gate.cat

Blocks rm -rf before your AI agent can run it

16 followers

Blocks rm -rf before your AI agent can run it

16 followers

Your AI coding agent doesn't have to be malicious to end your week — just shell access and one confident mistake. gate.cat is a deterministic, fail-closed veto that inspects the tool call at the boundary and refuses the irreversible class (rm -rf, DROP TABLE, terraform destroy) before it runs. Claude Code hook, gated shell, or OpenAI-API proxy. Free forever, Apache 2.0. We replayed 826,644 real agent commands (re-counted 28 Jul, lower bound): 0 real misses — and we publish our own bypass map.

Launch tags:Open Source•Developer Tools•Artificial Intelligence

Launch Team

Wispr Flow: Dictation That Works EverywhereStop typing. Start speaking. 4x faster.

Promoted

Maker

📌

Maker here. Business model up front, because that's the first thing I'd want to know. The local gate is free forever (Apache 2.0). Nothing is rate-limited, and safety is never paywalled — every time an audit found a catastrophic class missing (KMS/secret destroy, IAM escalation, backup destruction), it got promoted INTO the free core, not into a paid pack. What you pay for is the one thing an agent can't have: an off-machine, append-only copy of the veto history. A local log lives inside the agent's blast radius — real incident reports include an agent deleting a file and then hiding that it did. Cloud keeps the receipts, plus alerts and a monthly report. Solo €19/mo, Team €149/mo flat for up to 10 machines, Business €399/mo, and one-time €29 policy packs for stack-specific breadth (Fintech / PaaS / raw HTTP-API). 30-day refund, no questions. Why I built it: a team lost ~$106k to a runaway terraform destroy loop, and the incident author wrote the sentence that became the whole thesis — "Prompt-based rules are documentation. They are not enforcement." A rule in a system prompt is something the model knows. A hook in the harness is something the model cannot skip. The design decision I'd most like feedback on: we publish our own bypass map. The suite catches 178/178 danger shapes it claims, and it also prints its known gap (runtime assembly) plus 1 benign false-block in 129 cases. A clean number is unfalsifiable; a published gap map is checkable. That felt right, but it's an unusual thing for a safety tool to lead with — curious whether it builds trust or reads as weakness. Honest limit, stated on the homepage too: the gate is certain only about what it blocks. An unmatched action is unchecked, not safe. Use it with your sandbox, not instead of one — a sandbox can't tell you what the agent tried, and it won't stop a terraform destroy that has real credentials inside the sandbox. pip install gate.cat — happy to answer anything, especially about false-positive risk.

Report

1mo ago

Maker

Correcting my own comment on launch day, because the gap map is the exact thing I asked for feedback on and I stated it in my own favour. It is not one named gap. It is three, and two of them slip the whole product: a Unicode homoglyph rm and a printf-hex assembled rm. Only the third (runtime assembly) is still caught by the delete analyzer. Separately, the description above originally said 1,085,159 replayed commands. That number is retired - it double-counted one HuggingFace dataset and was inflated by 23.8%. The re-measured figure is 826,644 (28 Jul, one global dedup set, and a lower bound: two SWE-Gym sets dropped out after an upstream split rename). I have updated the description. 0 real misses after adjudication is unchanged. Both are pinned in FACTS.md, which now carries a retired-numbers table naming the old figure and why it died. So, an answer to my own question about whether publishing a gap map builds trust or reads as weakness: it is only worth anything if you also publish it on the day it gets worse. Today it got worse.

Report

30d ago

Pros

Cons

Reviews