Gate.cat: Stopping AI Agents from Running rm -rf

Ray37 Intermediate 10h ago 391 views 9 likes 1 min read

Giving AI coding agents shell access is a gamble unless you have a deterministic veto system. Most guardrails are just glorified logs that tell you why your database is gone after the command finishes. Gate.cat actually intercepts the execution before the shell even sees the command.

The core logic here is fail-closed: if the tool can't parse the command, it blocks it. Crucially, there is no LLM call in the veto path. This means a clever prompt injection can't "convince" the gate to let a dangerous command through because the gate isn't listening to the model; it's analyzing the string and path.

Deployment Options

Depending on your AI workflow, there are three ways to plug this in:

1. Claude Code hook: This is the most secure method since enforcement happens in the harness. Run pip install gate.cat and update your .claude/settings.json by adding gatecat-hook to the matcher for Bash|Write|Edit.
2. Gated shell: Works for any CLI agent that honors the $SHELL variable (like aider or Codex) via gatecat-shell.
3. Local proxy: For those using Ollama, vLLM, or OpenRouter, you can just swap the base_url to route through the proxy.

Performance Data

The project includes a FACTS.md file with reproducible artifacts. According to their data:

Command Testing: 1,085,159 unique agent commands from public datasets were replayed; zero misses after adjudication.
Bypass Suite: 178/178 dangerous shapes were successfully caught.
Intervention Rate: Only ~0.6% of real-world commands are actually blocked, meaning it doesn't get in the way of actual work too often.
Policy Walls: Comes with 71 default policy walls.

The Reality Check

This isn't a magical "safety proof." It's a wall against known-dangerous patterns. If a command doesn't match a danger shape, it goes through. It should be used as a layer of defense alongside a sandbox, not as a replacement for one.

It's Apache-2.0 and has a zero-dependency core.