# gate.cat: a deterministic, fail-closed veto that stops AI coding agents before rm -rf > Source: > Published: 2026-07-23 20:42:23+00:00 AI coding agents now run real shell commands. Most "guardrails" log the damage after the fact. **gate.cat** vetoes the execution itself — before the shell sees it. It blocks irreversible shell commands (`rm -rf` , `DROP TABLE` , `terraform destroy` , secret exfiltration via `scp` /`curl` ) *before* they execute. The check is deterministic string + path analysis plus an independent exec analyzer — **no model call in the veto path**, so a prompt injection can't talk the gate into allowing something. Fail-closed: anything it can't parse becomes a block, never a silent allow. `pip install gate.cat` , then add `gatecat-hook` to `.claude/settings.json` with matcher `Bash|Write|Edit` .`$SHELL` ): use `gatecat-shell` .`base_url` .Every number below has a row in `FACTS.md` in the repo, pinned to a reproducible artifact: The gate is certain only about what it **blocks**. An unmatched action is unchecked, not safe. It's a wall in front of known-dangerous shapes, not a proof of safety — use it *with* your sandbox, not instead of one. Free forever, Apache-2.0, zero-dependency core. `pip install gate.cat` What I'd genuinely like feedback on: does publishing our own bypass map and a documented false-block build more trust than a clean number would? That was the hardest design call.