DEV Community

Igor Ganapolsky
Igor Ganapolsky

Posted on

Shell is the screenshot risk. Checkout URLs are the quiet one.

Everyone demos blocking rm -rf.

Fewer people gate the agent that can open a payment URL.

The half-blast-radius problem

If your automation stack can shell out, fetch pages, or open browser URLs, "destructive command" is only half the blast radius. The other half is economic: checkout links, upgrade links, and spend surfaces that look like ordinary HTTP traffic until the card posts.

Why now

More teams are wiring coding agents to real tools — shell, MCP, SaaS APIs, sometimes payments — faster than they are wiring pre-exec policy. Prompt text that says "never spend money" is not a control plane.

What shipped

I just shipped ThumbGate 1.34.2 with a fail-closed financial hard floor:

  • Apollo upgrade and Stripe checkout URLs are treated as economic actions
  • Evaluated on Bash open / curl and WebFetch
  • Gate decision is local and deterministic on the enforcement path (no LLM call at block time)
  • One concrete thumbs-down becomes a Pre-Action Check before the tool runs
npx thumbgate init
Enter fullscreen mode Exit fullscreen mode

Open source · MIT · Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode.

Honest limits

Free tier has capture caps. Solo Pro is $19/mo for unlimited rules, history-aware lessons, personal dashboard, and DPO export. Hosted team sync is not claimed as GA.

Links

What spend surface would you hard-block first if your agent could hit it tonight?

Top comments (0)