What it does
gate.cat checks the tool calls an AI agent is about to make and blocks irreversible ones, such as deleting a project under a protected folder, dropping a database table or destroying infrastructure. The decision uses a deterministic deny-list and checks rather than a model, and it fails closed: if the engine errors, the action is blocked. The page is candid that an action it does not match is unchecked, not safe. It can be applied in three ways. A hook for Claude Code runs before each tool call and is described as the strongest mode. A gated shell, gatecat-shell, sits where any agent runs shell commands. A local proxy for OpenAI-compatible APIs inspects tool calls from models served through tools such as Ollama, vLLM or OpenRouter. Adapters for crewAI, LangGraph and AutoGen are described as weaker, in-process options. It is a Python package installed with pip. The page also describes extras: a semantic cache that wraps the OpenAI and Anthropic SDKs, a pipeline that returns verdicts on answers, and a detector for agents that are busy but making no progress. In throwaway CI or sandbox containers the gate disarms itself by default. The code is under the Apache License 2.0. The local gate is free; gate.cat Cloud is a paid layer that keeps a copy of your veto history off the machine, so an agent with shell access cannot delete it.
Capabilities
- Deterministic deny-list that blocks irreversible shell commands
- Claude Code hook, gated shell and local proxy modes
- Fails closed when the engine errors
- Disarms itself in throwaway CI or sandbox containers
- Adapters for crewAI, LangGraph and AutoGen
- Optional semantic cache and loop detection
When to use it
- An agent has shell access on a machine with real data, production access or paid infrastructure
- You run local models through Ollama or vLLM and want a guard in front of their tool calls
- You want a record of blocked actions stored off the machine
