Everyone demos blocking rm -rf.
Fewer people gate the agent that can open a payment URL.
The half-blast-radius problem
If your automation stack can shell out, fetch pages, or open browser URLs, "destructive command" is only half the blast radius. The other half is economic: checkout links, upgrade links, and spend surfaces that look like ordinary HTTP traffic until the card posts.
Why now
More teams are wiring coding agents to real tools — shell, MCP, SaaS APIs, sometimes payments — faster than they are wiring pre-exec policy. Prompt text that says "never spend money" is not a control plane.
What shipped
I just shipped ThumbGate 1.34.2 with a fail-closed financial hard floor:
- Apollo upgrade and Stripe checkout URLs are treated as economic actions
- Evaluated on Bash
open/curland WebFetch - Gate decision is local and deterministic on the enforcement path (no LLM call at block time)
- One concrete thumbs-down becomes a Pre-Action Check before the tool runs
npx thumbgate init
Open source · MIT · Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode.
Honest limits
Free tier has capture caps. Solo Pro is $19/mo for unlimited rules, history-aware lessons, personal dashboard, and DPO export. Hosted team sync is not claimed as GA.
Links
- Browser control plane: thumbgate.app
- Repo: github.com/IgorGanapolsky/ThumbGate
- Pro (optional): checkout/pro
What spend surface would you hard-block first if your agent could hit it tonight?
Top comments (0)