MCP.Market

ThumbGate MCP server

by IgorGanapolsky·io.github.IgorGanapolsky/thumbgate·v1.27.17·27 stars
No reviews yet

Pre-action gates that block AI agents from repeating known mistakes.

C58/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C58/100

full report

Adoption
Established

27 stars806 downloads/wk

Reviews

Write one

Nobody has reviewed ThumbGate yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

ThumbGate tools (5, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • dashboard

    Review feedback, gates, blocked actions, funnel metrics, and proof.

  • execwrite action

    Run shell commands

  • guide

    Install ThumbGate for Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and MCP agents.

  • lessons

    Browse promoted lessons and corrective actions.

  • workflow-sprint-intakewrite action

    Submit a repeated agent failure for a proof-backed sprint.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

1 high2 medium
  • Code scan56 source files scanned3/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (3)

  • mediumnpm install lifecycle script presentinstall.script
  • highShell command built from a string (injection risk)exec.shell-concat
    bin/cli.js: … } function whichExists(cmd) { try { execSync(`which ${cmd}`, { stdio: 'pipe' }); return true; …
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …md", "src/" ], "scripts": { "postinstall": "node bin/postinstall.js || true", …
Overall 58/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How ThumbGate compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
58/100
higher than 13% of 48,255 servers
Tools
5
the typical server has 7
Tools that change things
40%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
27
more than 91% of 28,688 servers
Downloads a week
806
more than 93% of 12,191 servers with a package

What its tools let an agent do: 3 read · 1 change · 1 run or deploy

Install ThumbGate in Claude Code, Cursor or VS Code

Runs npx -y thumbgate on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add thumbgate -- npx -y thumbgate
Add to Cursor

What the publisher says

From the ThumbGate repository's README, as published. We do not edit it. Read it on GitHub

ThumbGate 👍 👎

ThumbGate is the self-improving pre-action firewall for AI coding agents AI coding agents repeat mistakes — and one wrong tool call can wipe a directory, leak a key, or push broken code.

What it does

ThumbGate is the local-first Pre-Action Checks engine for AI coding agents. It runs in the PreToolUse hook to evaluate the proposed tool call before execution — so costly mistakes can be caught before they happen.

ThumbGate GitHub star growth is measured with GitHub's privacy-safe GET /repos/{owner}/{repo}/stargazers/history endpoint (weekly counts, no stargazer identities). Run npm run stars:history -- --fixture tests/fixtures/github-star-history.json --json for the local proof. Stars are not npm installs and not revenue. The live GitHub Marketplace Action is ThumbGate Agent Governance (uses: IgorGanapolsky/ThumbGate@v1).

Usage over star count. Evaluate ThumbGate from the install path and live usage badges above (npx thumbgate init, Marketplace uses:, npm weekly downloads, GitHub clones), not from whether the repo has twenty stars or twenty thousand. No pitch deck is required. We do not farm GitHub profile badges (no YOLO-merge of protected main, no 5-minute Issue close theater, no fake Co-authored-by). Galaxy Brain needs real accepted answers in Discussions Q&A. npm run github:achievements -- --fixture tests/fixtures/github-achievements.json --json inventories what is already earned vs what we refuse to farm.

Who it's for

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

ThumbGate: common questions

Is ThumbGate MCP server safe?
With care: it is graded C, so read the findings first (58/100). Read the ThumbGate safety report
How do I install ThumbGate?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does ThumbGate need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is ThumbGate maintained?
The last commit was 42 days ago (2026-09-23). The latest release is v1.27.17.
How does ThumbGate compare with other MCP servers?
safety score 58/100 (higher than 13% of 48,255 servers); tools 5 (the typical server has 7); tools that change things 40% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from IgorGanapolsky →