BGMLAI

Gate.Cat — AI skill for Claude Code

AI community

Block irreversible AI-agent actions before they run — deterministic, fail-closed action veto for Claude Code, Codex, Cursor, and other tool-using agents.

How to install Gate.Cat

This entry records only its repository, not the path inside it, so there is no exact command to give. Open BGMLAI/gate.cat and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Gate.Cat does

Block irreversible AI-agent actions before they run — deterministic, fail-closed action veto for Claude Code, Codex, Cursor, and other tool-using agents.

Alternatives in AI

Kibitz — Real-time decoded feed of AI agent actions — monitor multiple Claude Code & Codex sessions, see exactly what e 521 ★
Hol Guard — Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, M 485 ★
AI Review Local — Run AI code review locally using Codex CLI or OpenAI API before opening a PR 387 ★

README

gate.cat

**Install:** run the user-local installer below — it creates a private venv and works on PEP 668 systems too:
curl -fsSL https://raw.githubusercontent.com/BGMLAI/gate.cat/master/install.sh -o /tmp/gatecat-install.sh
sh /tmp/gatecat-install.sh
Or use the manual venv path: `python3 -m venv .venv && .venv/bin/python -m pip install gate.cat`.
from gatecat import check_action                     # deny-list gate
check_action("agent", "terraform destroy -auto-approve")  # -> raises ActionVetoed
The distribution is `gate.cat` (PyPI also accepts the normalized spelling `gate-cat`); the import module is `gatecat`. 0.2.x used `import cacheback` — see `MIGRATION.md`. Honest line, up front: the gate is certain only about what it **blocks**. An action it does not match is *unchecked*, not *safe*.

**Scope — persistent environments.** gate.cat guards places where a mistake is *irreversible*: a dev laptop with real data, a deploy pipeline, prod, paid infra. In a throwaway CI/sandbox container (a fresh git checkout that gets discarded) nothing is irreversible, so the gate **disarms itself** and logs a `disarmed` no-op rather than crying wolf. It auto-detects CI markers; `GATECAT_VETO_EPHEMERAL=0` forces it armed anyway. Measured on 14.7k real Claude Code commands *and* a public HF corpus of 8.6k SWE-agent commands, it intervenes on **~0.6% of commands on both** — the deny-list found something structural, not tuned to one user.

**Stop your AI agent before it takes an irreversible action.** The action-veto is **deterministic and model-agnostic** — a deny-list + exec-check + human-in-the-loop that inspects the *tool call* at the boundary, so it protects any agent the same way: a Claude Code hook (frontier), a crewAI/LangGraph app, or a local 7-30B model on Ollama/vLLM. `TruthPipeline` adds an honest verdict (confirmed / refuted / uncertain / unchecked) using deterministic checks (exec/calc/lookup) pl