{"slug": "gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm", "title": "gate.cat: a deterministic, fail-closed veto that stops AI coding agents before rm -rf", "summary": "A developer released gate.cat, a deterministic, fail-closed veto tool that blocks dangerous shell commands—such as rm -rf, DROP TABLE, and secret exfiltration—before they execute, using string and path analysis with no model call in the veto path to prevent prompt injection bypasses. The tool is free, Apache-2.0 licensed, and designed to be used alongside sandboxes, not as a replacement.", "body_md": "AI coding agents now run real shell commands. Most \"guardrails\" log the damage after the fact. **gate.cat** vetoes the execution itself — before the shell sees it.\n\nIt blocks irreversible shell commands (`rm -rf`\n\n, `DROP TABLE`\n\n, `terraform destroy`\n\n, secret exfiltration via `scp`\n\n/`curl`\n\n) *before* they execute. The check is deterministic string + path analysis plus an independent exec analyzer — **no model call in the veto path**, so a prompt injection can't talk the gate into allowing something. Fail-closed: anything it can't parse becomes a block, never a silent allow.\n\n`pip install gate.cat`\n\n, then add `gatecat-hook`\n\nto `.claude/settings.json`\n\nwith matcher `Bash|Write|Edit`\n\n.`$SHELL`\n\n): use `gatecat-shell`\n\n.`base_url`\n\n.Every number below has a row in `FACTS.md`\n\nin the repo, pinned to a reproducible artifact:\n\nThe gate is certain only about what it **blocks**. An unmatched action is unchecked, not safe. It's a wall in front of known-dangerous shapes, not a proof of safety — use it *with* your sandbox, not instead of one.\n\nFree forever, Apache-2.0, zero-dependency core.\n\n`pip install gate.cat`\n\nWhat I'd genuinely like feedback on: does publishing our own bypass map and a documented false-block build more trust than a clean number would? That was the hardest design call.", "url": "https://wpnews.pro/news/gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm", "canonical_source": "https://dev.to/bogumi_jankiewicz_fcfce0/gatecat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm-rf-577e", "published_at": "2026-07-23 20:42:23+00:00", "updated_at": "2026-07-23 21:33:45.779172+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents"], "entities": ["gate.cat"], "alternates": {"html": "https://wpnews.pro/news/gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm", "markdown": "https://wpnews.pro/news/gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm.md", "text": "https://wpnews.pro/news/gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm.txt", "jsonld": "https://wpnews.pro/news/gate-cat-a-deterministic-fail-closed-veto-that-stops-ai-coding-agents-before-rm.jsonld"}}