thumbgate 1.4.3 → 1.4.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (270) hide show
  1. package/.claude-plugin/marketplace.json +2 -2
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.well-known/llms.txt +12 -8
  4. package/.well-known/mcp/server-card.json +1 -1
  5. package/README.md +18 -8
  6. package/adapters/README.md +1 -1
  7. package/adapters/claude/.mcp.json +2 -2
  8. package/adapters/codex/config.toml +2 -2
  9. package/adapters/mcp/server-stdio.js +1 -1
  10. package/adapters/opencode/opencode.json +1 -1
  11. package/config/github-about.json +2 -2
  12. package/package.json +158 -10
  13. package/scripts/billing.js +5 -2
  14. package/scripts/statusline.sh +1 -0
  15. package/src/api/server.js +113 -16
  16. package/src/index.js +3 -0
  17. package/.claude-plugin/bundle/icon.png +0 -0
  18. package/.claude-plugin/bundle/icon.svg +0 -18
  19. package/.claude-plugin/bundle/server/index.js +0 -24
  20. package/adapters/chatgpt/INSTALL.md +0 -158
  21. package/adapters/perplexity/.mcp.json +0 -36
  22. package/adapters/perplexity/config.toml +0 -16
  23. package/adapters/perplexity/opencode.json +0 -29
  24. package/bin/memory.sh +0 -64
  25. package/bin/obsidian-sync.sh +0 -20
  26. package/plugins/amp-skill/INSTALL.md +0 -52
  27. package/plugins/amp-skill/SKILL.md +0 -64
  28. package/plugins/claude-codex-bridge/.claude-plugin/plugin.json +0 -22
  29. package/plugins/claude-codex-bridge/.mcp.json +0 -14
  30. package/plugins/claude-codex-bridge/INSTALL.md +0 -43
  31. package/plugins/claude-codex-bridge/README.md +0 -46
  32. package/plugins/claude-codex-bridge/scripts/codex-bridge.js +0 -286
  33. package/plugins/claude-codex-bridge/skills/adversarial-review/SKILL.md +0 -24
  34. package/plugins/claude-codex-bridge/skills/result/SKILL.md +0 -22
  35. package/plugins/claude-codex-bridge/skills/review/SKILL.md +0 -28
  36. package/plugins/claude-codex-bridge/skills/second-pass/SKILL.md +0 -27
  37. package/plugins/claude-codex-bridge/skills/setup/SKILL.md +0 -21
  38. package/plugins/claude-codex-bridge/skills/status/SKILL.md +0 -19
  39. package/plugins/claude-skill/INSTALL.md +0 -55
  40. package/plugins/claude-skill/SKILL.md +0 -46
  41. package/plugins/codex-profile/.codex-plugin/plugin.json +0 -43
  42. package/plugins/codex-profile/.mcp.json +0 -14
  43. package/plugins/codex-profile/AGENTS.md +0 -20
  44. package/plugins/codex-profile/INSTALL.md +0 -89
  45. package/plugins/codex-profile/README.md +0 -61
  46. package/plugins/cursor-marketplace/.cursor-plugin/plugin.json +0 -23
  47. package/plugins/cursor-marketplace/CHANGELOG.md +0 -30
  48. package/plugins/cursor-marketplace/LICENSE +0 -21
  49. package/plugins/cursor-marketplace/README.md +0 -124
  50. package/plugins/cursor-marketplace/agents/reliability-reviewer.md +0 -31
  51. package/plugins/cursor-marketplace/assets/logo-400x400.png +0 -0
  52. package/plugins/cursor-marketplace/commands/capture-feedback.md +0 -33
  53. package/plugins/cursor-marketplace/commands/check-gates.md +0 -25
  54. package/plugins/cursor-marketplace/commands/show-lessons.md +0 -27
  55. package/plugins/cursor-marketplace/hooks/hooks.json +0 -10
  56. package/plugins/cursor-marketplace/mcp.json +0 -14
  57. package/plugins/cursor-marketplace/rules/feedback-capture.mdc +0 -34
  58. package/plugins/cursor-marketplace/rules/pre-action-gates.mdc +0 -30
  59. package/plugins/cursor-marketplace/rules/session-continuity.mdc +0 -28
  60. package/plugins/cursor-marketplace/scripts/gate-check.sh +0 -21
  61. package/plugins/cursor-marketplace/skills/capture-feedback/SKILL.md +0 -48
  62. package/plugins/cursor-marketplace/skills/prevention-rules/SKILL.md +0 -31
  63. package/plugins/cursor-marketplace/skills/recall-context/SKILL.md +0 -30
  64. package/plugins/cursor-marketplace/skills/search-lessons/SKILL.md +0 -33
  65. package/plugins/gemini-extension/INSTALL.md +0 -92
  66. package/plugins/gemini-extension/gemini_prompt.txt +0 -14
  67. package/plugins/gemini-extension/tool_contract.json +0 -45
  68. package/plugins/opencode-profile/INSTALL.md +0 -57
  69. package/public/assets/instagram-card.png +0 -0
  70. package/public/assets/tiktok-agent-memory.mp4 +0 -0
  71. package/public/blog.html +0 -474
  72. package/public/compare/mem0.html +0 -189
  73. package/public/compare/speclock.html +0 -180
  74. package/public/compare.html +0 -310
  75. package/public/dashboard.html +0 -1100
  76. package/public/guide.html +0 -317
  77. package/public/guides/claude-code-prevent-repeated-mistakes.html +0 -161
  78. package/public/guides/codex-cli-guardrails.html +0 -158
  79. package/public/guides/cursor-prevent-repeated-mistakes.html +0 -161
  80. package/public/guides/pre-action-gates.html +0 -162
  81. package/public/guides/stop-repeated-ai-agent-mistakes.html +0 -159
  82. package/public/index.html +0 -1225
  83. package/public/js/buyer-intent.js +0 -252
  84. package/public/learn/agent-harness-pattern.html +0 -180
  85. package/public/learn/ai-agent-persistent-memory.html +0 -203
  86. package/public/learn/learn.css +0 -45
  87. package/public/learn/mcp-pre-action-gates-explained.html +0 -172
  88. package/public/learn/stop-ai-agent-force-push.html +0 -134
  89. package/public/learn/vibe-coding-safety-net.html +0 -142
  90. package/public/learn.html +0 -274
  91. package/public/lessons.html +0 -967
  92. package/public/llm-context.md +0 -156
  93. package/public/pro.html +0 -1087
  94. package/public/vercel.json +0 -8
  95. package/scripts/a2ui-engine.js +0 -73
  96. package/scripts/adk-consolidator.js +0 -274
  97. package/scripts/agent-security-hardening.js +0 -225
  98. package/scripts/ai-search-visibility.js +0 -116
  99. package/scripts/autonomous-sales-agent.js +0 -39
  100. package/scripts/autoresearch-runner.js +0 -216
  101. package/scripts/background-agent-governance.js +0 -229
  102. package/scripts/behavioral-extraction.js +0 -93
  103. package/scripts/budget-enforcer.js +0 -173
  104. package/scripts/budget-guard.js +0 -173
  105. package/scripts/build-claude-mcpb.js +0 -255
  106. package/scripts/build-codex-plugin.js +0 -152
  107. package/scripts/capture-railway-diagnostics.sh +0 -97
  108. package/scripts/changeset-check.js +0 -372
  109. package/scripts/check-congruence.js +0 -443
  110. package/scripts/computer-use-firewall.js +0 -280
  111. package/scripts/content-engine/linkedin-content-generator.js +0 -154
  112. package/scripts/content-engine/output/linkedin-memento-validation.md +0 -17
  113. package/scripts/content-engine/output/linkedin-posts-2026-04-09.md +0 -175
  114. package/scripts/content-engine/reddit-thread-finder.js +0 -154
  115. package/scripts/context-engine.js +0 -710
  116. package/scripts/daily-digest.js +0 -11
  117. package/scripts/data-governance.js +0 -173
  118. package/scripts/deploy-gcp.sh +0 -44
  119. package/scripts/deploy-policy.js +0 -249
  120. package/scripts/disagreement-mining.js +0 -315
  121. package/scripts/dpo-optimizer.js +0 -206
  122. package/scripts/ensure-repo-bootstrap.js +0 -130
  123. package/scripts/ephemeral-agent-store.js +0 -212
  124. package/scripts/eval-harness.js +0 -56
  125. package/scripts/export-kto-pairs.js +0 -309
  126. package/scripts/export-training.js +0 -446
  127. package/scripts/feedback-fallback.js +0 -111
  128. package/scripts/feedback-inbox-read.js +0 -162
  129. package/scripts/feedback-root-consolidator.js +0 -233
  130. package/scripts/feedback-to-memory.js +0 -185
  131. package/scripts/gate-satisfy.js +0 -42
  132. package/scripts/generate-paperbanana-diagrams.sh +0 -99
  133. package/scripts/generate-pretool-hook.sh +0 -40
  134. package/scripts/github-about.js +0 -430
  135. package/scripts/github-outreach.js +0 -65
  136. package/scripts/gtm-revenue-loop.js +0 -535
  137. package/scripts/hallucination-detector.js +0 -226
  138. package/scripts/hf-papers.js +0 -317
  139. package/scripts/hook-auto-capture.sh +0 -100
  140. package/scripts/hook-stop-pr-thread-check.sh +0 -68
  141. package/scripts/hook-stop-self-score.sh +0 -51
  142. package/scripts/hook-stop-verify-deploy.sh +0 -31
  143. package/scripts/hook-verify-before-done.sh +0 -20
  144. package/scripts/managed-dpo-export.js +0 -91
  145. package/scripts/markdown-escape.js +0 -12
  146. package/scripts/marketing-experiment.js +0 -657
  147. package/scripts/memalign-recall.js +0 -111
  148. package/scripts/memory-migration.js +0 -296
  149. package/scripts/meta-policy.js +0 -190
  150. package/scripts/metered-billing.js +0 -16
  151. package/scripts/model-tier-router.js +0 -310
  152. package/scripts/money-watcher.js +0 -218
  153. package/scripts/multi-hop-recall.js +0 -240
  154. package/scripts/per-step-scoring.js +0 -163
  155. package/scripts/perplexity-command-center.js +0 -644
  156. package/scripts/perplexity-marketing.js +0 -454
  157. package/scripts/pii-scanner.js +0 -153
  158. package/scripts/plan-gate.js +0 -154
  159. package/scripts/post-everywhere.js +0 -341
  160. package/scripts/post-to-x-retry.sh +0 -22
  161. package/scripts/post-to-x.js +0 -369
  162. package/scripts/pr-manager.js +0 -421
  163. package/scripts/principle-extractor.js +0 -162
  164. package/scripts/pro-features.js +0 -41
  165. package/scripts/prompt-dlp.js +0 -222
  166. package/scripts/prove-adapters.js +0 -860
  167. package/scripts/prove-attribution.js +0 -361
  168. package/scripts/prove-automation.js +0 -651
  169. package/scripts/prove-autoresearch.js +0 -304
  170. package/scripts/prove-claim-verification.js +0 -277
  171. package/scripts/prove-cloudflare-sandbox.js +0 -161
  172. package/scripts/prove-data-pipeline.js +0 -408
  173. package/scripts/prove-data-quality.js +0 -227
  174. package/scripts/prove-evolution.js +0 -352
  175. package/scripts/prove-harnesses.js +0 -287
  176. package/scripts/prove-intelligence.js +0 -257
  177. package/scripts/prove-lancedb.js +0 -425
  178. package/scripts/prove-local-intelligence.js +0 -340
  179. package/scripts/prove-loop-closure.js +0 -263
  180. package/scripts/prove-packaged-runtime.js +0 -327
  181. package/scripts/prove-predictive-insights.js +0 -355
  182. package/scripts/prove-runtime.js +0 -363
  183. package/scripts/prove-seo-gsd.js +0 -234
  184. package/scripts/prove-settings.js +0 -279
  185. package/scripts/prove-subway-upgrades.js +0 -277
  186. package/scripts/prove-tessl.js +0 -229
  187. package/scripts/prove-training-export.js +0 -325
  188. package/scripts/prove-workflow-contract.js +0 -112
  189. package/scripts/prove-xmemory.js +0 -332
  190. package/scripts/publish-decision.js +0 -159
  191. package/scripts/ralph-loop.js +0 -376
  192. package/scripts/ralph-mode-ci.js +0 -434
  193. package/scripts/reddit-dm-outreach.js +0 -192
  194. package/scripts/reddit-monitor-cron.sh +0 -26
  195. package/scripts/reminder-engine.js +0 -132
  196. package/scripts/revenue-status.js +0 -472
  197. package/scripts/rotate-stripe-webhook-secret.js +0 -314
  198. package/scripts/schedule-manager.js +0 -249
  199. package/scripts/self-healing-check.js +0 -193
  200. package/scripts/session-analyzer.js +0 -533
  201. package/scripts/shieldcortex-memory-firewall-runner.mjs +0 -53
  202. package/scripts/skill-exporter.js +0 -260
  203. package/scripts/skill-materializer.js +0 -134
  204. package/scripts/skill-packs.js +0 -136
  205. package/scripts/skill-proposer.js +0 -99
  206. package/scripts/skill-quality-tracker.js +0 -282
  207. package/scripts/slow-loop.js +0 -72
  208. package/scripts/social-analytics/db/marketing-db.js +0 -179
  209. package/scripts/social-analytics/db/schema.sql +0 -55
  210. package/scripts/social-analytics/digest.js +0 -256
  211. package/scripts/social-analytics/engagement-audit.js +0 -185
  212. package/scripts/social-analytics/generate-instagram-card.js +0 -123
  213. package/scripts/social-analytics/generate-slides.js +0 -268
  214. package/scripts/social-analytics/instagram-thumbgate-post.js +0 -111
  215. package/scripts/social-analytics/install-growth-automation.js +0 -114
  216. package/scripts/social-analytics/load-env.js +0 -77
  217. package/scripts/social-analytics/mcp-server.js +0 -289
  218. package/scripts/social-analytics/normalizer.js +0 -580
  219. package/scripts/social-analytics/notify.js +0 -162
  220. package/scripts/social-analytics/poll-all.js +0 -107
  221. package/scripts/social-analytics/pollers/github.js +0 -195
  222. package/scripts/social-analytics/pollers/instagram.js +0 -253
  223. package/scripts/social-analytics/pollers/linkedin.js +0 -340
  224. package/scripts/social-analytics/pollers/plausible.js +0 -245
  225. package/scripts/social-analytics/pollers/reddit.js +0 -306
  226. package/scripts/social-analytics/pollers/threads.js +0 -233
  227. package/scripts/social-analytics/pollers/tiktok.js +0 -203
  228. package/scripts/social-analytics/pollers/x.js +0 -227
  229. package/scripts/social-analytics/pollers/youtube.js +0 -304
  230. package/scripts/social-analytics/pollers/zernio.js +0 -183
  231. package/scripts/social-analytics/post-video.js +0 -316
  232. package/scripts/social-analytics/publish-instagram-thumbgate.js +0 -104
  233. package/scripts/social-analytics/publish-thumbgate-launch.js +0 -322
  234. package/scripts/social-analytics/publishers/devto.js +0 -122
  235. package/scripts/social-analytics/publishers/instagram.js +0 -317
  236. package/scripts/social-analytics/publishers/linkedin.js +0 -294
  237. package/scripts/social-analytics/publishers/reddit.js +0 -385
  238. package/scripts/social-analytics/publishers/threads.js +0 -275
  239. package/scripts/social-analytics/publishers/tiktok.js +0 -217
  240. package/scripts/social-analytics/publishers/x.js +0 -259
  241. package/scripts/social-analytics/publishers/youtube.js +0 -223
  242. package/scripts/social-analytics/publishers/zernio.js +0 -568
  243. package/scripts/social-analytics/reconcile-thumbgate-campaign.js +0 -165
  244. package/scripts/social-analytics/run-digest.js +0 -34
  245. package/scripts/social-analytics/schedule-thumbgate-campaign.js +0 -275
  246. package/scripts/social-analytics/store.js +0 -455
  247. package/scripts/social-analytics/sync-launch-assets.js +0 -185
  248. package/scripts/social-analytics/utm.js +0 -143
  249. package/scripts/social-pipeline.js +0 -2626
  250. package/scripts/social-post-hourly.js +0 -228
  251. package/scripts/social-quality-gate.js +0 -134
  252. package/scripts/social-reply-monitor.js +0 -592
  253. package/scripts/status-dashboard.js +0 -155
  254. package/scripts/stripe-live-status.js +0 -115
  255. package/scripts/subagent-profiles.js +0 -79
  256. package/scripts/sync-branch-protection.js +0 -340
  257. package/scripts/sync-gh-secrets-from-env.sh +0 -70
  258. package/scripts/sync-github-about.js +0 -55
  259. package/scripts/sync-version.js +0 -479
  260. package/scripts/synthetic-dpo.js +0 -234
  261. package/scripts/tessl-export.js +0 -369
  262. package/scripts/test-coverage.js +0 -128
  263. package/scripts/thumbgate-bench.js +0 -494
  264. package/scripts/thumbgate_session_start.sh +0 -32
  265. package/scripts/train_from_feedback.py +0 -929
  266. package/scripts/validate-feedback.js +0 -581
  267. package/scripts/verify-obsidian-setup.sh +0 -269
  268. package/scripts/verify-run.js +0 -269
  269. package/scripts/weekly-auto-post.js +0 -124
  270. package/scripts/x-autonomous-marketing.js +0 -139
@@ -1,45 +0,0 @@
1
- /* ThumbGate Learn Hub — shared styles for /learn pages */
2
- *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
3
- :root {
4
- --bg: #0a0a0b; --bg-card: #161618; --bg-raised: #111113;
5
- --border: #222225; --text: #e8e8ec; --muted: #8b8b94;
6
- --cyan: #22d3ee; --green: #34d399; --red: #f87171;
7
- }
8
- body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
9
- .container { max-width: 700px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
10
- nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display: flex; gap: 1.5rem; align-items: center; }
11
- nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
12
- nav a:hover { color: var(--cyan); }
13
- nav .brand { color: var(--text); font-weight: 700; font-size: 1.1rem; }
14
- h1 { font-size: 2rem; line-height: 1.2; margin: 2rem 0 1rem; }
15
- h2 { font-size: 1.4rem; margin: 2.5rem 0 0.75rem; color: var(--cyan); }
16
- h3 { font-size: 1.1rem; margin: 1.5rem 0 0.5rem; }
17
- p, li { margin-bottom: 0.75rem; }
18
- ul, ol { padding-left: 1.5rem; }
19
- code { background: #1a1a1e; padding: 0.15em 0.4em; border-radius: 4px; font-size: 0.9em; color: var(--cyan); font-family: 'SF Mono', 'Cascadia Code', 'JetBrains Mono', Consolas, monospace; }
20
- pre { background: var(--bg-raised); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; overflow-x: auto; margin: 1rem 0; }
21
- pre code { background: none; padding: 0; color: var(--text); }
22
- .breadcrumb { font-size: 0.85rem; color: var(--muted); margin-bottom: 0.5rem; }
23
- .breadcrumb a { color: var(--cyan); text-decoration: none; }
24
- .breadcrumb a:hover { text-decoration: underline; }
25
- .callout { background: var(--bg-card); border-left: 3px solid var(--cyan); padding: 1rem 1.25rem; border-radius: 0 8px 8px 0; margin: 1.5rem 0; }
26
- .callout-red { border-left-color: var(--red); }
27
- .callout-green { border-left-color: var(--green); }
28
- .cta-box { margin-top: 3rem; padding: 2rem; background: var(--bg-raised); border: 1px solid var(--border); border-radius: 12px; text-align: center; }
29
- .cta-box p { color: var(--muted); }
30
- .cta-install { display: inline-block; background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 10px 20px; font-family: 'SF Mono', Consolas, monospace; font-size: 0.95rem; color: var(--cyan); margin-top: 1rem; }
31
- .related { margin-top: 2rem; }
32
- .related a { color: var(--cyan); text-decoration: none; display: block; margin-bottom: 0.5rem; }
33
- .related a:hover { text-decoration: underline; }
34
- @media (max-width: 700px) { h1 { font-size: 1.5rem; } .container { padding: 1.5rem 1rem 3rem; } }
35
-
36
- /* TL;DR box — appears right after h1 to hook skimmers */
37
- .tldr { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem 1.25rem; margin: 1rem 0 2rem; font-size: 0.95rem; }
38
- .tldr strong { color: var(--cyan); }
39
- /* Sticky bottom CTA bar */
40
- .sticky-cta { position: fixed; bottom: 0; left: 0; right: 0; background: var(--bg-raised); border-top: 1px solid var(--border); padding: 10px 0; text-align: center; z-index: 100; display: flex; align-items: center; justify-content: center; gap: 16px; font-size: 0.9rem; }
41
- .sticky-cta code { background: var(--bg-card); padding: 4px 12px; border-radius: 6px; color: var(--cyan); font-family: 'SF Mono', Consolas, monospace; font-size: 0.85rem; border: 1px solid var(--border); }
42
- .sticky-cta a { color: var(--cyan); text-decoration: none; font-weight: 600; }
43
- .sticky-cta a:hover { text-decoration: underline; }
44
- /* Add padding-bottom to body so sticky bar doesn't cover content */
45
- body { padding-bottom: 52px; }
@@ -1,172 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>MCP Pre-Action Gates Explained — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="What pre-action gates are, how they work in the Model Context Protocol, and why enforcement beats prompt rules for AI coding agent safety.">
9
- <meta name="keywords" content="MCP pre-action gates, PreToolUse hooks, Model Context Protocol, AI agent enforcement, Claude Code hooks, MCP server guardrails, tool call interception, ThumbGate">
10
- <meta property="og:title" content="MCP Pre-Action Gates Explained">
11
- <meta property="og:description" content="Technical deep-dive: how pre-action gates intercept tool calls and enforce safety rules for AI coding agents.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "MCP Pre-Action Gates Explained",
21
- "description": "Technical deep-dive into pre-action gates: how they intercept tool calls and enforce safety rules at the MCP hook layer.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained",
35
- "about": [
36
- {"@type": "Thing", "name": "Model Context Protocol"},
37
- {"@type": "Thing", "name": "PreToolUse hooks"},
38
- {"@type": "Thing", "name": "AI agent enforcement"}
39
- ]
40
- }
41
- </script>
42
-
43
- <link rel="stylesheet" href="/learn/learn.css">
44
- <style>
45
- .flow-diagram { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1.5rem; margin: 1.5rem 0; font-family: 'SF Mono', Consolas, monospace; font-size: 0.85rem; color: var(--text); line-height: 2; text-align: center; }
46
- .flow-diagram .arrow { color: var(--cyan); }
47
- .flow-diagram .block { color: var(--green); }
48
- .flow-diagram .deny { color: var(--red); }
49
- table { width: 100%; border-collapse: collapse; margin: 1rem 0; }
50
- th, td { text-align: left; padding: 0.6rem 0.8rem; border-bottom: 1px solid var(--border); font-size: 0.9rem; }
51
- th { color: var(--cyan); font-weight: 600; }
52
- </style>
53
- </head>
54
- <body>
55
-
56
- <nav>
57
- <a href="/" class="brand">👍👎 ThumbGate</a>
58
- <a href="/guide">Setup Guide</a>
59
- <a href="/learn">Learn</a>
60
- <a href="/dashboard">Dashboard</a>
61
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
62
- </nav>
63
-
64
- <div class="container">
65
- <div class="breadcrumb"><a href="/learn">Learn</a> / MCP Pre-Action Gates</div>
66
- <h1>MCP Pre-Action Gates Explained</h1>
67
- <p style="color:var(--muted);">4 min read &middot; Technical deep-dive for developers building on MCP</p>
68
-
69
- <div class="tldr"><strong>TL;DR:</strong> Pre-action gates intercept tool calls before they execute. Unlike prompt rules, they cannot be ignored. This is how enforcement actually works in MCP.</div>
70
-
71
- <h2>What is a pre-action gate?</h2>
72
- <p>A pre-action gate is an enforcement rule that intercepts an AI agent's tool call <em>before</em> it executes. If the tool call matches a known-bad pattern, the gate blocks it and returns a rejection to the agent. The agent then adapts its approach without ever having run the dangerous action.</p>
73
- <p>Gates run at the hook layer of the Model Context Protocol (MCP). They are external to the agent's reasoning chain, which means they cannot be overridden by prompt injection, context overflow, or chain-of-thought reasoning.</p>
74
-
75
- <h2>How it works: the tool call lifecycle</h2>
76
- <div class="flow-diagram">
77
- <span class="block">Agent decides to call tool</span><br>
78
- <span class="arrow">&darr;</span><br>
79
- <span class="block">PreToolUse hook fires</span><br>
80
- <span class="arrow">&darr;</span><br>
81
- <span class="block">ThumbGate checks tool call against gates</span><br>
82
- <span class="arrow">&darr;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&darr;</span><br>
83
- <span class="block">No match &rarr; ALLOW</span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="deny">Match &rarr; BLOCK + reason</span><br>
84
- <span class="arrow">&darr;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&darr;</span><br>
85
- <span class="block">Tool executes</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="deny">Agent receives rejection</span>
86
- </div>
87
-
88
- <h2>Prompt rules vs. pre-action gates</h2>
89
- <table>
90
- <thead>
91
- <tr><th>Property</th><th>Prompt Rules</th><th>Pre-Action Gates</th></tr>
92
- </thead>
93
- <tbody>
94
- <tr><td>Where they live</td><td>Inside agent context</td><td>External hook layer</td></tr>
95
- <tr><td>Can be overridden</td><td>Yes (context overflow, reasoning)</td><td>No (runs outside agent)</td></tr>
96
- <tr><td>Enforcement</td><td>Advisory</td><td>Physical block</td></tr>
97
- <tr><td>Persistence</td><td>Per-session (context-dependent)</td><td>Permanent (database-backed)</td></tr>
98
- <tr><td>Adapts over time</td><td>No</td><td>Yes (Thompson Sampling)</td></tr>
99
- <tr><td>Explains why</td><td>No</td><td>Yes (reason chain per block)</td></tr>
100
- </tbody>
101
- </table>
102
-
103
- <h2>The three layers of a gate</h2>
104
-
105
- <h3>1. Pattern matcher</h3>
106
- <p>Gates match against the tool name and its arguments. For a <code>Bash</code> tool call, the pattern might match <code>git push --force</code> targeting <code>main</code>. For a <code>Write</code> tool call, it might match writes to <code>.env</code> or <code>production.config</code>.</p>
107
- <pre><code>{
108
- "tool": "Bash",
109
- "pattern": "git push.*(--force|-f).*main",
110
- "action": "BLOCK"
111
- }</code></pre>
112
-
113
- <h3>2. Evidence and reasoning</h3>
114
- <p>Every gate decision includes a reasoning chain: why this pattern exists, how many times it has fired, what the original failure was. This transparency lets you audit the system and tune it.</p>
115
- <pre><code>{
116
- "gate": "no-force-push-main",
117
- "decision": "BLOCK",
118
- "reason": "Force-push to main blocked",
119
- "evidence": "User reported loss of 14 commits (2026-03-15)",
120
- "fire_count": 7,
121
- "confidence": 0.94
122
- }</code></pre>
123
-
124
- <h3>3. Thompson Sampling adaptation</h3>
125
- <p>Not all patterns deserve the same enforcement level. Thompson Sampling uses a beta distribution to model each gate's risk profile. High-risk patterns (many failures, few successes) get strict enforcement. Low-risk patterns (rarely triggered, occasionally overridden) stay relaxed.</p>
126
-
127
- <div class="callout">
128
- <strong>Why Thompson Sampling?</strong> It balances exploration vs. exploitation. New gates start with wide confidence intervals and tighten as evidence accumulates. This prevents over-blocking on sparse data while ensuring genuinely dangerous patterns get strict enforcement fast.
129
- </div>
130
-
131
- <h2>How gates are created</h2>
132
- <ol>
133
- <li><strong>Feedback capture:</strong> Developer gives thumbs-down with context about what went wrong</li>
134
- <li><strong>Lesson storage:</strong> Feedback is stored in SQLite with FTS5 indexing for fast retrieval</li>
135
- <li><strong>Corrective inference:</strong> ThumbGate matches the failure against similar past failures and infers what should be prevented</li>
136
- <li><strong>Rule promotion:</strong> After configurable repeated failures, the lesson promotes to a prevention rule</li>
137
- <li><strong>Gate activation:</strong> The prevention rule becomes an active gate in the PreToolUse hook</li>
138
- </ol>
139
-
140
- <h2>Supported agents</h2>
141
- <p>Pre-action gates work with any agent that supports MCP hooks:</p>
142
- <ul>
143
- <li><strong>Claude Code</strong> &mdash; PreToolUse hooks in <code>.claude/settings.json</code></li>
144
- <li><strong>Cursor</strong> &mdash; MCP server configuration in <code>.cursor/mcp.json</code></li>
145
- <li><strong>Codex</strong> &mdash; MCP tool interception via server config</li>
146
- <li><strong>Gemini CLI</strong> &mdash; MCP server hooks</li>
147
- <li><strong>Amp, OpenCode</strong> &mdash; any MCP-compatible agent</li>
148
- </ul>
149
- <p>Run <code>npx thumbgate init</code> to auto-detect your agent and configure the correct hook format.</p>
150
-
151
- <div class="cta-box">
152
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Build your first gate</h2>
153
- <p>Install, give your first thumbs-down, and watch the gate auto-generate.</p>
154
- <div class="cta-install">$ npx thumbgate init</div>
155
- </div>
156
-
157
- <div class="related">
158
- <h3>Related guides</h3>
159
- <a href="/learn/stop-ai-agent-force-push">How to Stop AI Agents From Force-Pushing to Main &rarr;</a>
160
- <a href="/learn/vibe-coding-safety-net">The Vibe Coding Safety Net You Are Missing &rarr;</a>
161
- <a href="/guide">Full Setup Guide &rarr;</a>
162
- </div>
163
- </div>
164
-
165
-
166
- <div class="sticky-cta">
167
- <span style="color:var(--muted)">Try it now:</span>
168
- <code>npx thumbgate init</code>
169
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
170
- </div>
171
- </body>
172
- </html>
@@ -1,134 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>How to Stop AI Agents From Force-Pushing to Main — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="Your AI coding agent just force-pushed to main. Again. Here is how to make that physically impossible with a pre-action gate in two minutes.">
9
- <meta name="keywords" content="AI agent force push, Claude Code force push prevention, git push force main, AI coding agent git safety, pre-action gates, ThumbGate">
10
- <meta property="og:title" content="How to Stop AI Agents From Force-Pushing to Main">
11
- <meta property="og:description" content="Make force-push to main physically impossible for your AI coding agent with a pre-action gate.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "How to Stop AI Agents From Force-Pushing to Main",
21
- "description": "Make force-push to main physically impossible for your AI coding agent with a pre-action gate.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push",
35
- "about": [
36
- {"@type": "Thing", "name": "git force push prevention"},
37
- {"@type": "Thing", "name": "AI coding agent safety"},
38
- {"@type": "Thing", "name": "pre-action gates"}
39
- ]
40
- }
41
- </script>
42
-
43
- <link rel="stylesheet" href="/learn/learn.css">
44
- </head>
45
- <body>
46
-
47
- <nav>
48
- <a href="/" class="brand">👍👎 ThumbGate</a>
49
- <a href="/guide">Setup Guide</a>
50
- <a href="/learn">Learn</a>
51
- <a href="/dashboard">Dashboard</a>
52
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
53
- </nav>
54
-
55
- <div class="container">
56
- <div class="breadcrumb"><a href="/learn">Learn</a> / Stop AI Agent Force-Push</div>
57
- <h1>How to Stop AI Agents From Force-Pushing to Main</h1>
58
- <p style="color:var(--muted);">2 min read &middot; Works with Claude Code, Cursor, Codex, and any MCP agent</p>
59
-
60
- <div class="tldr"><strong>TL;DR:</strong> Your AI agent will force-push to main unless you physically prevent it. One PreToolUse hook + two minutes = impossible.</div>
61
-
62
- <h2>The problem</h2>
63
- <p>You write <code>never force-push to main</code> in your CLAUDE.md. Your agent reads it. Then it force-pushes to main anyway. Prompt rules are suggestions. Agents can and do ignore them when the context window fills up or when a chain of reasoning overrides the instruction.</p>
64
-
65
- <div class="callout callout-red">
66
- <strong>Real example:</strong> A developer lost 14 commits when their Claude Code agent ran <code>git push --force origin main</code> during a rebase. The CLAUDE.md said "never force-push." The agent did it anyway.
67
- </div>
68
-
69
- <h2>Why prompt rules fail</h2>
70
- <ul>
71
- <li><strong>Context overflow</strong> &mdash; as the conversation grows, early instructions get compressed or dropped</li>
72
- <li><strong>Reasoning override</strong> &mdash; the agent decides force-push is the "correct" solution to a merge conflict</li>
73
- <li><strong>No enforcement layer</strong> &mdash; nothing physically stops the tool call from executing</li>
74
- </ul>
75
-
76
- <h2>The fix: a pre-action gate</h2>
77
- <p>A pre-action gate intercepts the tool call <em>before</em> it executes. It pattern-matches the command against known-bad actions and blocks them. The agent cannot bypass it because the gate runs outside the agent's control, at the MCP hook layer.</p>
78
-
79
- <h3>Step 1: Install ThumbGate</h3>
80
- <pre><code>npx thumbgate init</code></pre>
81
- <p>This auto-detects your agent (Claude Code, Cursor, etc.) and configures the PreToolUse hook.</p>
82
-
83
- <h3>Step 2: Give feedback</h3>
84
- <p>The next time your agent tries a force-push (or anything dangerous), give it a thumbs-down with context:</p>
85
- <pre><code>👎 "Never force-push to main. This destroyed 14 commits last time."</code></pre>
86
-
87
- <h3>Step 3: Gate auto-generates</h3>
88
- <p>ThumbGate captures the feedback, matches it against the tool call pattern, and auto-generates a prevention rule. After repeated failures (configurable), it promotes to a hard gate:</p>
89
- <pre><code># Auto-generated prevention rule
90
- pattern: "git push --force"
91
- target_branch: "main"
92
- action: BLOCK
93
- reason: "Force-push to main blocked — destroyed 14 commits (2026-03-15)"</code></pre>
94
-
95
- <h3>Step 4: Gate fires on every future attempt</h3>
96
- <p>The PreToolUse hook checks every <code>Bash</code> tool call. If it matches <code>git push --force</code> targeting <code>main</code>, the action is blocked before execution. The agent receives a rejection with the reason and adapts.</p>
97
-
98
- <div class="callout">
99
- <strong>Key difference:</strong> Prompt rules ask nicely. Pre-action gates physically block. The gate runs at the hook layer, outside the agent's reasoning chain, so it cannot be overridden by context or chain-of-thought.
100
- </div>
101
-
102
- <h2>What about other dangerous actions?</h2>
103
- <p>The same pattern works for any tool call you want to prevent:</p>
104
- <ul>
105
- <li><code>DROP TABLE</code> on production databases</li>
106
- <li><code>rm -rf</code> on project directories</li>
107
- <li>Committing <code>.env</code> files with secrets</li>
108
- <li>Running untested migrations on prod</li>
109
- <li>Skipping test suites before deploy</li>
110
- </ul>
111
- <p>Every thumbs-down teaches the system. Thompson Sampling adapts gate sensitivity: high-risk patterns get strict enforcement, low-risk ones stay relaxed.</p>
112
-
113
- <div class="cta-box">
114
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Try it now</h2>
115
- <p>One command. Your agent stops repeating mistakes today.</p>
116
- <div class="cta-install">$ npx thumbgate init</div>
117
- </div>
118
-
119
- <div class="related">
120
- <h3>Related guides</h3>
121
- <a href="/learn/vibe-coding-safety-net">The Vibe Coding Safety Net You Are Missing &rarr;</a>
122
- <a href="/learn/mcp-pre-action-gates-explained">MCP Pre-Action Gates Explained &rarr;</a>
123
- <a href="/guide">Full Setup Guide &rarr;</a>
124
- </div>
125
- </div>
126
-
127
-
128
- <div class="sticky-cta">
129
- <span style="color:var(--muted)">Try it now:</span>
130
- <code>npx thumbgate init</code>
131
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
132
- </div>
133
- </body>
134
- </html>
@@ -1,142 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>The Vibe Coding Safety Net You Are Missing — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="Vibe coding is fast until your AI agent deletes a production table or rewrites a file you did not ask it to touch. Add guardrails without slowing down.">
9
- <meta name="keywords" content="vibe coding safety, vibe coding guardrails, AI coding mistakes, Claude Code safety net, Cursor agent guardrails, AI agent enforcement, ThumbGate">
10
- <meta property="og:title" content="The Vibe Coding Safety Net You Are Missing">
11
- <meta property="og:description" content="Vibe coding is fast until your AI agent breaks something. Add guardrails without slowing down.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "The Vibe Coding Safety Net You Are Missing",
21
- "description": "Vibe coding is fast until your AI agent breaks something. Here is how to add guardrails that learn from your corrections.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net"
35
- }
36
- </script>
37
-
38
- <link rel="stylesheet" href="/learn/learn.css">
39
- <style>
40
- .comparison { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin: 1.5rem 0; }
41
- .comparison > div { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; }
42
- .comparison h4 { font-size: 0.95rem; margin-bottom: 0.5rem; }
43
- .comparison .bad h4 { color: var(--red); }
44
- .comparison .good h4 { color: var(--green); }
45
- @media (max-width: 700px) { .comparison { grid-template-columns: 1fr; } }
46
- </style>
47
- </head>
48
- <body>
49
-
50
- <nav>
51
- <a href="/" class="brand">👍👎 ThumbGate</a>
52
- <a href="/guide">Setup Guide</a>
53
- <a href="/learn">Learn</a>
54
- <a href="/dashboard">Dashboard</a>
55
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
56
- </nav>
57
-
58
- <div class="container">
59
- <div class="breadcrumb"><a href="/learn">Learn</a> / Vibe Coding Safety Net</div>
60
- <h1>The Vibe Coding Safety Net You Are Missing</h1>
61
- <p style="color:var(--muted);">3 min read &middot; For developers who vibe-code with Claude Code, Cursor, Codex, or Gemini</p>
62
-
63
- <div class="tldr"><strong>TL;DR:</strong> Vibe coding is 10x faster until your agent breaks something. Add a feedback-driven safety net that learns from your corrections — without slowing you down.</div>
64
-
65
- <h2>Vibe coding is a superpower with a blindspot</h2>
66
- <p>You describe what you want. The agent builds it. You ship in hours what used to take days. But every vibe-coder has hit this wall: the agent does something catastrophically wrong, and you realize there was nothing stopping it.</p>
67
-
68
- <div class="comparison">
69
- <div class="bad">
70
- <h4>Without guardrails</h4>
71
- <ul>
72
- <li>Agent rewrites a file you did not mention</li>
73
- <li>Agent runs <code>DROP TABLE</code> in prod</li>
74
- <li>Agent force-pushes over teammate's commits</li>
75
- <li>Agent installs a dependency you rejected yesterday</li>
76
- <li>Same mistake repeats every session</li>
77
- </ul>
78
- </div>
79
- <div class="good">
80
- <h4>With ThumbGate</h4>
81
- <ul>
82
- <li>Gate blocks file writes outside scope</li>
83
- <li>Gate blocks destructive SQL before execution</li>
84
- <li>Gate blocks force-push to protected branches</li>
85
- <li>Gate remembers your rejection across sessions</li>
86
- <li>Mistakes are blocked permanently after feedback</li>
87
- </ul>
88
- </div>
89
- </div>
90
-
91
- <h2>Why CLAUDE.md and .cursorrules are not enough</h2>
92
- <p>Prompt rules live inside the agent's context. They compete with your conversation, the codebase, and the agent's own reasoning. When the context window fills up, prompt rules are the first thing to get compressed or ignored.</p>
93
- <p>Pre-action gates live <em>outside</em> the agent. They intercept tool calls at the hook layer (PreToolUse in MCP) before execution. The agent cannot override them because the gate runs in a separate process.</p>
94
-
95
- <div class="callout callout-green">
96
- <strong>Mental model:</strong> Prompt rules are speed limit signs. Pre-action gates are physical barriers. Signs can be ignored. Barriers cannot.
97
- </div>
98
-
99
- <h2>How to add guardrails in two minutes</h2>
100
- <ol>
101
- <li><strong>Install:</strong> <code>npx thumbgate init</code> — auto-detects your agent and configures hooks</li>
102
- <li><strong>Code normally:</strong> vibe-code as you always do, no workflow changes</li>
103
- <li><strong>Correct when needed:</strong> when the agent does something wrong, give it a thumbs-down with context</li>
104
- <li><strong>Gates build themselves:</strong> repeated failures auto-promote into prevention rules that block the action next time</li>
105
- </ol>
106
-
107
- <h2>It gets smarter over time</h2>
108
- <p>ThumbGate uses Thompson Sampling to adapt enforcement. Patterns that cause real damage get strict gates. Low-risk patterns stay relaxed. The system tunes itself based on your feedback — no manual rule-writing required.</p>
109
- <p>Every correction you make improves the model. Every thumbs-up reinforces good behavior. Over weeks, your agent develops an immune system tailored to your codebase and workflow.</p>
110
-
111
- <h2>What vibe-coders actually gate</h2>
112
- <p>Based on real usage patterns from ThumbGate users:</p>
113
- <ul>
114
- <li><strong>Git operations:</strong> force-push, branch deletion, rebase on shared branches</li>
115
- <li><strong>File mutations:</strong> writes to config files, package.json changes, lock file modifications</li>
116
- <li><strong>Database operations:</strong> destructive SQL, schema migrations without backup</li>
117
- <li><strong>Dependency management:</strong> installing packages the developer already rejected</li>
118
- <li><strong>Deployment:</strong> pushing to production without test suite passing</li>
119
- </ul>
120
-
121
- <div class="cta-box">
122
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Start with one gate</h2>
123
- <p>Install, vibe-code, and give your first thumbs-down. The safety net builds itself.</p>
124
- <div class="cta-install">$ npx thumbgate init</div>
125
- </div>
126
-
127
- <div class="related">
128
- <h3>Related guides</h3>
129
- <a href="/learn/stop-ai-agent-force-push">How to Stop AI Agents From Force-Pushing to Main &rarr;</a>
130
- <a href="/learn/mcp-pre-action-gates-explained">MCP Pre-Action Gates Explained &rarr;</a>
131
- <a href="/guide">Full Setup Guide &rarr;</a>
132
- </div>
133
- </div>
134
-
135
-
136
- <div class="sticky-cta">
137
- <span style="color:var(--muted)">Try it now:</span>
138
- <code>npx thumbgate init</code>
139
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
140
- </div>
141
- </body>
142
- </html>