gate.cat: a deterministic, fail-closed veto that stops AI coding agents before rm -rf

A developer released gate.cat, a deterministic, fail-closed veto tool that blocks dangerous shell commands—such as rm -rf, DROP TABLE, and secret exfiltration—before they execute, using string and path analysis with no model call in the veto path to prevent prompt injection bypasses. The tool is free, Apache-2.0 licensed, and designed to be used alongside sandboxes, not as a replacement.

AI coding agents now run real shell commands. Most "guardrails" log the damage after the fact. gate.cat vetoes the execution itself — before the shell sees it. It blocks irreversible shell commands rm -rf , DROP TABLE , terraform destroy , secret exfiltration via scp / curl before they execute. The check is deterministic string + path analysis plus an independent exec analyzer — no model call in the veto path , so a prompt injection can't talk the gate into allowing something. Fail-closed: anything it can't parse becomes a block, never a silent allow. pip install gate.cat , then add gatecat-hook to .claude/settings.json with matcher Bash|Write|Edit . $SHELL : use gatecat-shell . base url .Every number below has a row in FACTS.md in the repo, pinned to a reproducible artifact: The gate is certain only about what it blocks . An unmatched action is unchecked, not safe. It's a wall in front of known-dangerous shapes, not a proof of safety — use it with your sandbox, not instead of one. Free forever, Apache-2.0, zero-dependency core. pip install gate.cat What I'd genuinely like feedback on: does publishing our own bypass map and a documented false-block build more trust than a clean number would? That was the hardest design call.