Gate.cat: Stopping AI Agents from Running rm -rf

Gate.cat, an open-source tool from BGMLAI, intercepts shell commands from AI agents before execution to block dangerous operations like rm -rf, using a fail-closed parser with no LLM call in the veto path. In testing on 1,085,159 unique agent commands, it achieved zero misses and caught 178/178 dangerous shapes, blocking only ~0.6% of real-world commands. The tool offers deployment via Claude Code hook, gated shell, or local proxy, and is available under Apache-2.0 at github.com/BGMLAI/gate.cat.

Gate.cat: Stopping AI Agents from Running rm -rf after the command finishes. Gate.cat actually intercepts the execution before the shell even sees the command. The core logic here is fail-closed: if the tool can't parse the command, it blocks it. Crucially, there is no LLM call in the veto path. This means a clever prompt injection can't "convince" the gate to let a dangerous command through because the gate isn't listening to the model; it's analyzing the string and path. Deployment Options Depending on your AI workflow, there are three ways to plug this in: 1. Claude Code hook : This is the most secure method since enforcement happens in the harness. Run pip install gate.cat and update your .claude/settings.json by adding gatecat-hook to the matcher for Bash|Write|Edit .2. Gated shell : Works for any CLI agent that honors the $SHELL variable like aider or Codex via gatecat-shell .3. Local proxy : For those using Ollama, vLLM, or OpenRouter, you can just swap the base url to route through the proxy. Performance Data The project includes a FACTS.md file with reproducible artifacts. According to their data: Command Testing: 1,085,159 unique agent commands from public datasets were replayed; zero misses after adjudication. Bypass Suite: 178/178 dangerous shapes were successfully caught. Intervention Rate: Only ~0.6% of real-world commands are actually blocked, meaning it doesn't get in the way of actual work too often. Policy Walls: Comes with 71 default policy walls. The Reality Check This isn't a magical "safety proof." It's a wall against known-dangerous patterns. If a command doesn't match a danger shape, it goes through. It should be used as a layer of defense alongside a sandbox, not as a replacement for one. It's Apache-2.0 and has a zero-dependency core. pip install gate.cat Specific project details: https://github.com/BGMLAI/gate.cat Next LLM Eval Strategy → /en/threads/2479/