gate.cat is an action-veto tool for AI coding agents, whose core goal is deterministic interception before an agent performs an irreversible operation. It is designed to be fail-closed, meaning that when the engine is missing or errors it chooses to block rather than allow, and the veto path does not depend on any LLM, so it is model-agnostic.
Purpose
This tool is used to protect environments that are irreversible once something goes wrong, such as development laptops containing real data, deployment pipelines, production environments, and paid infrastructure. In disposable CI/sandbox containers that will be discarded, because there are no irreversible operations, gate.cat automatically disarms itself and logs a no-op instead of producing a false positive. It achieves this behavior by automatically detecting CI markers, and can also be forced to remain armed via GATECAT_VETO_EPHEMERAL=0. The author claims an intervention rate of about 0.6% measured on 14.7k real Claude Code commands and a public corpus of 8.6k SWE-agent commands.
Main capabilities
- Blocks irreversible shell command patterns, such as rm -rf, DROP TABLE, terraform destroy, gh repo delete, etc. By default it includes 71 policies (51 blocks, 20 warnings) targeting irreversible action categories.
- Intercepts installation one-liners in READMEs (such as the curl … | sh pattern), but obfuscated/base64-encoded installation tricks may still bypass it.
- gate.cat why "<command>" can print the actual verdict, with rule names such as RM_RF, DISK_DESTROY, ENCODED_EXEC, DB_DESTRUCTIVE; commands not on the deny list are marked as unchecked, not safe.
- Positions itself as a string gate rather than a sandbox: it reads commands, but does not isolate processes.
- Provides stagnation detection (StateStagnationDetector), used to discover situations where an agent is in a loop of safe commands but is making no progress, such as repeated operations, no state change, repeated errors, and cost consumption with no progress. This detection is advisory.
- Provides the Truth Pipeline (koryto → gate → veto) verification engine, combining deterministic checks (exec/calc/lookup) with sample distributionUncertainty signals, giving confirmed / refuted / uncertain / unchecked verdicts, based on which veto.py blocks, pauses, or asks a human before a tool call is executed.
- Comes with semantic caching and Cache-Augmented Synthesis (CAS) as supporting engines, and can serve as a drop-in replacement wrapper for the OpenAI/Anthropic SDK, providing three layers of responses: verbatim cache, synthesis, and upstream.
How to Use
Installation methods include a user-level installer, or a manual venv path: python3 -m venv .venv && .venv/bin/python -m pip install gate.cat. The distribution name is gate.cat (PyPI also accepts the normalized spelling gate-cat), and the import module is gatecat. 0.2.x uses import cacheback, see MIGRATION.md for details.
Main modes:
- Hook (strongest mode): register gatecat-hook as Claude Code's PreToolUse hook, add the configuration in .claude/settings.json, no need to edit absolute paths. Tool calls cannot be executed before the gate returns.
- Controlled shell: gatecat-shell sits at the execution point of sh -c "<command>", point the agent's shell to it, and all commands are reviewed by the same deterministic engine before execution. The real shell is /bin/sh, and it can be changed via GATECAT_SHELL_REAL=/bin/bash. Commands are passed through byte for byte. Acting as the agent shell binary (-c mode) is enforcement outside of model control; the --install-bash DEBUG trap is weaker, and commands within the session can be removed via trap - DEBUG.
- Framework adapters: provides crewAI / LangGraph adapters, as well as the framework-agnostic guard_callable, which can wrap any ordinary callable object (AutoGen and others go this route). These are all in-process conventions, and prompt injection can bypass them; only the hook is enforcement that the agent cannot skip.
- Proxy mode: can serve as a local OpenAI API proxy, covering Ollama / NIM / OpenRouter / vLLM / LM Studio.
Applicable Scenarios
Suitable for any agent that uses tools, including Claude Code, Codex, Cursor, crewAI/LangGraph applications, and local 7-30B models running on Ollama/vLLM. The Truth Pipeline's uncertainty signals perform strongest on small/cheap models (AUC 0.77–0.90, N=4800), and the signal weakens on frontier models (AUC 0.68–0.71); but action vetoing itself is independent of model scale.
Limitations and Boundaries
The gate is only deterministic about what it blocks; unmatched actions are unchecked, not safe. It does not guarantee correctness, and only provides uncertainty signals for pausing/escalating. Prompt injection can bypass in-process adapters. Obfuscated installation tricks can still bypass it. It automatically disarms itself in one-off CI/sandboxes.
Pricing
The local gate is free forever, with no rate limits. The paid tier gate.cat Cloud is optional and off by default: Solo €19/month, Team €149/month flat (up to 10 machines), Business €399/month, one-time €29 policy pack (Fintech, PaaS, HTTP-API Breadth). Blocking functionality does not depend on payment. Team plans provide shared off-machine veto history, fleet alerts, and signed policy sync. Partner plans provide a 30% recurring commission.
Not Yet Provided
Regarding platform compatibility details not explicitly stated in the official text, the complete contents of the specific policy list, and the full functional boundaries of the Cloud tier, this article does not provide more information for now.
