afterthe command finishes. Gate.cat actually intercepts the execution before the shell even sees the command.
The core logic here is fail-closed: if the tool can't parse the command, it blocks it. Crucially, there is no LLM call in the veto path. This means a clever prompt injection can't "convince" the gate to let a dangerous command through because the gate isn't listening to the model; it's analyzing the string and path.
Deployment Options #
Depending on your AI workflow, there are three ways to plug this in:
- ** Claude Code hook**: This is the most secure method since enforcement happens in the harness. Run
pip install gate.cat
and update your .claude/settings.json
by adding gatecat-hook
to the matcher for Bash|Write|Edit
.2.
Gated shell: Works for any CLI agent that honors the
$SHELL
variable (like aider or Codex) via gatecat-shell
.3.
Local proxy: For those using Ollama, vLLM, or OpenRouter, you can just swap the
base_url
to route through the proxy.## Performance Data
The project includes a FACTS.md
file with reproducible artifacts. According to their data:
Command Testing: 1,085,159 unique agent commands from public datasets were replayed; zero misses after adjudication.Bypass Suite: 178/178 dangerous shapes were successfully caught.Intervention Rate: Only ~0.6% of real-world commands are actually blocked, meaning it doesn't get in the way of actual work too often.Policy Walls: Comes with 71 default policy walls.
The Reality Check #
This isn't a magical "safety proof." It's a wall against known-dangerous patterns. If a command doesn't match a danger shape, it goes through. It should be used as a layer of defense alongside a sandbox, not as a replacement for one.
It's Apache-2.0 and has a zero-dependency core.
pip install gate.cat
Specific project details:
https://github.com/BGMLAI/gate.cat