{
  "markdown": "# ThumbGate 👍 👎\n\n<p align=\"center\">\n  <a href=\"https://thumbgate.ai\">\n    <img src=\"docs/media/thumbgate-hero-banner.svg\" alt=\"ThumbGate Infrastructure Firewall with Thumbs Up and Thumbs Down\" width=\"100%\" />\n  </a>\n</p>\n\n<p align=\"center\">\n  <b>ThumbGate is the self-improving pre-action firewall for AI coding agents</b><br>\n  AI coding agents repeat mistakes — and one wrong tool call can wipe a directory, leak a key, or push broken code.\n</p>\n\n<p align=\"center\">\n  <a href=\"https://mcptoplist.com/server/glama%2FIgorGanapolsky%2FThumbGate\"><img src=\"https://mcptoplist.com/badge/glama%2FIgorGanapolsky%2FThumbGate.svg\" alt=\"MCP Toplist\" /></a>\n  <a href=\"https://github.com/IgorGanapolsky/ThumbGate/actions/workflows/ci.yml\"><img src=\"https://github.com/IgorGanapolsky/ThumbGate/actions/workflows/ci.yml/badge.svg\" alt=\"CI\" /></a>\n  <a href=\"https://www.npmjs.com/package/thumbgate\"><img src=\"https://img.shields.io/npm/v/thumbgate\" alt=\"npm version\" /></a>\n  <a href=\"https://www.npmjs.com/package/thumbgate\"><img src=\"https://img.shields.io/npm/dw/thumbgate\" alt=\"npm weekly downloads\" /></a>\n  <a href=\"https://github.com/IgorGanapolsky/ThumbGate\"><img src=\"https://img.shields.io/github/stars/IgorGanapolsky/ThumbGate\" alt=\"GitHub stars\" /></a>\n  <a href=\"https://github.com/marketplace/actions/thumbgate-agent-governance\"><img src=\"https://img.shields.io/badge/GitHub_Marketplace-ThumbGate_Agent_Governance-0969da\" alt=\"GitHub Marketplace: ThumbGate Agent Governance\" /></a>\n  <a href=\"LICENSE\"><img src=\"https://img.shields.io/badge/License-MIT-green.svg\" alt=\"License: MIT\" /></a>\n</p>\n\n<p align=\"center\">\n  <a href=\"#quick-start\"><img src=\"https://img.shields.io/badge/⚡_Quick_Start-npx_thumbgate_init-22d3ee?style=for-the-badge\" alt=\"Quick Start\" /></a>\n  <a href=\"https://thumbgate.ai/#demo?utm_source=github&utm_medium=readme\"><img src=\"https://img.shields.io/badge/🎬_Watch-90s_Demo-ff647c?style=for-the-badge\" alt=\"Watch Demo\" /></a>\n  <a href=\"https://thumbgate.ai/go/gpt?utm_source=github&utm_medium=readme\"><img src=\"https://img.shields.io/badge/💬_Try-ThumbGate_GPT-56e39f?style=for-the-badge\" alt=\"Try GPT\" /></a>\n  <a href=\"https://thumbgate.ai/checkout/pro?utm_source=github&utm_medium=readme\"><img src=\"https://img.shields.io/badge/💼_Pro-$19/mo-ffd166?style=for-the-badge\" alt=\"Pro Tier\" /></a>\n</p>\n\n---\n\n## What it does\n\nThumbGate is the local-first **Pre-Action Checks** engine for AI coding agents. It runs in the PreToolUse hook to evaluate the proposed tool call before execution — so costly mistakes can be caught before they happen.\n\nThumbGate GitHub star growth is measured with GitHub's privacy-safe [`GET /repos/{owner}/{repo}/stargazers/history`](https://docs.github.com/en/rest/activity/starring#get-repository-star-history) endpoint (weekly counts, no stargazer identities). Run `npm run stars:history -- --fixture tests/fixtures/github-star-history.json --json` for the local proof. Stars are not npm installs and not revenue. The live GitHub Marketplace Action is [ThumbGate Agent Governance](https://github.com/marketplace/actions/thumbgate-agent-governance) (`uses: IgorGanapolsky/ThumbGate@v1`).\n\n**Usage over star count.** Evaluate ThumbGate from the install path and live usage badges above (`npx thumbgate init`, Marketplace `uses:`, npm weekly downloads, GitHub clones), not from whether the repo has twenty stars or twenty thousand. No pitch deck is required. We do not farm GitHub profile badges (no YOLO-merge of protected `main`, no 5-minute Issue close theater, no fake `Co-authored-by`). Galaxy Brain needs real accepted answers in [Discussions Q&A](https://github.com/IgorGanapolsky/ThumbGate/discussions/categories/q-a). `npm run github:achievements -- --fixture tests/fixtures/github-achievements.json --json` inventories what is already earned vs what we refuse to farm.\n\n### Who it's for\n\nThumbGate is for operators whose AI coding agents can leak a secret or destroy a checkout before a human sees the tool call (Claude Code, Cursor, Codex, Gemini CLI, MCP). Discovery should reach those operators — not a star campaign.\n\nThumbGate is **not** a GitHub star package, not fake engagement, and not a substitute for npm installs or merged PRs. Real engagement is `npx thumbgate init` and a PreToolUse hook that actually fires.\n\n### Tech memes (shareable)\n\nLightweight visuals for how agents fail without a pre-action gate:\n\n| Meme | Meaning |\n|------|---------|\n| ![Agent destroys prod without a gate](docs/media/meme-agent-destroys-prod.svg) | Unchecked tool calls ship destructive commands. |\n| ![Prompt vs PreToolUse hook](docs/media/meme-prompt-vs-hook.svg) | A prompt is advice; a PreToolUse hook is enforcement. |\n\n\n\nIt **hard-blocks detected secret leaks and two direct self-disable command classes by default** — commands that terminate the ThumbGate gate process or enable its bypass environment override. Other high-risk classes (`rm -rf`, force-push, fetch-and-run, direct guardrail edits) **warn and log by default**. Set `THUMBGATE_STRICT_ENFORCEMENT=1` for strict enforcement (warnings become hard denies).\n\n| Verdict | Default behavior |\n|---------|------------------|\n| ⛔ **Hard-block** | Detected secret leaks; process-kill/environment-override self-disable |\n| 👎 **Warn + log** | `rm -rf`, `git push --force`, fetch-and-run, direct guardrail edits — **warn by default** |\n| 👍 **Allow** | Everything else |\n\n**Accepted feedback is stored as local lessons.** Repeated concrete failures can become prevention rules that promote from warnings to blocking gates. The firewall improves from operations without retraining the model. Prompt evaluation (`npx thumbgate eval`) turns accepted feedback into reusable eval cases and local proof reports.\n\n**Honest disclaimer:** ThumbGate does not update model weights. It intercepts tool calls at runtime. Local-first — no cloud required for the enforcement path.\n\nWorks with **Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode**, and other MCP agents.\n\n[![AI Agent without ThumbGate vs Agent guarded by ThumbGate](public/assets/diagrams/thumbgate-agent-meme.jpg)](https://thumbgate.ai/#demo?utm_source=github&utm_medium=readme_meme)\n\n```\n  Agent tries:   rm -rf tests/\n  ThumbGate:     👎 WARN + LOG — \"Never delete test directories\"\n                 Pattern matched: rm.*-rf.*tests\n                 Source: your thumbs-down from last Tuesday\n                 Strict mode: ⛔ DENY before tool execution\n```\n\n### Agentic development cycle fit\n\nAgentic development is becoming a loop: **Guide → Generate → Verify → Solve**. ThumbGate is the pre-action gate / pre-action boundary between generated intent and executed action.\n\n---\n\n## Quick Start\n\n> Want a phased walkthrough with a verify step at every stage? Follow the [Progressive Setup Guide](GUIDE.md).\n\nProgressive wiring — prove the pipe before you turn matching on. Empty dashboard is success.\n\n```bash\nnpx thumbgate init          # Phase 1: hooks only\nnpx thumbgate doctor        # verify: exits 0 only when PreToolUse hook is wired (hidden metric = hook install, not gate count)\nnpx thumbgate dashboard --open  # Phase 2: open local HTML; empty stats are OK\nnpx thumbgate capture --feedback=down --context=\"Never run DROP on production tables\" --what-went-wrong=\"agent proposed DROP\" --what-to-change=\"require review for DROP\"\n```\n\nLater `DROP` attempts in the same scope surface the check:\n\n```\n⚠️ Check fired: \"Never run DROP on production tables\"\n   Pattern: DROP.*production\n   Verdict: 👎 WARN + LOG   (⛔ BLOCK when THUMBGATE_STRICT_ENFORCEMENT=1)\n```\n\nNumbered configs: [`config/progressive/`](config/progressive/). Guide: [progressive wiring](https://thumbgate.ai/guides/progressive-wiring).\n\n### MCP / Glama / registry install (stdio)\n\nDirectories and clients that install ThumbGate as an MCP server must start **stdio MCP**, not the HTTP API:\n\n```bash\nnpx -y thumbgate serve\n```\n\n- Equivalent: `npx -y thumbgate mcp`\n- Do **not** use `npm start` for MCP — that launches the hosted HTTP API (`src/api/server.js`), not the agent-facing stdio server.\n\n[**▶ 90-second demo**](https://thumbgate.ai/#demo?utm_source=github&utm_medium=readme&utm_campaign=demo_video) · [GIF walkthrough](docs/media/thumbgate-demo.gif)\n\n---\n\n## Install for your agent\n\n| Agent | Command | Enforcement |\n|-------|---------|-------------|\n| **Claude Code** | `npx thumbgate init --agent claude-code` | 🛡️ Hard — PreToolUse |\n| **Codex** | `npx thumbgate init --agent codex` | 🛡️ Hard — `pre_tool_use` |\n| **Gemini CLI** | `npx thumbgate init --agent gemini` | 🛡️ Hard — PreToolUse |\n| **ForgeCode** | `npx thumbgate init --agent forge` | 🛡️ Hard — `pre_tool_use` |\n| **Cursor** | `npx thumbgate init --agent cursor` | 💬 Advisory — MCP `gate_check` |\n| **Cline** | `npx thumbgate init --agent cline` | 💬 Advisory — MCP + `.clinerules` |\n| **OpenCode** | `npx thumbgate init --agent opencode` | 💬 Advisory — MCP `gate_check` |\n| **Any MCP agent** | `npx thumbgate serve` | 💬 Advisory — MCP `gate_check` |\n| **Amp** | `npx thumbgate init --agent amp` | 📝 Feedback capture |\n| **GitHub Actions** | `uses: IgorGanapolsky/ThumbGate@v1` | 🩺 Marketplace Action — doctor / AI inventory in CI |\n\nPer-agent guides: [Claude/Codex bridge](plugins/claude-codex-bridge/README.md) · [Codex profile](plugins/codex-profile/README.md) · [Cursor](docs/CURSOR_PLUGIN_OPERATIONS.md) · [MCP setup](docs/MCP_AUTONOMOUS_SETUP.md)\n\n### Install scope: machine-wide vs per-project\n\n| Scope | Command | Settings | Lessons | Best for |\n|-------|---------|----------|---------|----------|\n| **Machine-wide** (default) | `npx thumbgate init` | `~/.claude/settings.json` | `~/.claude/memory/feedback/` | Solo operators — **same machine-local feedback store** across repos |\n| **Per-project** | `npx thumbgate init --project` | `<repo>/.claude/settings.json` | `<repo>/.claude/memory/feedback/` | Client / compliance — **separate dashboard** / isolated lessons per repo |\n\nBoth scopes write `mcpServers.thumbgate` plus PreToolUse / UserPromptSubmit / PostToolUse / SessionStart hooks. Machine-wide is the right default for most developers. Cross-repo blocking is not automatic: a lesson learned in one project only applies elsewhere when you share the store (machine-wide) or export/import lessons.\n\n**MCP tools (surface):** `gate_check` (read/evaluate proposed tool call), feedback capture + session tools (write), dashboard/stats (read). Destructive agent actions stay blocked/warned by PreToolUse — ThumbGate does not execute user shell commands for you.\n\n---\n\n## Discoverable slash-commands — the guardrail layer for spec-driven agents\n\nSpec-driven agent frameworks like **GSD** (get-shit-done) and **GitHub Spec Kit** plan and generate work. ThumbGate is the **guardrail layer for spec-driven agents**: it sits *after* the plan, on the boundary between a generated tool call and its execution — **alongside GSD / Spec-Kit, not instead of them**.\n\n`npx thumbgate init` installs these into your agent palette:\n\n| Command | What it does |\n|---------|--------------|\n| `/thumbgate-dashboard` | Open local project dashboard |\n| `/thumbgate-guard` | Turn last mistake into a hard prevention rule |\n| `/thumbgate-rules` | List active rules & lessons |\n| `/thumbgate-blocked` | Gate stats + enforcement matrix |\n| `/thumbgate-protect` | Branch governance + scoped approval |\n| `/thumbgate-doctor` | Health-check hooks, MCP, readiness |\n\n---\n\n## Pricing & buyer paths\n\nFree tier: **2 feedback captures/day (10 total)** and **up to 3 active auto-promoted prevention rules**. Pro ($19/mo or $149/yr) is the individual tier for unlimited rules, history-aware lessons, linked feedback session flow, personal dashboard, and DPO export. **Enterprise is custom and scoped after intake**; hosted team lesson sync and a hosted org dashboard are not general availability.\n\n| | Free | Pro ($19/mo or $149/yr) | Enterprise |\n|---|---|---|---|\n| Local CLI + PreToolUse | ✅ | ✅ | Scoped after intake |\n| Feedback captures | 2 feedback captures/day (10 total) | Unlimited | Scoped after intake |\n| Active auto-promoted rules | up to 3 active auto-promoted prevention rules | Unlimited | Scoped after intake |\n| Personal dashboard + DPO export | — | ✅ | Reviewed during intake |\n| Hosted team lesson sync | — | — | Not general availability |\n| Hosted org dashboard | — | — | Not general availability |\n\n**Enterprise intake path:** the **Workflow Hardening Sprint** scopes one repeated failure before any broader rollout commitment. **[Start intake →](https://thumbgate.ai/?utm_source=github&utm_medium=readme&utm_campaign=team_rollout#workflow-sprint-intake)**\n\n**Local technical path:** install the CLI and use `init` plus the documented setup so Pre-Action Checks evaluate tool calls where the agent actually runs.\n\n**First-dollar activation path:** open the [ThumbGate GPT](https://thumbgate.ai/go/gpt?utm_source=github&utm_medium=readme), paste the risky action, capture typed feedback (`thumbs down:` / `thumbs up:`). **Native ChatGPT rating buttons are not the ThumbGate capture path.** Ask: **what repeated AI mistake would be worth catching before the tool executes?**\n\n**Paid path for individual operators:** [ThumbGate Pro](https://thumbgate.ai/checkout/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page) is the self-serve side lane for a personal dashboard and export-ready evidence.\n\n[**Start free**](https://thumbgate.ai/?utm_source=github&utm_medium=readme) · [**Pro $19/mo**](https://thumbgate.ai/checkout/pro?utm_source=github&utm_medium=readme) · [**Live Dashboard**](https://thumbgate.ai/dashboard?utm_source=github&utm_medium=readme) · [**Team Sprint intake**](https://thumbgate.ai/?utm_source=github&utm_medium=readme#workflow-sprint-intake) · [**Workflow Hardening Sprint**](https://thumbgate.ai/?utm_source=github&utm_medium=readme&utm_campaign=top_cta#workflow-sprint-intake) · [**First Dollar Playbook**](docs/FIRST_DOLLAR_PLAYBOOK.md)\n\n**Popular buyer questions:** **[AI search topical presence](https://thumbgate.ai/guides/ai-search-topical-presence?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Relational knowledge and AI recommendations](https://thumbgate.ai/guides/relational-knowledge-ai-recommendations?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[AI Mode ads for agent governance](https://thumbgate.ai/guides/ai-mode-ads-agent-governance?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[MCP tool governance](https://thumbgate.ai/guides/mcp-tool-governance?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[AI agent pre-action approval gates](https://thumbgate.ai/guides/ai-agent-pre-action-approval-gates?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Background agent governance](https://thumbgate.ai/guides/background-agent-governance?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[GPT-5.5 model evaluation](https://thumbgate.ai/guides/gpt-5-5-model-evaluation?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Stop repeated AI agent mistakes](https://thumbgate.ai/guides/stop-repeated-ai-agent-mistakes?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Browser automation safety](https://thumbgate.ai/guides/browser-automation-safety?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Native messaging host security](https://thumbgate.ai/guides/native-messaging-host-security?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Autoresearch agent safety](https://thumbgate.ai/guides/autoresearch-agent-safety?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Cursor guardrails](https://thumbgate.ai/guides/cursor-agent-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Codex CLI guardrails](https://thumbgate.ai/guides/codex-cli-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Gemini CLI memory + enforcement](https://thumbgate.ai/guides/gemini-cli-feedback-memory?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Google Cloud MCP guardrails](https://thumbgate.ai/guides/gcp-mcp-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Roo Code alternative: migrate to Cline](https://thumbgate.ai/guides/roo-code-alternative-cline?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)**\n\n---\n\n## How it works (short)\n\n1. **Capture** 👍/👎 feedback (CLI, MCP, linked feedback session flow / `open_feedback_session`, or [ThumbGate GPT](https://thumbgate.ai/go/gpt?utm_source=github&utm_medium=readme))\n2. **Promote** concrete lessons via history-aware lesson distillation into prevention rules\n3. **Evaluate** the next proposed tool call against active rules (literal/AST + local vectors)\n4. **Allow / warn / deny** before the tool runs\n\n```bash\nnpx thumbgate brain --write   # → .thumbgate/BRAIN.md (lessons + gates in one artifact)\n```\n\nPro operators can invoke `search_lessons` through MCP and use `npx thumbgate lessons` from the CLI. History-aware feedback sessions and lesson search are Pro capabilities; Free does not include recall or search.\n\n<details>\n<summary><b>Architecture diagram & stack</b></summary>\n\n[![ThumbGate Architecture](docs/diagrams/thumbgate_architecture.png)](https://thumbgate.ai/#how-it-works)\n\n```mermaid\nflowchart LR\n    A[\"Agent tool call\"] --> B{\"Rule match?\"}\n    B -- exact --> D[\"On-device gate\"]\n    B -- semantic --> C[\"Local LanceDB\"]\n    C --> D\n    D -- secret/kill --> E[\"⛔ Hard-block\"]\n    D -- known-bad --> G[\"👎 Warn + log\"]\n    D -- safe --> F[\"👍 Allow\"]\n```\n\n</details>\n\n<details>\n<summary><b>Built-in checks</b></summary>\n\n```\n⛔ secret-exfiltration → hard-block (default)\n⛔ self-protect-kill   → hard-block (default)\n⛔ self-protect-env    → hard-block (default)\n⚠️ force-push          → warn; hard-block under strict\n⚠️ protected-branch    → warn; hard-block under strict\n⚠️ unresolved-threads  → warn; hard-block under strict\n⚠️ package-lock-reset  → warn; hard-block under strict\n```\n\n</details>\n\n<details>\n<summary><b>CLI cheatsheet</b></summary>\n\n```bash\nnpx thumbgate init\nnpx thumbgate doctor\nnpx thumbgate capture up|down \"<text>\"\nnpx thumbgate lessons\nnpx thumbgate brain --write\nnpx thumbgate dashboard --open\nnpx thumbgate break-glass --reason=\"ThumbGate over-fired\"   # 5-min recovery\n```\n\n</details>\n\n<details>\n<summary><b>Pro: lesson + DPO export</b></summary>\n\n```bash\n# Portable lessons\ncurl -X POST http://localhost:3456/v1/lessons/export \\\n  -H \"Authorization: Bearer $THUMBGATE_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"outputPath\": \"./lessons-export.json\"}'\n\n# DPO pairs for fine-tuning\ncurl -X POST http://localhost:3456/v1/dpo/export \\\n  -H \"Authorization: Bearer $THUMBGATE_API_KEY\" \\\n  -o dpo-pairs.jsonl\n```\n\n</details>\n\n---\n\n## Tech Stack\n\n| Layer | Tech |\n|-------|------|\n| **Runtime** | Node.js ≥18 |\n| **Interfaces** | MCP stdio, HTTP API, CLI |\n| **Storage** | SQLite + FTS5, LanceDB vectors, JSONL logs |\n| **Intelligence** | MemAlign dual recall, Thompson Sampling, local embeddings |\n| **Billing / host** | Stripe, Railway |\n| **Execution** | Railway, Cloudflare Workers, Docker Sandboxes |\n| **Governance** | Workflow Sentinel, control plane, Docker Sandboxes |\n\nEvery Changeset is tied to the exact `main` merge commit and generates Verification Evidence for Release Confidence.\n\n---\n\n## Integrations (compact)\n\n| Surface | Start here |\n|---------|------------|\n| **Open ThumbGate GPT** | [thumbgate.ai/go/gpt](https://thumbgate.ai/go/gpt?utm_source=github&utm_medium=readme&utm_campaign=readme_gpt) — **ThumbGate GPT: start here.** Paste agent actions, get advice + checkpointing. **No, users do not have to keep chatting inside the ThumbGate GPT to use ThumbGate** — the **hard enforcement layer still runs where the work happens**. |\n| **Install Codex Plugin** | Open the Codex plugin install page: [thumbgate.ai/codex-plugin](https://thumbgate.ai/codex-plugin) · zip: [thumbgate-codex-plugin.zip](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-codex-plugin.zip) · [plugins/codex-profile/INSTALL.md](plugins/codex-profile/INSTALL.md) |\n| Claude Desktop `.mcpb` | [latest release](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-claude-desktop.mcpb) |\n| **VS Code / Open VSX** | [plugins/vscode-extension/README.md](plugins/vscode-extension/README.md) |\n| **Antigravity-compatible** | [plugins/antigravity-extension/INSTALL.md](plugins/antigravity-extension/INSTALL.md) |\n| **JetBrains** | [plugins/jetbrains-plugin/README.md](plugins/jetbrains-plugin/README.md) · JetBrains Marketplace path for the same runtime |\n| ChatGPT App / GPT Action | [thumbgate.ai/chatgpt-app](https://thumbgate.ai/chatgpt-app) |\n| ThumbGate-Core (staging) | [https://github.com/IgorGanapolsky/ThumbGate-Core](https://github.com/IgorGanapolsky/ThumbGate-Core) — pre-release staging + a few internal cache scripts; **not** the product moat |\n\n## Docs\n\nFull index: **[docs/INDEX.md](docs/INDEX.md)**\n\n| Need | Link |\n|------|------|\n| Agent workflow contract | [WORKFLOW.md](WORKFLOW.md) |\n| Ready-for-agent intake | [.github/ISSUE_TEMPLATE/ready-for-agent.yml](.github/ISSUE_TEMPLATE/ready-for-agent.yml) |\n| Verification Evidence | [docs/VERIFICATION_EVIDENCE.md](docs/VERIFICATION_EVIDENCE.md) |\n| Release Confidence | [docs/RELEASE_CONFIDENCE.md](docs/RELEASE_CONFIDENCE.md) |\n| Changeset strategy | [docs/CHANGESET_STRATEGY.md](docs/CHANGESET_STRATEGY.md) |\n| First Dollar Playbook | [docs/FIRST_DOLLAR_PLAYBOOK.md](docs/FIRST_DOLLAR_PLAYBOOK.md) |\n| Security policy | [SECURITY.md](SECURITY.md) |\n| Threat model | [THREAT_MODEL.md](THREAT_MODEL.md) |\n| Federal / regulated | [docs/FEDERAL.md](docs/FEDERAL.md) |\n| Commercial Truth | [docs/COMMERCIAL_TRUTH.md](docs/COMMERCIAL_TRUTH.md) |\n| Issues / PRs | [GitHub Issues](https://github.com/IgorGanapolsky/ThumbGate/issues) · [PR template](.github/pull_request_template.md) |\n\n**FAQ (one-liners):** Not a fine-tuner (runtime intercept only). Different from `CLAUDE.md` / `.cursorrules` (those are context; ThumbGate is an external allow/warn/deny before tools run).\n\n---\n\n## Who builds this\n\n**Igor Ganapolsky** — payments (Stripe/Connect), AI agent guardrails/MCP, Android + backends. Small number of contract slots: **$120–150/hr, 1099, remote US**. [LinkedIn](https://www.linkedin.com/in/igor-ganapolsky-859317343/) · [thumbgate.ai](https://thumbgate.ai)\n\n## License\n\nMIT — see [LICENSE](LICENSE). Project policy: [SECURITY.md](SECURITY.md) · [THREAT_MODEL.md](THREAT_MODEL.md).\n",
  "bytes": 22649,
  "sha": "7103622add5ca95f9ae3a5196565d4097f7128209203f44bb6dbc9b43af71077",
  "repo_slug": "igorganapolsky/thumbgate",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_igorganapolsky_thumbgate_thumbgate_fa652f2c/readme"
}