: 8px; text-decoration: none; }
27
+ .brand .logo-mark { width: 28px; height: 28px; display: block; }
28
+ .hero { padding: 72px 0 32px; }
29
+ .eyebrow { display: inline-flex; align-items: center; gap: 8px; padding: 6px 12px; border-radius: 999px; border: 1px solid rgba(34, 211, 238, 0.22); background: rgba(34, 211, 238, 0.1); color: var(--cyan); text-transform: uppercase; letter-spacing: 0.08em; font-size: 12px; font-weight: 700; }
30
+ h1 { font-size: clamp(34px, 5vw, 56px); line-height: 1.06; letter-spacing: -0.04em; margin: 16px 0; max-width: 860px; }
31
+ .hero p { max-width: 760px; color: var(--muted); font-size: 18px; }
32
+ .grid { display: grid; grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr); gap: 24px; padding-bottom: 72px; }
33
+ .card, .detail-section, .sidebar-card { background: var(--bg-card); border: 1px solid var(--line); border-radius: 16px; }
34
+ .card { padding: 24px; }
35
+ .detail-section { padding: 24px; margin-bottom: 18px; }
36
+ .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
37
+ .detail-section p, .detail-section li, .sidebar-card p { color: var(--muted); }
38
+ .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
39
+ .comparison-table { width: 100%; border-collapse: collapse; margin-top: 16px; font-size: 14px; }
40
+ .comparison-table th, .comparison-table td { border: 1px solid var(--line); padding: 12px; text-align: left; vertical-align: top; }
41
+ .comparison-table th { background: var(--bg-raised); color: var(--cyan); }
42
+ .pill-row { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 24px; }
43
+ .pill { border: 1px solid var(--line); background: var(--bg-raised); border-radius: 999px; padding: 10px 14px; font-size: 14px; font-weight: 650; }
44
+ .pill.good { color: #b8f7c8; border-color: rgba(74, 222, 128, 0.28); background: rgba(74, 222, 128, 0.1); }
45
+ .pill.warn { color: #ffe2a4; border-color: rgba(251, 191, 36, 0.28); background: rgba(251, 191, 36, 0.1); }
46
+ .sidebar { display: flex; flex-direction: column; gap: 18px; }
47
+ .sidebar-card { padding: 20px; }
48
+ .sidebar-card:first-child { position: sticky; top: 84px; max-height: calc(100vh - 104px); overflow-y: auto; -webkit-overflow-scrolling: touch; }
49
+ .cta-button { display: inline-flex; align-items: center; justify-content: center; margin-top: 18px; padding: 12px 16px; border-radius: 10px; background: var(--cyan); color: #071116; font-weight: 700; text-decoration: none; }
50
+ .related-card { display: block; padding: 14px; border-radius: 12px; border: 1px solid var(--line); background: var(--bg-raised); margin-top: 12px; color: var(--text); }
51
+ .related-label { display: block; color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; margin-bottom: 4px; }
52
+ .faq-item { border-top: 1px solid var(--line); padding: 14px 0; }
53
+ .faq-item summary { cursor: pointer; font-weight: 600; }
54
+ .faq-item p { color: var(--muted); }
55
+ @media (max-width: 860px) { .grid { grid-template-columns: 1fr; } .sidebar-card:first-child { position: static; max-height: none; overflow: visible; } }
56
+ </style>
57
+ <script type="application/ld+json">
58
+ {
59
+ "@context": "https://schema.org",
60
+ "@type": "TechArticle",
61
+ "headline": "ThumbGate vs Arcjet",
62
+ "description": "Arcjet is a runtime SDK that shields your Node/Python web application from inbound traffic — bots, rate-limit abuse, prompt-injection attempts, PII egress, WAF rules. ThumbGate is a PreToolUse hook inside the AI coding agent that gates outbound tool calls before they fire. Same agentic-perimeter story, opposite sides.",
63
+ "about": ["thumbgate vs arcjet", "AI agent security layer", "PreToolUse vs WAF SDK", "agent governance"],
64
+ "url": "https://thumbgate.ai/compare/arcjet",
65
+ "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
66
+ "mainEntityOfPage": "https://thumbgate.ai/compare/arcjet"
67
+ }
68
+ </script>
69
+ <script type="application/ld+json">
70
+ {
71
+ "@context": "https://schema.org",
72
+ "@type": "FAQPage",
73
+ "mainEntity": [
74
+ {
75
+ "@type": "Question",
76
+ "name": "Is Arcjet a ThumbGate competitor?",
77
+ "acceptedAnswer": {
78
+ "@type": "Answer",
79
+ "text": "No. They are adjacent on the agentic perimeter. Arcjet is a runtime SDK that installs in your Node, Python, Deno, or Bun web application and intercepts inbound traffic at the HTTP request entry — bot detection, rate-limit, prompt-injection in user input, PII detection, Shield WAF rules. It protects your application from what an external user or agent might send IN. ThumbGate runs at the PreToolUse hook inside an AI coding agent runtime (Claude Code, Cursor, Codex CLI, Gemini CLI, Amp, Cline, OpenCode, Claude Desktop) and intercepts the tool call the developer's agent is about to execute — bash, SQL, file write, MCP tool, outbound LLM call. It protects your engineering org from what the agent might send OUT. Different sides of the same perimeter."
80
+ }
81
+ },
82
+ {
83
+ "@type": "Question",
84
+ "name": "Can I use both Arcjet and ThumbGate?",
85
+ "acceptedAnswer": {
86
+ "@type": "Answer",
87
+ "text": "Yes. The integration shape is clean because the two products do not overlap: Arcjet runs as middleware in your production web servers; ThumbGate runs as a PreToolUse hook in your developers' agent runtimes. At a regulated firm, the dual-deploy story is: Arcjet enforces inbound rules on the application your customers and external agents reach. ThumbGate enforces outbound rules on the AI coding agents your engineers use. Neither layer can substitute for the other."
88
+ }
89
+ },
90
+ {
91
+ "@type": "Question",
92
+ "name": "Why doesn't Arcjet ship a PreToolUse hook for AI coding agents?",
93
+ "acceptedAnswer": {
94
+ "@type": "Answer",
95
+ "text": "Arcjet's product surface is application-side. Their SDK is designed to be added to a Next.js, Express, Fastify, Nuxt, or similar web framework. Their AI agent coverage is about protecting an application that hosts an AI agent (a chatbot, an MCP server, a tool-using endpoint) from external abuse. ThumbGate's product surface is the opposite end: inside the developer's IDE-agent process, before any tool call leaves the agent's memory. Two product surfaces, both correct, both needed."
96
+ }
97
+ },
98
+ {
99
+ "@type": "Question",
100
+ "name": "When would I pick ThumbGate over Arcjet?",
101
+ "acceptedAnswer": {
102
+ "@type": "Answer",
103
+ "text": "If the failure mode you are worried about is your AI coding agent running rm -rf in the wrong directory, force-pushing to main, dropping a table against staging-that-was-actually-prod, or sending a privileged document to an external LLM, ThumbGate is the layer. If the failure mode is your hosted application being scraped, prompt-injected, or rate-limit-abused by external traffic, Arcjet is the layer. Most firms with both kinds of risk install both."
104
+ }
105
+ },
106
+ {
107
+ "@type": "Question",
108
+ "name": "Does ThumbGate's PreToolUse hook overlap with Arcjet's prompt-injection detection?",
109
+ "acceptedAnswer": {
110
+ "@type": "Answer",
111
+ "text": "Different attack and different defender. Arcjet's prompt-injection detection inspects incoming user prompts to your hosted LLM endpoint and flags injection patterns before your model sees them. ThumbGate inspects the tool call your model decided to make after processing whatever input it received and blocks the call before the tool fires. One catches the attack on the way in; the other catches the consequence on the way out."
112
+ }
113
+ }
114
+ ]
115
+ }
116
+ </script>
117
+ </head>
118
+ <body>
119
+ <header class="topbar">
120
+ <div class="container">
121
+ <a href="/" class="brand"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28" /><span>ThumbGate</span></a>
122
+ <nav><a href="/learn">Learn</a> &nbsp; <a href="/pro">Pro</a> &nbsp; <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a></nav>
123
+ </div>
124
+ </header>
125
+
126
+ <section class="hero">
127
+ <div class="container">
128
+ <span class="eyebrow">ThumbGate vs Arcjet</span>
129
+ <h1>One protects your app from inbound traffic. One protects your engineering org from outbound agent actions.</h1>
130
+ <p><strong>Arcjet</strong> is a runtime SDK that installs in your Node, Python, Deno, or Bun web application and intercepts inbound HTTP requests &mdash; bot detection, rate-limit, prompt-injection in user input, PII detection, Shield WAF rules. <strong>ThumbGate</strong> is a PreToolUse hook inside an AI coding agent (Claude Code, Cursor, Codex CLI, Gemini CLI, Sourcegraph Amp, Cline, OpenCode, Claude Desktop) that intercepts the tool call the developer's agent is about to execute &mdash; bash, SQL, file write, MCP, outbound LLM call. Different sides of the same agentic perimeter. Most regulated firms run both.</p>
131
+ </div>
132
+ </section>
133
+
134
+ <main class="container">
135
+ <div class="grid">
136
+ <div class="content">
137
+
138
+ <section class="detail-section">
139
+ <h2>Side-by-side scope comparison</h2>
140
+ <table class="comparison-table">
141
+ <thead>
142
+ <tr><th>Dimension</th><th>Arcjet</th><th>ThumbGate</th></tr>
143
+ </thead>
144
+ <tbody>
145
+ <tr><td><strong>Install surface</strong></td><td>Runtime SDK in your Node / Python / Deno / Bun web application</td><td>PreToolUse hook inside the developer's AI coding agent process</td></tr>
146
+ <tr><td><strong>Traffic direction</strong></td><td>Inbound &mdash; what reaches your application</td><td>Outbound &mdash; what the agent is about to do</td></tr>
147
+ <tr><td><strong>What it blocks</strong></td><td>Bots, rate-limit abuse, prompt-injection in user input, PII egress, WAF violations</td><td><code>rm -rf</code> traversal, destructive SQL against non-test, <code>git push --force</code>, MCP tool calls to untrusted hosts, secret-carrying file writes</td></tr>
148
+ <tr><td><strong>Framework coverage</strong></td><td>Next.js, Express, Fastify, NestJS, Nuxt, Astro, React Router, Remix, SvelteKit, Bun, Deno, Python</td><td>Claude Code, Cursor, OpenAI Codex CLI, Google Gemini CLI, Sourcegraph Amp, Cline, OpenCode, Claude Desktop</td></tr>
149
+ <tr><td><strong>Decision boundary</strong></td><td>HTTP request middleware in your web server</td><td>PreToolUse hook in the agent runtime, before tool API fires</td></tr>
150
+ <tr><td><strong>AI in the gate?</strong></td><td>No (Arcjet ships deterministic rules + their <em>Shield</em> WAF; prompt-injection detection is pattern-based)</td><td>No (deterministic PreToolUse rule match + lesson DB; no model in the enforcement path)</td></tr>
151
+ <tr><td><strong>Lesson promotion from feedback</strong></td><td>No &mdash; rules are configured by the developer</td><td>Yes &mdash; thumbs-down on a bad tool call promotes to a prevention rule via Thompson Sampling</td></tr>
152
+ <tr><td><strong>Best alongside</strong></td><td>ThumbGate at the dev-agent layer</td><td>Arcjet at the application-inbound layer</td></tr>
153
+ </tbody>
154
+ </table>
155
+ </section>
156
+
157
+ <section class="detail-section">
158
+ <h2>The shared architectural insight</h2>
159
+ <p>Both products land on the same core decision: <strong>the gate runs deterministically, in your runtime, with no LLM in the enforcement path</strong>. Arcjet says it about their Shield WAF and rate-limit rules. ThumbGate says it about the PreToolUse hook. Neither product asks an external "judge model" to decide if an action is safe &mdash; both run pattern-match + policy logic in-process, which is what makes them auditable, cheap, and survivable under load.</p>
160
+ <p>The vendors who put an LLM in the enforcement path lose on three axes at once: <em>latency</em> (every request waits for a model call), <em>cost</em> (every request pays for inference), and <em>auditability</em> (the model's decision is non-deterministic, so an audit log of "the model said it was fine" is not a defense). Arcjet and ThumbGate independently arrived at the same posture from opposite ends of the perimeter.</p>
161
+ </section>
162
+
163
+ <section class="detail-section">
164
+ <h2>The dual-deploy story for a regulated firm</h2>
165
+ <p>Take a fintech or law firm running its own customer-facing application <em>and</em> developing it with AI coding agents:</p>
166
+ <ul>
167
+ <li><strong>Arcjet on the customer-facing app.</strong> Bot detection on the signup endpoint, rate-limit on the chat endpoint, prompt-injection scoring on incoming user messages, PII detection on form submissions, WAF rules on every route.</li>
168
+ <li><strong>ThumbGate on the engineering team's AI coding agents.</strong> PreToolUse rules block destructive shell, enforce per-repo scope on the agent's tool calls, prevent privileged customer data from being sent to external LLMs during dev workflows, and turn each incident into a prevention rule the next sprint inherits automatically.</li>
169
+ </ul>
170
+ <p>Neither layer overlaps with the other. Together they cover both the application's attack surface and the developer-agent's action surface &mdash; which is what <a href="/ai-malpractice-prevention">our /ai-malpractice-prevention</a> page describes for the legal-vertical case.</p>
171
+ </section>
172
+
173
+ <section class="detail-section">
174
+ <h2>FAQ</h2>
175
+ <details class="faq-item" open>
176
+ <summary>Does Arcjet have a PreToolUse hook?</summary>
177
+ <p>Not at the IDE-agent layer. Arcjet's "For Agents" surface (MCP server support, Arcjet Guards, Plugin, Skills, AI app protection) protects an application that <em>hosts</em> an AI agent &mdash; a chatbot endpoint, an MCP server, a tool-using API &mdash; from external misuse. ThumbGate runs upstream of that, inside the developer's coding agent before any tool call leaves the agent's memory.</p>
178
+ </details>
179
+ <details class="faq-item">
180
+ <summary>Where does each one log evidence?</summary>
181
+ <p>Arcjet emits decisions to your application's logging pipeline and the Arcjet dashboard for analytics. ThumbGate writes structured allow/warn/block decisions to a local lesson DB and (optionally on the Pro tier) syncs anonymized rule patterns to a hosted evidence dashboard. Both are SIEM-pluggable.</p>
182
+ </details>
183
+ <details class="faq-item">
184
+ <summary>Can ThumbGate enforce policy on the application Arcjet protects?</summary>
185
+ <p>No, and that is the point. ThumbGate runs in the dev's local agent runtime, not in the production web server. If an attacker hits your production app, Arcjet is the layer that sees the request first. If your AI coding agent is about to push to production, ThumbGate is the layer that sees the action first.</p>
186
+ </details>
187
+ <details class="faq-item">
188
+ <summary>Pricing &mdash; what tier do I need from each?</summary>
189
+ <p>Arcjet has a free tier and paid tiers for production volume (see <a href="https://arcjet.com/pricing" target="_blank" rel="noopener">arcjet.com/pricing</a>). ThumbGate ships an open-source free tier with the full PreToolUse engine and prevention-rule promotion; Pro/Team adds hosted evidence sync, adapter coverage for all eight agent runtimes, and the audit-export endpoint we ship to procurement teams. The two pricing decisions are independent.</p>
190
+ </details>
191
+ <details class="faq-item">
192
+ <summary>Is this comparison sponsored or partnered?</summary>
193
+ <p>No. We don't have a partnership with Arcjet. We wrote this page because the same prospects evaluate both vendors &mdash; we want them to choose by scope, not by confusion. If anything here misrepresents Arcjet, open an issue at <a href="https://github.com/IgorGanapolsky/ThumbGate/issues" target="_blank" rel="noopener">our repo</a> and we will correct it.</p>
194
+ </details>
195
+ </section>
196
+
197
+ </div>
198
+
199
+ <aside class="sidebar">
200
+ <div class="sidebar-card">
201
+ <span class="related-label">Install ThumbGate</span>
202
+ <p style="font-size: 14px;">Get PreToolUse rules running in your dev's AI coding agent in two minutes.</p>
203
+ <a class="cta-button" href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">npx thumbgate init &rarr;</a>
204
+ </div>
205
+
206
+ <div class="sidebar-card">
207
+ <span class="related-label">Try Arcjet too</span>
208
+ <p style="font-size: 13px;">If you need an application-inbound firewall, install Arcjet on the same project. <a href="https://docs.arcjet.com/" target="_blank" rel="noopener">docs.arcjet.com</a></p>
209
+ </div>
210
+
211
+ <div class="sidebar-card">
212
+ <span class="related-label">Related comparisons</span>
213
+ <a class="related-card" href="/compare/anthropic-containment">
214
+ <strong>ThumbGate vs Anthropic's Claude Containment</strong><br>
215
+ <span style="color: var(--muted); font-size: 13px;">IDE-agent extension of Anthropic's published architecture</span>
216
+ </a>
217
+ <a class="related-card" href="/compare/bumblebee">
218
+ <strong>ThumbGate vs Bumblebee</strong><br>
219
+ <span style="color: var(--muted); font-size: 13px;">Runtime enforcement vs Perplexity's static MCP inventory</span>
220
+ </a>
221
+ <a class="related-card" href="/compare/oak-and-sparrow-gatekeeper">
222
+ <strong>ThumbGate vs Gatekeeper (Oak &amp; Sparrow)</strong><br>
223
+ <span style="color: var(--muted); font-size: 13px;">Agent-action gate vs workforce-input gate</span>
224
+ </a>
225
+ <a class="related-card" href="/compare/anthropic-claude-for-legal">
226
+ <strong>ThumbGate vs Claude for Legal</strong><br>
227
+ <span style="color: var(--muted); font-size: 13px;">Runtime feedback-to-enforcement loop underneath Anthropic's legal bundle</span>
228
+ </a>
229
+ </div>
230
+
231
+ <div class="sidebar-card">
232
+ <span class="related-label">Sources</span>
233
+ <p style="font-size: 13px;">Arcjet product facts from <a href="https://docs.arcjet.com/" target="_blank" rel="noopener">docs.arcjet.com</a> and The New Stack's <a href="https://thenewstack.io/arcjet-wafs-guards-ai-agents-security/" target="_blank" rel="noopener">"The attack surface moved inside the agent. So did Arcjet."</a> as of 2026-05-27. If anything here misrepresents Arcjet, open an issue at <a href="https://github.com/IgorGanapolsky/ThumbGate/issues" target="_blank" rel="noopener">our repo</a> and we will correct it.</p>
234
+ </div>
235
+ </aside>
236
+ </div>
237
+ </main>
238
+ </body>
239
+ </html>