igorganapolsky/thumbgate
.claude/skills/thumbgate/SKILL.md
Pre-action gates for AI agents - capture feedback, generate prevention rules, block known-bad patterns. Use for setup, feedback capture, gate debugging, or DPO training data export.
$ install --global
skillsauthnpx skillsauth add igorganapolsky/rlhf-feedback-loop thumbgateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 3:09 PM8.8s3 files scanned
SKILL.md
- name:
- thumbgate
- description:
- Pre-action gates for AI agents - capture feedback, generate prevention rules, block known-bad patterns. Use for setup, feedback capture, gate debugging, or DPO training data export.
ThumbGate — Pre-Action Gates for AI Agents
ThumbGate turns thumbs-up/down feedback into hard enforcement gates that block known-bad agent actions before they execute. Think of it as an immune system for your AI agent.
npm package: thumbgate
Docs: https://github.com/IgorGanapolsky/ThumbGate
Quick Start
If ThumbGate is not yet installed in this project:
npx thumbgate init
This bootstraps .thumbgate/ data directory and .mcp.json config. Works with
Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent.
Core Commands
Capture feedback
When an agent action succeeds or fails, capture it:
# Thumbs down — something went wrong
node .claude/scripts/feedback/capture-feedback.js \
--feedback=down \
--context="what happened" \
--what-went-wrong="specific failure" \
--what-to-change="specific fix" \
--tags="tag1,tag2"
# Thumbs up — something worked
node .claude/scripts/feedback/capture-feedback.js \
--feedback=up \
--context="what happened" \
--what-worked="specific thing that worked" \
--tags="tag1,tag2"
View active gates and rules
npm run feedback:rules # Show prevention rules generated from feedback
npm run feedback:stats # Feedback counts by signal, domain, importance
npm run feedback:summary # Aggregated summary of all feedback
Check system health
npm run self-heal:check # Verify 4/4 subsystems healthy
Export training data (Pro)
npm run feedback:export:dpo # Export DPO preference pairs for fine-tuning
How Gates Work
- Feedback — You give thumbs-up or thumbs-down on agent actions
- Rules — Repeated failures auto-promote into prevention rules via Thompson Sampling
- Gates — Rules become PreToolUse hooks that block the agent before it repeats the mistake
Gates are enforced via MCP PreToolUse hooks — the agent literally cannot execute a blocked action. This is hard enforcement, not a soft suggestion.
Architecture
| Component | What it does | |-----------|-------------| | SQLite+FTS5 lesson DB | Fast full-text search across all feedback | | Thompson Sampling | Adaptive gate sensitivity per failure domain | | LanceDB + HuggingFace | Local vector search for semantic similarity | | ContextFS | Hierarchical context assembly with semantic caching | | PreToolUse hooks | Hard enforcement — blocks before execution |
MCP Tools Available
When the MCP server is running, these tools are available to your agent:
| Tool | Purpose |
|------|---------|
| capture_feedback | Record thumbs-up/down on an agent action |
| search_lessons | Search past feedback by keyword, tag, or domain |
| recall | Retrieve relevant memories for current context |
| prevention_rules | View active prevention rules |
| gate_stats | See which gates are firing and their block rates |
| feedback_stats | Feedback counts and trends |
| export_dpo_pairs | Export DPO training pairs (Pro) |
| construct_context_pack | Build bounded context from feedback history |
Pro Features
Pro users ($19/mo or $149/yr) unlock:
- Visual gate debugger — see every blocked action and the gate that fired
- Multi-hop recall — chain related lessons across hops for deeper context
- Synthetic DPO augmentation — expand real feedback into larger training datasets
- Gate wiring support — help enforcing your riskiest flows in the first week
Team rollout ($49/seat/mo, 3-seat minimum after intake) adds the shared hosted lesson DB, org dashboard, approval boundaries, and proof-backed workflow hardening sprint.
Upgrade: https://buy.stripe.com/5kQ4gzbmI9Lo6tPayn3sI06
Detailed Reference
For setup guides per agent, see: <references/setup-guides.md> For gate configuration, see: <references/gate-config.md>
Related Skills
igorganapolsky/thumbgate-rules
tools
VerifiedTrustedCommunity
List the active ThumbGate prevention rules, reliability rules, and the promoted lessons behind them, so the user can see which guardrails are currently protecting this project and WHY each one exists. Reads the live rule and lesson stores via the prevention_rules, get_reliability_rules, and search_lessons MCP tools (CLI fallback `npx thumbgate rules`). Use when the user says "what is ThumbGate protecting me from", "show my rules", "show my gates", "what has the agent learned", "list active guardrails", or "what's blocked here". Do NOT use to CREATE a new rule (use the thumbgate-guard skill), to see runtime enforcement counts of what actually fired (use the thumbgate-blocked skill), or to diagnose whether ThumbGate is wired up at all (use the thumbgate-doctor skill).
23SKILL.mdUpdated Jun 12, 2026
igorganapolsky/thumbgate-protect
tools
VerifiedTrustedCommunity
Inspect this repo's branch and release governance (protected branches, release rules, protected-file globs) and, only when the user explicitly approves, grant a scoped, time-limited exception so a protected-file edit or publish can proceed under audit. Reads posture via the get_branch_governance MCP tool and records a narrow, expiring approval via the approve_protected_action MCP tool. Use when the user says "is main protected", "show branch governance", "what am I blocked from editing", "approve this protected change", or "let me edit a protected file just this once". Do NOT use to disable protection wholesale, to grant broad or standing exceptions, or to diagnose hook wiring (use the thumbgate-doctor skill) — this skill is for narrow, temporary, audited approvals only.
23SKILL.mdUpdated Jun 12, 2026
igorganapolsky/thumbgate-guard
tools
VerifiedTrustedCommunity
Turn the agent's most recent mistake into an enforced ThumbGate prevention rule (a PreToolUse block gate) so the same bad tool call is intercepted before it runs again, in this and every future session across Claude Code, Cursor, Codex, Gemini, Amp, and Cline. Captures the failure with the capture_feedback MCP tool, then force-promotes it via `npx thumbgate force-gate` so it is enforced, not just logged. Use when the user says "guard against this", "block this from happening again", "never do that again", "make that a rule", "stop the agent from repeating that", or right after a bad action or thumbs-down that should become a hard rule. Do NOT use to merely log a thumbs-up/down without enforcement (use the thumbgate-feedback skill), to recall prior context before starting work (use the Agent Memory skill), or to list rules that already exist (use the thumbgate-rules skill).
23SKILL.mdUpdated Jun 12, 2026
igorganapolsky/thumbgate-doctor
tools
VerifiedTrustedCommunity
Health-check whether ThumbGate is actually wired into this agent — PreToolUse/SessionStart hooks installed, MCP server reachable, lesson store present, statusline, and overall agent-readiness — then report exactly what to fix. Runs the existing `npx thumbgate doctor` audit and the check_operational_integrity MCP tool. Use when the user says "is ThumbGate wired up", "thumbgate doctor", "check my guardrails are installed", "why aren't my gates firing", "is the MCP server connected", or "agent readiness". Do NOT use to view rules (use the thumbgate-rules skill), to view what was blocked (use the thumbgate-blocked skill), or to capture a new rule (use the thumbgate-guard skill) — this skill only diagnoses setup and wiring.
23SKILL.mdUpdated Jun 12, 2026