thumbgate-18a4ec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited thumbgate-18a4ec (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ThumbGate turns thumbs-up/down feedback into hard enforcement checks that block known-bad agent actions before they execute. Think of it as an immune system for your AI agent.
npm package: thumbgate Docs: https://github.com/IgorGanapolsky/ThumbGate
If ThumbGate is not yet installed in this project:
npx thumbgate initThis bootstraps .thumbgate/ data directory and .mcp.json config. Works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent.
When an agent action succeeds or fails, capture it:
# Thumbs down — something went wrong
node .claude/scripts/feedback/capture-feedback.js \
--feedback=down \
--context="what happened" \
--what-went-wrong="specific failure" \
--what-to-change="specific fix" \
--tags="tag1,tag2"
# Thumbs up — something worked
node .claude/scripts/feedback/capture-feedback.js \
--feedback=up \
--context="what happened" \
--what-worked="specific thing that worked" \
--tags="tag1,tag2"npm run feedback:rules # Show prevention rules generated from feedback
npm run feedback:stats # Feedback counts by signal, domain, importance
npm run feedback:summary # Aggregated summary of all feedbacknpm run self-heal:check # Verify 4/4 subsystems healthynpm run feedback:export:dpo # Export DPO preference pairs for fine-tuningGates are enforced via MCP PreToolUse hooks — the agent literally cannot execute a blocked action. This is hard enforcement, not a soft suggestion.
| Component | What it does |
|---|---|
| SQLite+FTS5 lesson DB | Fast full-text search across all feedback |
| Thompson Sampling | Adaptive gate sensitivity per failure domain |
| LanceDB + HuggingFace | Local vector search for semantic similarity |
| ContextFS | Hierarchical context assembly with semantic caching |
| PreToolUse hooks | Hard enforcement — blocks before execution |
When the MCP server is running, these tools are available to your agent:
| Tool | Purpose |
|---|---|
capture_feedback | Record thumbs-up/down on an agent action |
search_lessons | Search past feedback by keyword, tag, or domain |
recall | Retrieve relevant memories for current context |
prevention_rules | View active prevention rules |
gate_stats | See which gates are firing and their block rates |
feedback_stats | Feedback counts and trends |
export_dpo_pairs | Export DPO training pairs (Pro) |
construct_context_pack | Build bounded context from feedback history |
Pro users ($19/mo or $149/yr) unlock:
Team rollout ($49/seat/mo, 3-seat minimum after intake) adds the shared hosted lesson DB, org dashboard, approval boundaries, and proof-backed workflow hardening sprint.
Upgrade: https://thumbgate-production.up.railway.app/go/pro?utm_source=skill
For setup guides per agent, see: <references/setup-guides.md> For gate configuration, see: <references/gate-config.md>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.