gate.cat: a deterministic, fail-closed veto that stops AI coding agents before rm -rf

AI coding agents now run real shell commands. Most "guardrails" log the damage after the fact. gate.cat vetoes the execution itself — before the shell sees it.

What it does

It blocks irreversible shell commands (rm -rf, DROP TABLE, terraform destroy, secret exfiltration via scp/curl) before they execute. The check is deterministic string + path analysis plus an independent exec analyzer — no model call in the veto path, so a prompt injection can't talk the gate into allowing something. Fail-closed: anything it can't parse becomes a block, never a silent allow.

Three ways to use it

• 
  Claude Code hook (the strongest — enforcement runs in the harness, outside the model's control flow): pip install gate.cat, then add gatecat-hook to .claude/settings.json with matcher Bash|Write|Edit.


• 
  Gated shell for any CLI agent (Codex, aider — anything honoring $SHELL): use gatecat-shell.


• 
  Local proxy for anything speaking the OpenAI API (Ollama, vLLM, LM Studio, OpenRouter): your agent changes one base_url.

Measured, not claimed

Every number below has a row in FACTS.md in the repo, pinned to a reproducible artifact:

• 
  1,085,159 unique real agent commands (5 public datasets) replayed through the full 6-stage gate: 0 real misses after adjudication.


• the reproducible bypass suite catches 178/178 danger shapes it claims — and prints its own known gap (runtime assembly) plus 1 benign false-block in 129 cases. We publish the misses instead of hiding them.


• 
  71 default policy walls (73 presets incl. opt-in), ~0.6% intervention rate on real commands.

Honest limit

The gate is certain only about what it blocks. An unmatched action is unchecked, not safe. It's a wall in front of known-dangerous shapes, not a proof of safety — use it with your sandbox, not instead of one.

Free forever, Apache-2.0, zero-dependency core.

• Install: pip install gate.cat
  


• Repo:
  

What I'd genuinely like feedback on: does publishing our own bypass map and a documented false-block build more trust than a clean number would? That was the hardest design call.