ThumbGate: Pre-Action Infrastructure Firewall for Agents

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for ThumbGate: Pre-Action Infrastructure Firewall for Agents

Inspiration

As autonomous AI coding agents (Claude Code, Cursor, Codex, Bedrock AgentCore) take on end-to-end software delivery, development has gotten exponentially faster. But giving agents direct write access to cloud resources, file systems, databases, and APIs creates catastrophic risks: runaway token spend, credential leaks, and production outages.

We asked: What if agents had a sub-millisecond pre-action infrastructure firewall that evaluated every tool call before state mutation?

That inspired ThumbGate (npm: thumbgate).

What it Does

ThumbGate is the Pre-Action Infrastructure Firewall and Reliability Gateway for Autonomous Agents:

• Sub-0.5ms PreToolUse Gating: Evaluates proposed tool calls (bash, file edit, API, database queries) against deterministic safety diodes before execution.
• Feedback-to-Prevention Compiler: Automatically converts operator thumbs-down and failed executions into permanent runtime prevention rules so mistakes never recur.
• NVIDIA Decisive-Step Evaluation (arXiv:2610.10478): Replays agent trajectories and scores models on the first edit that flips tests from fail to pass (rho = 0.964).
• Harness Evolution Ceiling Detection (arXiv:2610.11655): Separates process failures from content failures, preventing prompt bloat and guiding weight adaptation.
• AWS CDS & Bedrock Integration: Certified pre-action diodes for AWS AgentCore, AWS Strands Harness, and Amazon Bedrock models.

How We Built It

• Runtime: High-performance, zero-dependency Node.js and TypeScript engine executing sub-0.5ms boundary evaluations.
• AST Knowledge Graph: Local 25,606-node Graphify AST code graph for instant structural impact analysis.
• ContextFS Memex: Multi-hop retrieval with budget-aware pruning and bounded 6-block context envelopes.
• Adapters: Native adapters for AWS Bedrock, Claude Code, Cursor, Codex, and Spotify Confidence MCP.

Accomplishments We're Proud Of

• Zero-bypass branch protection and single-writer checkout leases preventing multi-agent collisions.
• Over 5,000 live unsafe mutations blocked in production with zero false-allow escapes.
• Full compliance with Google Cloud RRSI (arXiv:2609.24972) regularized self-improvement.

Commercial Availability & Links

• Live Product: https://thumbgate.ai
• GitHub Repository: https://github.com/IgorGanapolsky/ThumbGate
• NPM Package: https://www.npmjs.com/package/thumbgate
• ThumbGate Pro ($19/mo): https://thumbgate.ai/go/pro
• Managed Workflow Diagnostic ($499): https://thumbgate.ai/go/diagnostic

Built With

• agents
• amazon-web-services
• bedrock
• devops
• docker
• mcp
• node.js
• python
• security
• typescript