MCP Memory Gateway (rlhf-feedback-loop)

Local-first RLHF feedback loop for AI agents — capture preference signals, promote memories, block repeated mistakes, export DPO/KTO training pairs

Self-improving pre-action firewall for AI coding agents
AI coding agents repeat mistakes — and one wrong tool call can wipe a directory, leak a key, or push broken code.

ThumbGate is the local-firstPre-Action Checksengine for AI coding agents. It runs in the PreToolUse hook to evaluate the proposed tool call before execution — so costly mistakes can be caught before they happen.

Lightweight visuals for how agents fail without a pre-action gate:

Ithard-blocks detected secret leaks and two direct self-disable command classes by default— commands that terminate the ThumbGate gate process or enable its bypass environment override. Other high-risk classes (rm -rf, force-push, fetch-and-run, direct guardrail edits)warn and log by default. SetTHUMBGATE_STRICT_ENFORCEMENT=1for strict enforcement (warnings become hard denies).

Accepted feedback is stored as local lessons.Repeated concrete failures can become prevention rules that promote from warnings to blocking gates. The firewall improves from operations without retraining the model. Prompt evaluation (npx thumbgate eval) turns accepted feedback into reusable eval cases and local proof reports.

Honest disclaimer:ThumbGate does not update model weights. It intercepts tool calls at runtime. Local-first — no cloud required for the enforcement path.

Works withClaude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and other MCP agents.

Agent tries: rm -rf tests/ ThumbGate: 👎 WARN + LOG — "Never delete test directories" Pattern matched: rm.-rf.tests Source: your thumbs-down from last Tuesday Strict mode: ⛔ DENY before tool execution

Agentic development is becoming a loop:Guide → Generate → Verify → Solve. ThumbGate is the pre-action gate / pre-action boundary between generated intent and executed action.

Want a phased walkthrough with a verify step at every stage? Follow theProgressive Setup Guide.

npx thumbgate init # Phase 1: hooks only npx thumbgate doctor # verify: exits 0 only when PreToolUse hook is wired (hidden metric = hook install, not gate count) npx thumbgate dashboard --open # Phase 2: open local HTML; empty stats are OK npx thumbgate capture --feedback=down --context="Never run DROP on production tables" --what-went-wrong="agent proposed DROP" --what-to-change="require review for DROP"

⚠️ Check fired: "Never run DROP on production tables" Pattern: DROP.production Verdict: 👎 WARN + LOG (⛔ BLOCK when THUMBGATE_STRICT_ENFORCEMENT=1)

Enterprise intake path:theWorkflow Hardening Sprintscopes one repeated failure before any broader rollout commitment.Start intake →

First-dollar activation path:open theThumbGate GPT, paste the risky action, capture typed feedback (thumbs down:/thumbs up:).Native ChatGPT rating buttons are not the ThumbGate capture path.Ask:what repeated AI mistake would be worth catching before the tool executes?

Paid path for individual operators:ThumbGate Prois the self-serve side lane for a personal dashboard and export-ready evidence.

Start free·Pro $19/mo·Live Dashboard·Team Sprint intake·Workflow Hardening Sprint·First Dollar Playbook

Popular buyer questions:AI search topical presence·Relational knowledge and AI recommendations·AI Mode ads for agent governance·MCP tool governance·AI agent pre-action approval gates·Background agent governance·GPT-5.5 model evaluation·Stop repeated AI agent mistakes·Browser automation safety·Native messaging host security·Autoresearch agent safety·Cursor guardrails·Codex CLI guardrails·Gemini CLI memory + enforcement·Google Cloud MCP guardrails·Roo Code alternative: migrate to Cline
- Capture👍/👎 feedback (CLI, MCP, linked feedback session flow /open_feedback_session, orThumbGate GPT)
- Promoteconcrete lessons via history-aware lesson distillation into prevention rules
- Evaluatethe next proposed tool call against active rules (literal/AST + local vectors)
- Allow / warn / denybefore the tool runs

npx thumbgate brain --write # → .thumbgate/BRAIN.md (lessons + gates in one artifact)

flowchart LR A["Agent tool call"] --> B{"Rule match?"} B -- exact --> D["On-device gate"] B -- semantic --> C["Local LanceDB"] C --> D D -- secret/kill --> E["⛔ Hard-block"] D -- known-bad --> G["👎 Warn + log"] D -- safe --> F["👍 Allow"]

⛔ secret-exfiltration → hard-block (default) ⛔ self-protect-kill → hard-block (default) ⛔ self-protect-env → hard-block (default) ⚠️ force-push → warn; hard-block under strict ⚠️ protected-branch → warn; hard-block under strict ⚠️ unresolved-threads → warn; hard-block under strict ⚠️ package-lock-reset → warn; hard-block under strict

npx thumbgate init npx thumbgate doctor npx thumbgate capture up|down "<text>" npx thumbgate lessons npx thumbgate brain --write npx thumbgate dashboard --open npx thumbgate break-glass --reason="ThumbGate over-fired" # 5-min recovery

# Portable lessons curl -X POST http://localhost:3456/v1/lessons/export \ -H "Authorization: Bearer $THUMBGATE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"outputPath": "./lessons-export.json"}' # DPO pairs for fine-tuning curl -X POST http://localhost:3456/v1/dpo/export \ -H "Authorization: Bearer $THUMBGATE_API_KEY" \ -o dpo-pairs.jsonl

Every Changeset is tied to the exactmainmerge commit and generates Verification Evidence for Release Confidence.

FAQ (one-liners):Not a fine-tuner (runtime intercept only). Different fromCLAUDE.md/.cursorrules(those are context; ThumbGate is an external allow/warn/deny before tools run).

Igor Ganapolsky— payments (Stripe/Connect), AI agent guardrails/MCP, Android + backends. Small number of contract slots:$120–150/hr, 1099, remote US.LinkedIn·thumbgate.ai

MIT — seeLICENSE. Project policy:SECURITY.md·THREAT_MODEL.md.

A framework for developing LLM applications with capabilities like tool usage, planning, and memory, based on the Qwen model.