thumbgate 1.27.8 → 1.27.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (117) hide show
  1. package/.claude-plugin/plugin.json +1 -1
  2. package/.well-known/llms.txt +1 -2
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +4 -2
  5. package/adapters/claude/.mcp.json +2 -2
  6. package/adapters/mcp/server-stdio.js +1 -1
  7. package/adapters/opencode/opencode.json +1 -1
  8. package/bin/cli.js +259 -78
  9. package/config/gate-templates.json +228 -0
  10. package/config/gates/claim-verification.json +18 -0
  11. package/package.json +14 -21
  12. package/public/blog.html +30 -0
  13. package/public/compare/adopt-ai.html +219 -0
  14. package/public/compare/agentix-labs.html +197 -0
  15. package/public/compare/ai-experience-orchestration.html +216 -0
  16. package/public/compare/anthropic-claude-for-legal.html +260 -0
  17. package/public/compare/anthropic-containment.html +280 -0
  18. package/public/compare/arcade.html +175 -0
  19. package/public/compare/arcjet.html +239 -0
  20. package/public/compare/bumblebee.html +307 -0
  21. package/public/compare/claude-code-hooks.html +294 -0
  22. package/public/compare/databricks-unity-ai-gateway.html +215 -0
  23. package/public/compare/fallow.html +351 -0
  24. package/public/compare/heidi.html +233 -0
  25. package/public/compare/mem0.html +342 -0
  26. package/public/compare/oak-and-sparrow-gatekeeper.html +289 -0
  27. package/public/compare/rein.html +236 -0
  28. package/public/compare/sigmashake.html +256 -0
  29. package/public/compare/speclock.html +342 -0
  30. package/public/compare.html +2 -0
  31. package/public/guides/agent-harness-optimization.html +342 -0
  32. package/public/guides/agentic-web-governance.html +406 -0
  33. package/public/guides/ai-agent-governance-sprint.html +415 -0
  34. package/public/guides/ai-agent-pre-action-approval-gates.html +401 -0
  35. package/public/guides/ai-agent-workflow-migration-checklist.html +392 -0
  36. package/public/guides/ai-deployment-readiness.html +415 -0
  37. package/public/guides/ai-mode-ads-agent-governance.html +401 -0
  38. package/public/guides/ai-search-topical-presence.html +342 -0
  39. package/public/guides/autoresearch-agent-safety.html +342 -0
  40. package/public/guides/background-agent-governance.html +358 -0
  41. package/public/guides/best-tools-stop-ai-agents-breaking-production.html +363 -0
  42. package/public/guides/browser-automation-safety.html +342 -0
  43. package/public/guides/chatgpt-ads-trust.html +353 -0
  44. package/public/guides/claude-code-feedback.html +339 -0
  45. package/public/guides/claude-code-prevent-repeated-mistakes.html +161 -0
  46. package/public/guides/claude-code-skills-guardrails.html +343 -0
  47. package/public/guides/claude-desktop.html +356 -0
  48. package/public/guides/code-knowledge-graph-guardrails.html +365 -0
  49. package/public/guides/codex-cli-guardrails.html +339 -0
  50. package/public/guides/cursor-agent-guardrails.html +339 -0
  51. package/public/guides/cursor-prevent-repeated-mistakes.html +161 -0
  52. package/public/guides/database-agent-safety.html +406 -0
  53. package/public/guides/deepseek-v4-runtime-guardrails.html +346 -0
  54. package/public/guides/developer-machine-supply-chain-guardrails.html +358 -0
  55. package/public/guides/gcp-mcp-guardrails.html +147 -0
  56. package/public/guides/gemini-cli-feedback-memory.html +339 -0
  57. package/public/guides/gpt-5-5-model-evaluation.html +358 -0
  58. package/public/guides/internal-ai-engineering-stack-guardrails.html +348 -0
  59. package/public/guides/long-running-agent-context-management.html +346 -0
  60. package/public/guides/mcp-tool-governance.html +401 -0
  61. package/public/guides/multica-thumbgate-setup.html +134 -0
  62. package/public/guides/native-messaging-host-security.html +342 -0
  63. package/public/guides/policy-engine-pre-action-gates.html +346 -0
  64. package/public/guides/pre-action-checks.html +342 -0
  65. package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +342 -0
  66. package/public/guides/prompt-tricks-to-workflow-rules.html +365 -0
  67. package/public/guides/proxy-pointer-rag-guardrails.html +352 -0
  68. package/public/guides/rag-precision-tuning-guardrails.html +352 -0
  69. package/public/guides/reasoning-compression-guardrails.html +346 -0
  70. package/public/guides/relational-knowledge-ai-recommendations.html +342 -0
  71. package/public/guides/roo-code-alternative-cline.html +339 -0
  72. package/public/guides/semantic-programmatic-seo-guardrails.html +352 -0
  73. package/public/guides/seo-agent-skills-guardrails.html +344 -0
  74. package/public/guides/stop-repeated-ai-agent-mistakes.html +342 -0
  75. package/public/index.html +192 -50
  76. package/public/learn/ac-dc-runtime-enforcement.html +277 -0
  77. package/public/learn/agent-harness-pattern.html +181 -0
  78. package/public/learn/agent-identity-connector-governance.html +146 -0
  79. package/public/learn/agent-swarms-shared-gates.html +173 -0
  80. package/public/learn/agentic-enterprise-context-brain.html +117 -0
  81. package/public/learn/agentic-os-team-governance.html +146 -0
  82. package/public/learn/ai-agent-governance.html +158 -0
  83. package/public/learn/ai-agent-persistent-memory.html +211 -0
  84. package/public/learn/anthropomorphic-claim-gates.html +180 -0
  85. package/public/learn/background-agent-control-layer.html +184 -0
  86. package/public/learn/claude-code-goal-with-rubrics.html +205 -0
  87. package/public/learn/codex-role-plugins-need-governance.html +125 -0
  88. package/public/learn/cost-aware-agent-gate-routing.html +173 -0
  89. package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +157 -0
  90. package/public/learn/deterministic-agent-workflows.html +185 -0
  91. package/public/learn/feedback-loop-vs-decision-layer.html +283 -0
  92. package/public/learn/from-prototype-to-production.html +223 -0
  93. package/public/learn/learn.css +51 -0
  94. package/public/learn/mcp-pre-action-checks-explained.html +172 -0
  95. package/public/learn/pretix-stripe-connect-marketplaces.html +161 -0
  96. package/public/learn/regulated-agent-execution-boundary.html +196 -0
  97. package/public/learn/spec-driven-development.html +168 -0
  98. package/public/learn/stop-ai-agent-force-push.html +134 -0
  99. package/public/learn/vibe-coding-safety-net.html +142 -0
  100. package/public/learn.html +34 -50
  101. package/public/numbers.html +2 -2
  102. package/public/pro.html +6 -6
  103. package/scripts/cli-schema.js +10 -22
  104. package/scripts/dashboard-chat.js +1 -2
  105. package/scripts/document-intake.js +49 -1
  106. package/scripts/gemini-embedding-policy.js +1 -2
  107. package/scripts/hook-stop-anti-claim.js +103 -42
  108. package/scripts/hosted-config.js +12 -0
  109. package/scripts/plausible-domain-config.js +1 -3
  110. package/scripts/reddit-browser-notification-watch.js +230 -0
  111. package/scripts/seo-gsd.js +0 -239
  112. package/scripts/tool-registry.js +2 -2
  113. package/scripts/vector-store.js +0 -44
  114. package/scripts/workspace-evolver.js +2 -62
  115. package/src/api/server.js +126 -335
  116. package/adapters/policy-engine/ethicore-guardian-client.js +0 -68
  117. package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +0 -260
package/public/compare/oak-and-sparrow-gatekeeper.html ADDED
@@ -0,0 +1,289 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>ThumbGate vs Gatekeeper (Oak & Sparrow) | Agent-Action Gate Pairs With Workforce-Input Gate</title>
7
+ <meta name="description" content="Oak & Sparrow's Gatekeeper sits at the browser boundary to block employees from pasting regulated data into ChatGPT/Copilot/Gemini. ThumbGate sits at the PreToolUse boundary to block AI coding agents from executing bad tool calls. Same deterministic-gate philosophy, different layers. Use both for full coverage." />
8
+ <meta property="og:title" content="ThumbGate vs Gatekeeper | Agent-Action Gate Pairs With Workforce-Input Gate" />
9
+ <meta property="og:description" content="Gatekeeper stops employees from leaking regulated data into commercial AI. ThumbGate stops coding agents from executing bad tool calls. Both deterministic, no AI in the gate. Complementary." />
10
+ <meta property="og:type" content="article" />
11
+ <meta property="og:url" content="https://thumbgate.ai/compare/oak-and-sparrow-gatekeeper" />
12
+ <link rel="canonical" href="https://thumbgate.ai/compare/oak-and-sparrow-gatekeeper" />
13
+ <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
14
+ <link rel="icon" type="image/png" href="/thumbgate-icon.png" />
15
+ <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
16
+ <meta property="og:image" content="/og.png" />
17
+ <style>
18
+ :root { --bg: #0a0a0b; --bg-raised: #111113; --bg-card: #161618; --line: #222225; --text: #e8e8ec; --muted: #8b8b96; --cyan: #22d3ee; --green: #4ade80; --amber: #fbbf24; }
19
+ * { box-sizing: border-box; }
20
+ body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: var(--bg); color: var(--text); line-height: 1.65; }
21
+ a { color: var(--cyan); text-decoration: none; }
22
+ a:hover { text-decoration: underline; }
23
+ .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
24
+ .topbar { position: sticky; top: 0; z-index: 20; backdrop-filter: blur(12px); background: rgba(10, 10, 11, 0.88); border-bottom: 1px solid var(--line); }
25
+ .topbar .container { display: flex; justify-content: space-between; align-items: center; padding-top: 14px; padding-bottom: 14px; }
26
+ .brand { font-weight: 700; color: var(--text); display: inline-flex; align-items: center; gap: 8px; text-decoration: none; }
27
+ .brand .logo-mark { width: 28px; height: 28px; display: block; }
28
+ .hero { padding: 72px 0 32px; }
29
+ .eyebrow { display: inline-flex; align-items: center; gap: 8px; padding: 6px 12px; border-radius: 999px; border: 1px solid rgba(34, 211, 238, 0.22); background: rgba(34, 211, 238, 0.1); color: var(--cyan); text-transform: uppercase; letter-spacing: 0.08em; font-size: 12px; font-weight: 700; }
30
+ h1 { font-size: clamp(34px, 5vw, 56px); line-height: 1.06; letter-spacing: -0.04em; margin: 16px 0; max-width: 860px; }
31
+ .hero p { max-width: 760px; color: var(--muted); font-size: 18px; }
32
+ .grid { display: grid; grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr); gap: 24px; padding-bottom: 72px; }
33
+ .card, .detail-section, .sidebar-card { background: var(--bg-card); border: 1px solid var(--line); border-radius: 16px; }
34
+ .card { padding: 24px; }
35
+ .detail-section { padding: 24px; margin-bottom: 18px; }
36
+ .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
37
+ .detail-section p, .detail-section li, .sidebar-card p { color: var(--muted); }
38
+ .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
39
+ .comparison-table { width: 100%; border-collapse: collapse; margin-top: 16px; font-size: 14px; }
40
+ .comparison-table th, .comparison-table td { border: 1px solid var(--line); padding: 12px; text-align: left; vertical-align: top; }
41
+ .comparison-table th { background: var(--bg-raised); color: var(--cyan); }
42
+ .pill-row { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 24px; }
43
+ .pill { border: 1px solid var(--line); background: var(--bg-raised); border-radius: 999px; padding: 10px 14px; font-size: 14px; font-weight: 650; }
44
+ .pill.good { color: #b8f7c8; border-color: rgba(74, 222, 128, 0.28); background: rgba(74, 222, 128, 0.1); }
45
+ .pill.warn { color: #ffe2a4; border-color: rgba(251, 191, 36, 0.28); background: rgba(251, 191, 36, 0.1); }
46
+ .sidebar { display: flex; flex-direction: column; gap: 18px; }
47
+ .sidebar-card { padding: 20px; }
48
+ .sidebar-card:first-child { position: sticky; top: 84px; max-height: calc(100vh - 104px); overflow-y: auto; -webkit-overflow-scrolling: touch; }
49
+ .cta-button { display: inline-flex; align-items: center; justify-content: center; margin-top: 18px; padding: 12px 16px; border-radius: 10px; background: var(--cyan); color: #071116; font-weight: 700; text-decoration: none; }
50
+ .related-card { display: block; padding: 14px; border-radius: 12px; border: 1px solid var(--line); background: var(--bg-raised); margin-top: 12px; color: var(--text); }
51
+ .related-label { display: block; color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; margin-bottom: 4px; }
52
+ .faq-item { border-top: 1px solid var(--line); padding: 14px 0; }
53
+ .faq-item summary { cursor: pointer; font-weight: 600; }
54
+ .faq-item p { color: var(--muted); }
55
+ blockquote { border-left: 3px solid var(--cyan); margin: 14px 0; padding: 6px 16px; color: var(--text); font-style: italic; background: rgba(34, 211, 238, 0.05); }
56
+ @media (max-width: 860px) { .grid { grid-template-columns: 1fr; } .sidebar-card:first-child { position: static; max-height: none; overflow: visible; } }
57
+ </style>
58
+ <script type="application/ld+json">
59
+ {
60
+ "@context": "https://schema.org",
61
+ "@type": "TechArticle",
62
+ "headline": "ThumbGate vs Gatekeeper (Oak & Sparrow Systems)",
63
+ "description": "Gatekeeper intercepts employee inputs to commercial AI systems (ChatGPT, Copilot, Gemini) at the browser boundary, blocking violations of HIPAA, FERPA, CCPA, COPPA, CPNI, PCI, FINRA, and the EU AI Act. ThumbGate intercepts AI coding agent tool calls at the PreToolUse boundary inside Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and Claude Desktop. Same deterministic-gate architectural philosophy. Different layers, different buyers, zero overlap.",
64
+ "about": ["thumbgate vs gatekeeper", "AI governance enforcement layer", "PreToolUse hooks vs browser-boundary interception", "deterministic AI gates"],
65
+ "url": "https://thumbgate.ai/compare/oak-and-sparrow-gatekeeper",
66
+ "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
67
+ "mainEntityOfPage": "https://thumbgate.ai/compare/oak-and-sparrow-gatekeeper"
68
+ }
69
+ </script>
70
+ <script type="application/ld+json">
71
+ {
72
+ "@context": "https://schema.org",
73
+ "@type": "FAQPage",
74
+ "mainEntity": [
75
+ {
76
+ "@type": "Question",
77
+ "name": "Is Gatekeeper a competitor to ThumbGate?",
78
+ "acceptedAnswer": {
79
+ "@type": "Answer",
80
+ "text": "Architectural cousins, not competitors. Both products share the same enforcement philosophy: deterministic rules, no AI in the gate, sealed audit evidence. But they operate on different surfaces. Gatekeeper (by Oak & Sparrow Systems Enterprise) intercepts the input box of commercial AI tools that employees use — ChatGPT, Copilot, Gemini — at the browser boundary, before regulated data leaves the building. ThumbGate intercepts the tool call an AI coding agent is about to execute — bash, SQL, file write, HTTP fetch, MCP tool — before the side effect happens. Same architectural class, complementary scope."
81
+ }
82
+ },
83
+ {
84
+ "@type": "Question",
85
+ "name": "Should I use Gatekeeper or ThumbGate?",
86
+ "acceptedAnswer": {
87
+ "@type": "Answer",
88
+ "text": "Use both if you have both threats. If your concern is employees pasting customer SSNs, PHI, financial records, or other regulated data into ChatGPT/Copilot/Gemini and you need legal-evidence-grade proof that the block happened, that is Gatekeeper's job — it ships 93 deontic rules mapped to HIPAA, FERPA, CCPA, COPPA, CPNI, PCI, FINRA, the EU AI Act, and state chatbot laws. If your concern is an AI coding agent (Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode) running rm -rf, force-pushing main, dropping a production table, or fetching from a privilege-leaking external URL, that is ThumbGate's job."
89
+ }
90
+ },
91
+ {
92
+ "@type": "Question",
93
+ "name": "Do they overlap technically?",
94
+ "acceptedAnswer": {
95
+ "@type": "Answer",
96
+ "text": "No. Gatekeeper hooks the browser; ThumbGate hooks the PreToolUse boundary inside agent runtimes. Different attach points, different request shapes, different rule corpora (statute-derived vs operator-feedback-derived). Running both does not create policy conflicts because each sees a different request layer."
97
+ }
98
+ },
99
+ {
100
+ "@type": "Question",
101
+ "name": "Both say 'deterministic, no AI in the gate'. Why is that important?",
102
+ "acceptedAnswer": {
103
+ "@type": "Answer",
104
+ "text": "An enforcement layer that calls an LLM to decide whether to block introduces the same non-determinism the layer is supposed to fix. Both Gatekeeper and ThumbGate solve this the same way: pure pattern matching against a deterministic rule set. Gatekeeper's rules are derived from statutes (each rule maps to a specific legal citation). ThumbGate's rules are derived from operator feedback through Thompson Sampling auto-promotion (each rule must pass precision/recall thresholds before going live). Different sources of truth, same fast / auditable / no-LLM enforcement path."
105
+ }
106
+ },
107
+ {
108
+ "@type": "Question",
109
+ "name": "Can a regulated firm (law, finance, healthcare) install both?",
110
+ "acceptedAnswer": {
111
+ "@type": "Answer",
112
+ "text": "Yes. The most common dual-use story we expect: a firm uses Gatekeeper to enforce that no PHI / FERPA-protected / non-public-personal-info text gets pasted into ChatGPT by anyone in the org, AND uses ThumbGate to enforce that the firm's AI coding agents and intake bots cannot execute privileged actions (unauthorized practice of law, conflict-of-interest violations, privilege-leaking egress) when they generate code or take tool actions inside Claude Code / Cursor / Codex. Workforce-input gate + agent-action gate covers the AI compliance perimeter end to end."
113
+ }
114
+ }
115
+ ]
116
+ }
117
+ </script>
118
+ </head>
119
+ <body>
120
+ <div class="topbar">
121
+ <div class="container">
122
+ <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
123
+ <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
124
+ </div>
125
+ </div>
126
+
127
+ <section class="hero">
128
+ <div class="container">
129
+ <span class="eyebrow">ThumbGate vs Gatekeeper (Oak &amp; Sparrow)</span>
130
+ <h1>Gatekeeper stops employees leaking data into ChatGPT. ThumbGate stops coding agents executing bad tool calls. Same philosophy, different layer.</h1>
131
+ <p><strong>Gatekeeper</strong> (by <a href="https://oakandsparrowsystemsenterprise.io/" target="_blank" rel="noopener">Oak &amp; Sparrow Systems Enterprise</a>) intercepts every input an employee types into a commercial AI system (ChatGPT, Copilot, Gemini) at the browser boundary, blocking violations of HIPAA, FERPA, CCPA, COPPA, CPNI, PCI, FINRA, and the EU AI Act before the data leaves the building. <strong>ThumbGate</strong> intercepts the tool call an AI coding agent is about to make — bash, SQL, file write, MCP tool, outbound LLM call — inside Claude Code, Cursor, OpenAI Codex CLI, Google Gemini CLI, Sourcegraph Amp, Cline, OpenCode, and Claude Desktop. Both products say *"deterministic enforcement, no AI in the gate."* They mean it.</p>
132
+ <div class="pill-row">
133
+ <span class="pill">Both deterministic</span>
134
+ <span class="pill">Both no AI in the gate</span>
135
+ <span class="pill">Different surfaces</span>
136
+ <span class="pill good">Use both for full coverage</span>
137
+ </div>
138
+ </div>
139
+ </section>
140
+
141
+ <div class="container grid">
142
+ <main>
143
+ <article class="detail-section">
144
+ <h2>Side-by-side scope comparison</h2>
145
+ <table class="comparison-table">
146
+ <thead>
147
+ <tr>
148
+ <th>Capability</th>
149
+ <th>Gatekeeper (Oak &amp; Sparrow)</th>
150
+ <th>ThumbGate</th>
151
+ </tr>
152
+ </thead>
153
+ <tbody>
154
+ <tr>
155
+ <td>What it intercepts</td>
156
+ <td>Every input an employee types into a commercial AI system (ChatGPT, Copilot, Gemini), at the browser boundary, before transmission</td>
157
+ <td>Every tool call an AI coding agent attempts (bash, SQL, file write, HTTP fetch, MCP tool), at the PreToolUse boundary inside the agent runtime, before execution</td>
158
+ </tr>
159
+ <tr>
160
+ <td>Who buys it</td>
161
+ <td>Compliance officers, CISOs, legal teams at regulated firms (healthcare, finance, education, telco)</td>
162
+ <td>Engineering leaders + devs using AI coding agents; law firms / regulated dev teams adopting agentic intake workflows</td>
163
+ </tr>
164
+ <tr>
165
+ <td>Rule source</td>
166
+ <td>93 deontic rules derived from active statutes (HIPAA, FERPA, CCPA/CPRA, COPPA, CPNI, PCI DSS, FINRA, EU AI Act, SB-1001 CA, Colorado AI Act). Each rule maps to a specific legal citation.</td>
167
+ <td>Operator feedback (👍/👎) auto-promoted via Thompson Sampling; LLM-generated candidates that must pass precision/recall gates before activation. Each rule traceable to the lesson that produced it.</td>
168
+ </tr>
169
+ <tr>
170
+ <td>Enforcement primitive</td>
171
+ <td>Deterministic pattern matching; no AI in the gate</td>
172
+ <td>Deterministic pattern matching; no LLM in the gate</td>
173
+ </tr>
174
+ <tr>
175
+ <td>Evidence output</td>
176
+ <td>SHA-256 linked artifacts, timestamped, hashed, chain-linked, statute-referenced — designed as legal evidence</td>
177
+ <td>Audit log entries with rule version + source lesson + decision + reviewer + timestamp; DPO preference pairs for downstream model hardening; HuggingFace dataset export</td>
178
+ </tr>
179
+ <tr>
180
+ <td>Status surface</td>
181
+ <td>GREEN (system ran) / YELLOW (risk caught) / RED (violation prevented)</td>
182
+ <td>Per-agent / per-gate hit rates, agent inventory, remediations, token-savings telemetry on <a href="/dashboard">/dashboard</a></td>
183
+ </tr>
184
+ <tr>
185
+ <td>Attach point</td>
186
+ <td>Browser extension / web boundary, before the HTTP request to OpenAI / Microsoft / Google reaches the AI provider</td>
187
+ <td>PreToolUse hook inside the agent runtime, before the tool call (bash, SQL, MCP, etc.) hits the OS / network</td>
188
+ </tr>
189
+ <tr>
190
+ <td>License / availability</td>
191
+ <td>Enterprise (no public pricing published as of 2026-05-27)</td>
192
+ <td>MIT-licensed npm package (free local CLI); $19/mo Pro for hosted sync + dashboard + DPO export; $49/seat Team for shared lesson DB + workflow hardening</td>
193
+ </tr>
194
+ </tbody>
195
+ </table>
196
+ </article>
197
+
198
+ <article class="detail-section">
199
+ <h2>The shared architectural insight</h2>
200
+ <p>Gatekeeper's site frames its core design constraint in eight words:</p>
201
+ <blockquote>"Deterministic enforcement — no AI in the gate."</blockquote>
202
+ <p>ThumbGate ships the same constraint, written in our own architecture docs as <em>"no LLM on the enforcement path."</em> Both products converge on the same conclusion for the same reason: an enforcement layer that calls an LLM to decide whether to block re-introduces the non-determinism the layer is supposed to remove. A gate that occasionally hallucinates is not a gate — it is a suggestion.</p>
203
+ <p>The deterministic constraint forces a different question: <em>where does the rule corpus come from?</em></p>
204
+ <ul>
205
+ <li><strong>Gatekeeper's answer:</strong> derive rules from statutes. Each of the 93 deontic rules maps to a specific legal citation. The ontology is built from the law, not from assumptions. This makes the output usable as legal evidence in regulated industries.</li>
206
+ <li><strong>ThumbGate's answer:</strong> derive rules from operator feedback. 👎 thumbs-down on a bad agent action becomes a history-aware lesson, then a candidate prevention rule, then — only after passing precision/recall gates — an enforced Pre-Action Check. The ontology is built from observed agent mistakes, not from assumed ones.</li>
207
+ </ul>
208
+ <p>Same enforcement primitive. Different rule provenance. Use both if both data sources matter to your compliance posture.</p>
209
+ </article>
210
+
211
+ <article class="detail-section">
212
+ <h2>The dual-deploy story we expect for regulated firms</h2>
213
+ <p>The buyer who needs both products at once is a regulated firm adopting AI coding agents for internal automation. A concrete picture:</p>
214
+ <p>A law firm has 600 lawyers and paralegals using ChatGPT for routine drafting. <strong>Gatekeeper</strong> sits in the browser and blocks any input containing PHI markers, ABA Rule 5.5 — Unauthorized Practice of Law indicators, conflict-of-interest markers, or attorney-client privileged content from leaving the firm boundary. Every block is sealed as legal evidence the firm can produce in an ethics inquiry.</p>
215
+ <p>The same firm has built an AI intake bot using Cursor + Anthropic's API that handles inbound client questions. <strong>ThumbGate</strong> sits at the PreToolUse boundary inside that bot's agent runtime and blocks (a) advice-shaped output ("you should file in the Southern District of Florida") that would constitute unauthorized practice of law from a non-attorney source, (b) document fetches against parties already on the firm's adverse-parties list, and (c) outbound LLM calls carrying privilege markers. We've published interactive demos of all three gates at <a href="/ai-malpractice-prevention#live-gate-demos">/ai-malpractice-prevention</a>.</p>
216
+ <p>One stack: workforce-input gate + agent-action gate. End-to-end AI compliance perimeter.</p>
217
+ </article>
218
+
219
+ <article class="detail-section">
220
+ <h2>FAQ</h2>
221
+ <details class="faq-item" open>
222
+ <summary>Is Gatekeeper a competitor to ThumbGate?</summary>
223
+ <p>Architectural cousins, not competitors. Same enforcement philosophy (deterministic, no AI in the gate, sealed audit), different surfaces (employee browser input vs agent tool call). Different buyers. Different rule corpora. Zero technical overlap.</p>
224
+ </details>
225
+ <details class="faq-item">
226
+ <summary>Should I use Gatekeeper or ThumbGate?</summary>
227
+ <p>Use both if you have both threats. Gatekeeper for employees pasting regulated data into commercial AI. ThumbGate for AI coding agents executing bad tool calls. They cover different halves of the AI compliance perimeter.</p>
228
+ </details>
229
+ <details class="faq-item">
230
+ <summary>Do they overlap technically?</summary>
231
+ <p>No. Gatekeeper hooks the browser; ThumbGate hooks the PreToolUse boundary inside agent runtimes. Different attach points, different request shapes, different rule corpora. Running both does not create policy conflicts.</p>
232
+ </details>
233
+ <details class="faq-item">
234
+ <summary>Both say "deterministic, no AI in the gate." Why?</summary>
235
+ <p>An enforcement layer that calls an LLM to decide whether to block introduces the same non-determinism the layer is supposed to remove. Both products converge on pure pattern matching against a deterministic rule set for that reason.</p>
236
+ </details>
237
+ <details class="faq-item">
238
+ <summary>Where do I start?</summary>
239
+ <p>Talk to <a href="https://oakandsparrowsystemsenterprise.io/" target="_blank" rel="noopener">Oak &amp; Sparrow</a> for workforce-input governance against ChatGPT / Copilot / Gemini. <code>npx thumbgate init</code> for AI coding agent runtime governance against Claude Code / Cursor / Codex / Gemini CLI / Amp / Cline / OpenCode / Claude Desktop. Different sales motions, different deployment surfaces.</p>
240
+ </details>
241
+ </article>
242
+ </main>
243
+
244
+ <aside class="sidebar">
245
+ <div class="sidebar-card">
246
+ <h3 style="margin: 0 0 8px;">Install ThumbGate free</h3>
247
+ <p>10 captures/day, 3 active rules, PreToolUse blocking across Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, Claude Desktop.</p>
248
+ <pre style="background: var(--bg-raised); border: 1px solid var(--line); border-radius: 8px; padding: 12px; font-size: 13px; overflow: auto;">npx thumbgate init</pre>
249
+ <a class="cta-button" href="/pricing">See Pro vs Team pricing →</a>
250
+ <p style="font-size: 12px; margin-top: 16px;">MIT licensed. No telemetry without opt-in. <code>THUMBGATE_NO_TELEMETRY=1</code> disables.</p>
251
+ </div>
252
+
253
+ <div class="sidebar-card">
254
+ <span class="related-label">Visit Oak &amp; Sparrow</span>
255
+ <p style="font-size: 13px;">Workforce-input governance for ChatGPT / Copilot / Gemini at the browser boundary. <a href="https://oakandsparrowsystemsenterprise.io/" target="_blank" rel="noopener">oakandsparrowsystemsenterprise.io</a></p>
256
+ </div>
257
+
258
+ <div class="sidebar-card">
259
+ <span class="related-label">Related comparisons</span>
260
+ <a class="related-card" href="/compare/anthropic-containment">
261
+ <strong>ThumbGate vs Anthropic's Claude Containment</strong><br>
262
+ <span style="color: var(--muted); font-size: 13px;">IDE-agent extension of Anthropic's published architecture</span>
263
+ </a>
264
+ <a class="related-card" href="/compare/bumblebee">
265
+ <strong>ThumbGate vs Bumblebee</strong><br>
266
+ <span style="color: var(--muted); font-size: 13px;">Runtime enforcement vs Perplexity's static MCP inventory</span>
267
+ </a>
268
+ <a class="related-card" href="/compare/claude-code-hooks">
269
+ <strong>ThumbGate vs claude-code-hooks</strong><br>
270
+ <span style="color: var(--muted); font-size: 13px;">Hosted sync vs local shell scripts</span>
271
+ </a>
272
+ <a class="related-card" href="/compare/arcjet">
273
+ <strong>ThumbGate vs Arcjet</strong><br>
274
+ <span style="color: var(--muted); font-size: 13px;">Agent-outbound gate vs app-inbound firewall</span>
275
+ </a>
276
+ <a class="related-card" href="/compare/anthropic-claude-for-legal">
277
+ <strong>ThumbGate vs Claude for Legal</strong><br>
278
+ <span style="color: var(--muted); font-size: 13px;">Runtime feedback-to-enforcement loop underneath Anthropic's legal bundle</span>
279
+ </a>
280
+ </div>
281
+
282
+ <div class="sidebar-card">
283
+ <span class="related-label">Sources</span>
284
+ <p style="font-size: 13px;">Gatekeeper feature claims and verbatim quotes from <a href="https://oakandsparrowsystemsenterprise.io/" target="_blank" rel="noopener">oakandsparrowsystemsenterprise.io</a> as of 2026-05-27. If anything here misrepresents Gatekeeper, open an issue at <a href="https://github.com/IgorGanapolsky/ThumbGate/issues" target="_blank" rel="noopener">our repo</a> and we'll correct it.</p>
285
+ </div>
286
+ </aside>
287
+ </div>
288
+ </body>
289
+ </html>
package/public/compare/rein.html ADDED
@@ -0,0 +1,236 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>ThumbGate vs Rein — Coding-Agent Governance vs Generic Decorator Governance</title>
7
+ <script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
8
+ <meta name="description" content="ThumbGate vs Rein for AI agent governance. Rein is a generic decorator for production apps in regulated domains. ThumbGate is the coding-agent specialist with a learning feedback loop and MIT licensing.">
9
+ <meta name="keywords" content="AI agent governance, Rein, ThumbGate, runtime governance, pre-action hooks, agent decorator, coding agent guardrails">
10
+ <meta property="og:title" content="ThumbGate vs Rein — Coding-Agent Governance vs Generic Decorator Governance">
11
+ <meta property="og:description" content="Both intercept agent actions before damage. Different layers, different domains, different licenses. Honest side-by-side.">
12
+ <meta property="og:type" content="article">
13
+ <meta property="og:url" content="https://thumbgate.ai/compare/rein">
14
+ <link rel="canonical" href="https://thumbgate.ai/compare/rein">
15
+
16
+ <script type="application/ld+json">
17
+ {
18
+ "@context": "https://schema.org",
19
+ "@type": "TechArticle",
20
+ "headline": "ThumbGate vs Rein — Coding-Agent Governance vs Generic Decorator Governance",
21
+ "description": "Side-by-side comparison of two pre-action governance layers for AI agents. ThumbGate specializes in AI coding agents (Claude Code, Cursor, Codex). Rein is a generic decorator targeted at production apps in regulated domains.",
22
+ "author": {
23
+ "@type": "Person",
24
+ "name": "Igor Ganapolsky",
25
+ "url": "https://github.com/IgorGanapolsky"
26
+ },
27
+ "publisher": {
28
+ "@type": "Organization",
29
+ "name": "ThumbGate",
30
+ "url": "https://thumbgate.ai"
31
+ },
32
+ "datePublished": "2026-05-15",
33
+ "dateModified": "2026-05-15",
34
+ "mainEntityOfPage": "https://thumbgate.ai/compare/rein"
35
+ }
36
+ </script>
37
+
38
+ <script type="application/ld+json">
39
+ {
40
+ "@context": "https://schema.org",
41
+ "@type": "FAQPage",
42
+ "mainEntity": [
43
+ {
44
+ "@type": "Question",
45
+ "name": "What's the difference between Rein and ThumbGate?",
46
+ "acceptedAnswer": {
47
+ "@type": "Answer",
48
+ "text": "Both intercept an agent's action before it fires — that's the shared category. Rein is a generic in-process Python decorator aimed at production apps in regulated domains (trading, healthcare, legal), where each decision is high-stakes and policies are authored by hand. ThumbGate is the coding-agent specialist for Claude Code, Cursor, Codex, Gemini, Amp, Cline, and OpenCode: it intercepts at the out-of-process PreToolUse hook boundary and learns from thumbs-down corrections, auto-promoting them into prevention rules that persist across sessions. Same pre-action thesis, different target user."
49
+ }
50
+ },
51
+ {
52
+ "@type": "Question",
53
+ "name": "Can I use Rein and ThumbGate together?",
54
+ "acceptedAnswer": {
55
+ "@type": "Answer",
56
+ "text": "Yes. They don't conflict and they aren't direct alternatives. Rein governs a production application's agent at the decorated-function boundary; ThumbGate governs your engineering team's coding agents at the PreToolUse boundary. A team running both a regulated production agent and an AI coding workflow can use Rein for the first and ThumbGate for the second."
57
+ }
58
+ },
59
+ {
60
+ "@type": "Question",
61
+ "name": "Does ThumbGate require code changes like Rein's decorator?",
62
+ "acceptedAnswer": {
63
+ "@type": "Answer",
64
+ "text": "No. Rein integrates as a Python decorator you wrap around each tool function. ThumbGate installs with npx thumbgate init, which auto-detects the agent and wires the PreToolUse hooks with zero workflow change. It runs out-of-process at the agent runtime boundary, so dangerous calls are caught before the agent's process even attempts them."
65
+ }
66
+ },
67
+ {
68
+ "@type": "Question",
69
+ "name": "Is ThumbGate open source like Rein?",
70
+ "acceptedAnswer": {
71
+ "@type": "Answer",
72
+ "text": "ThumbGate's CLI and hook layer are MIT licensed — open-core, not viral — with commercial licensing for Pro and Team features. Rein's exact license should be confirmed at reinai.io before you make a distribution decision; a secondary source summarized it as AGPL, but we have not independently verified that, so check the primary source."
73
+ }
74
+ }
75
+ ]
76
+ }
77
+ </script>
78
+
79
+ <link rel="stylesheet" href="/learn/learn.css">
80
+ <style>
81
+ .matrix { width: 100%; border-collapse: collapse; margin: 1.5rem 0; font-size: 0.95rem; }
82
+ .matrix th, .matrix td { padding: 12px 14px; text-align: left; border-bottom: 1px solid var(--border); vertical-align: top; }
83
+ .matrix th { background: var(--bg-card); font-weight: 600; }
84
+ .matrix td:nth-child(2) { color: var(--muted); }
85
+ .matrix td:nth-child(3) { color: var(--text); }
86
+ .verdict { font-weight: 600; color: var(--green); }
87
+ .pair { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin: 1.5rem 0; }
88
+ .pair > div { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; }
89
+ @media (max-width: 700px) { .pair { grid-template-columns: 1fr; } }
90
+ </style>
91
+ </head>
92
+ <body>
93
+
94
+ <nav>
95
+ <a href="/" class="brand"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
96
+ <a href="/pricing">Pricing</a>
97
+ <a href="/case-studies">Case Studies</a>
98
+ <a href="/compare">Compare</a>
99
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
100
+ </nav>
101
+
102
+ <div class="container">
103
+ <div class="breadcrumb"><a href="/compare">Compare</a> / ThumbGate vs Rein</div>
104
+ <h1>ThumbGate vs Rein</h1>
105
+ <p style="color:var(--muted);">5 min read · For teams evaluating AI-agent runtime governance options</p>
106
+
107
+ <div class="tldr"><strong>TL;DR:</strong> Both Rein and ThumbGate intercept agent actions before they fire — that's the shared category. The honest differences: Rein is a <em>generic in-process decorator</em> aimed at production apps in regulated domains (trading, healthcare, legal). ThumbGate is the <em>coding-agent specialist</em> for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, with a feedback loop that learns from thumbs-down corrections, plus MIT licensing on the core CLI + hook layer. <em>Note: Rein's exact license terms are documented at reinai.io; the source we read summarized them as "AGPL" but we have not independently verified — check the primary source before making a distribution decision.</em></div>
108
+
109
+ <h2>The shared thesis</h2>
110
+ <p>Both projects start from the same observation: most AI agent frameworks optimize for task completion, very few optimize for what happens when the agent does the wrong task. Both insert a gate <em>before</em> the action fires rather than trying to clean up after it.</p>
111
+
112
+ <p>Below is an honest side-by-side. We're not going to claim ThumbGate "wins" on every dimension — Rein is well-designed software with a legitimate niche. Pick by what you're actually building.</p>
113
+
114
+ <h2>Side-by-side</h2>
115
+
116
+ <table class="matrix">
117
+ <thead>
118
+ <tr><th style="width:28%;">Dimension</th><th style="width:36%;">Rein</th><th style="width:36%;">ThumbGate</th></tr>
119
+ </thead>
120
+ <tbody>
121
+ <tr>
122
+ <td><strong>Integration layer</strong></td>
123
+ <td>In-process Python decorator wrapping the agent's tool functions.</td>
124
+ <td>Out-of-process PreToolUse hook intercepting tool calls at the agent runtime boundary (Claude Code / Cursor / Codex / Gemini / Amp / Cline / OpenCode).</td>
125
+ </tr>
126
+ <tr>
127
+ <td><strong>Target domain</strong></td>
128
+ <td>Production apps in regulated domains: trading, healthcare, legal. High-stakes per-action.</td>
129
+ <td>AI coding agents. High-volume, high-frequency tool calls (file write, shell exec, git push, package install).</td>
130
+ </tr>
131
+ <tr>
132
+ <td><strong>Target user</strong></td>
133
+ <td>Engineering teams building production agent apps where each decision is consequential.</td>
134
+ <td>Developers and engineering teams running AI coding assistants who hit the same repeat mistake more than once.</td>
135
+ </tr>
136
+ <tr>
137
+ <td><strong>Core mechanisms</strong></td>
138
+ <td>Policy checks. Audit trails. Circuit breakers.</td>
139
+ <td>Pre-action checks. Thumbs-up/down feedback ledger. Auto-generated prevention rules. Lesson DB with semantic recall. Thompson Sampling for gate-policy bandits.</td>
140
+ </tr>
141
+ <tr>
142
+ <td><strong>Learning loop</strong></td>
143
+ <td>Not in the public framing. Policies are authored.</td>
144
+ <td>Yes. Thumbs-down feedback in one session auto-promotes to a prevention rule that blocks the same action in future sessions across machines.</td>
145
+ </tr>
146
+ <tr>
147
+ <td><strong>Domain skill packs</strong></td>
148
+ <td>Not in the public framing.</td>
149
+ <td>Ships Stripe, Railway, database-migration packs. Each pack is a set of pre-action rules specific to the domain's failure modes.</td>
150
+ </tr>
151
+ <tr>
152
+ <td><strong>License</strong></td>
153
+ <td>Open-source license per <a href="https://reinai.io">reinai.io</a> — verify the exact terms at the source before making a distribution decision. (Our secondary source summarized it as AGPL; we have not independently confirmed.)</td>
154
+ <td>MIT for the CLI and hook layer. Commercial license for Team / Pro features. Open-core, not viral.</td>
155
+ </tr>
156
+ <tr>
157
+ <td><strong>Installation</strong></td>
158
+ <td>Python decorator import.</td>
159
+ <td><code>npx thumbgate init</code> — auto-detects the agent, wires the hooks, zero workflow change.</td>
160
+ </tr>
161
+ <tr>
162
+ <td><strong>Cost when the agent is wrong</strong></td>
163
+ <td>Caught at the decorated function boundary.</td>
164
+ <td>Caught at the PreToolUse hook boundary, before the agent's process even attempts the call.</td>
165
+ </tr>
166
+ </tbody>
167
+ </table>
168
+
169
+ <h2>When to pick which</h2>
170
+
171
+ <div class="pair">
172
+ <div>
173
+ <h3 style="margin-top:0;">Use <strong>Rein</strong> if</h3>
174
+ <ul>
175
+ <li>You're building a production application (not a coding agent) in a regulated domain</li>
176
+ <li>You write your agent in Python and want decorator-level integration</li>
177
+ <li>Your team has policy-authoring resources to write rules upfront</li>
178
+ <li>Rein's licensing terms (verify at reinai.io) are acceptable for your distribution model</li>
179
+ <li>Per-action stakes are high enough that a decorator wrapper is the right tradeoff</li>
180
+ </ul>
181
+ </div>
182
+ <div>
183
+ <h3 style="margin-top:0;">Use <strong>ThumbGate</strong> if</h3>
184
+ <ul>
185
+ <li>Your agent is Claude Code, Cursor, Codex, Gemini, Amp, Cline, or OpenCode</li>
186
+ <li>You want the gate to learn from your corrections instead of being authored by hand</li>
187
+ <li>Your team writes code (vs. authoring policy) and wants thumbs-down feedback as the primary signal</li>
188
+ <li>You need an MIT-licensed core layer that can be embedded in commercial products</li>
189
+ <li>You ship Domain Skill Packs as a feature (Stripe, Railway, database migrations)</li>
190
+ </ul>
191
+ </div>
192
+ </div>
193
+
194
+ <h2>Both, side by side, in the same stack</h2>
195
+
196
+ <p>The two projects don't conflict. Rein governs your production app's agent at the function boundary. ThumbGate governs your engineering team's coding agents at the PreToolUse boundary. The pre-action gate pattern is the shared category; the specialization differs. A team operating both an AI coding workflow and a regulated production agent can use ThumbGate for the first and Rein for the second.</p>
197
+
198
+ <div class="callout callout-green">
199
+ <strong>Honest framing:</strong> Rein and ThumbGate are not direct alternatives. We share a thesis. We do not share a target user.
200
+ </div>
201
+
202
+ <h2>What the category gets right</h2>
203
+
204
+ <p>Both projects are correct that the dominant failure mode of agent frameworks today is "you can't undo an action after the model already took it." Prompt-level rules in <code>CLAUDE.md</code> or <code>.cursorrules</code> are eviction-prone under context pressure. Decorator-level wrappers are tighter. Hook-level intercepts are tighter still. Sandbox isolation is the strongest. Pick the layer that matches your operating model.</p>
205
+
206
+ <h2>Adoption in two minutes (ThumbGate)</h2>
207
+
208
+ <ol>
209
+ <li><strong>Install:</strong> <code>npx thumbgate init</code> — the CLI detects your agent and wires PreToolUse hooks. No workflow change.</li>
210
+ <li><strong>Give feedback when the agent is wrong:</strong> a thumbs-down with context becomes a structured failure record.</li>
211
+ <li><strong>Prevention rules generate themselves:</strong> after repeated failures in the same domain, ThumbGate auto-promotes a prevention rule that fires the next time the agent tries the same pattern.</li>
212
+ <li><strong>Pre-action checks block the mistake:</strong> the PreToolUse hook intercepts the call. The agent gets a structured error and a path back to the spec.</li>
213
+ </ol>
214
+
215
+ <div class="cta-box">
216
+ <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Pick the layer that matches your stack</h2>
217
+ <p>Building a Python production agent in a regulated domain? Look at Rein. Running AI coding agents and want them to stop repeating the same mistake? Start with ThumbGate.</p>
218
+ <div class="cta-install">$ npx thumbgate init</div>
219
+ </div>
220
+
221
+ <div class="related">
222
+ <h3>Related comparisons</h3>
223
+ <a href="/compare/heidi">ThumbGate vs Heidi (Meterian supply-chain) →</a>
224
+ <a href="/compare/mem0">ThumbGate vs Mem0 (memory layer) →</a>
225
+ <a href="/compare">All comparisons →</a>
226
+ </div>
227
+ </div>
228
+
229
+
230
+ <div class="sticky-cta">
231
+ <span style="color:var(--muted)">Try it now:</span>
232
+ <code>npx thumbgate init</code>
233
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
234
+ </div>
235
+ </body>
236
+ </html>