AI coding agents now run real shell commands. Most "guardrails" log the damage after the fact. gate.cat vetoes the execution itself — before the shell sees it.
It blocks irreversible shell commands (rm -rf
, DROP TABLE
, terraform destroy
, secret exfiltration via scp
/curl
) before they execute. The check is deterministic string + path analysis plus an independent exec analyzer — no model call in the veto path, so a prompt injection can't talk the gate into allowing something. Fail-closed: anything it can't parse becomes a block, never a silent allow.
pip install gate.cat
, then add gatecat-hook
to .claude/settings.json
with matcher Bash|Write|Edit
.$SHELL
): use gatecat-shell
.base_url
.Every number below has a row in FACTS.md
in the repo, pinned to a reproducible artifact:
The gate is certain only about what it blocks. An unmatched action is unchecked, not safe. It's a wall in front of known-dangerous shapes, not a proof of safety — use it with your sandbox, not instead of one.
Free forever, Apache-2.0, zero-dependency core.
pip install gate.cat
What I'd genuinely like feedback on: does publishing our own bypass map and a documented false-block build more trust than a clean number would? That was the hardest design call.