Reported issues for ThumbGate

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to ThumbGate.

Most discussed

MCP security scan: thumbgate (score 25/100)

We ran a security scan on thumbgate@1.10.1 as part of our MCP ecosystem monitoring.

Score: 25/100 Risk: CRITICAL

Findings

• [HIGH] command injection: Potential command injection: shell execution with template literal input
• [CRITICAL] hardcoded secret: Hardcoded secret found (AWS key, OpenAI key, GitHub token, or npm token)
• [HIGH] sensitive file access: Code reads sensitive system files

What this checks

Install scripts, prompt injection patterns in metadata,

Read the thread · 2026-04-20 · closed · external user · 3 comments

P0: workflow-sentinel learned classifier is degenerate (0.038 holdout accuracy) and traps agent sessions

Summary

The workflow-sentinel PreToolUse hook denies benign actions using a learned classifier whose own reported accuracy is worse than chance. Once triggered it locks a session's working directory into a persistent deny loop that no documented remedy clears. This blocked a full CTO session on 2026-08-21.

Evidence

Measured directly this session:

Read the thread · 2026-08-21 · open · 1 comment

Self-protection: agent can edit/disable ThumbGate's own governance files by default

Reported by Andy Martin (LinkedIn review, 2026-07-08). Thank you.

Observation (verified)

In the shipped `gate-check` path, editing ThumbGate's own kill-switch files is ALLOWED by default — only `THUMBGATE_STRICT_ENFORCEMENT=1` denies:

So an agent that decides ThumbGate is slowing it down could disable the governance layer before c

Read the thread · 2026-07-08 · closed · 1 comment

Integration: ThumbGate enforcement layer for secure-claude-code

Outreach Target

Repo: https://github.com/efij/secure-claude-code
Stars: 88 | Language: Python
Description: Security guardrails for Claude Code, MCP tools, and Claude cowork workflows. Local-first modular YARA-style guard packs for secrets, exfiltration, prompt injection, MCP abuse, and risky agent actions.

Why This Is a Natural Fit

secure-claude-code focuses on static/pattern-based detection (YARA-style rules). ThumbGate complements this with *runtime enforcement

Read the thread · 2026-04-14 · closed · 1 comment

feat: prevention rules should generate PreToolUse hook configs (enforcement, not advice)

Problem

Prevention rules are session-start text that fades from context. Approval rate is 21.7%.

Proposed

High-recurrence rules (5+ occurrences) should auto-generate PreToolUse hook configs that physically block actions. Gateway exposes generate_hooks tool outputting hook JSON. Moves from advisory to enforcement.

Read the thread · 2026-03-15 · closed · 1 comment

bug: ShieldCortex DB writes stale — capture_feedback reports success but SQLite not updated

Problem

capture_feedback MCP tool returns "status": "promoted" but the ShieldCortex SQLite DB (~/.shieldcortex/memories.db) last write is 3 days stale (2026-03-12).

Evidence

sqlite3 ~/.shieldcortex/memories.db "SELECT created_at FROM memories ORDER BY created_at DESC LIMIT 1;"
→ 2026-03-12 14:28:04

Fix

1. Add integration test: capture_feedback → verify row exists in DB with current timestamp
2. Add DB write verification in the promotion pipeline
3. Return actual DB row t

Read the thread · 2026-03-15 · closed · 1 comment

Add measurable performance budgets and browser-native agent connectors

Implement the highest-ROI improvements from the performance-design guidance, the WebMCP draft, and the IdeaBrowser agent connector.

Acceptance:

• Evaluate measured task p95 latency and cost per verified success against explicit budgets.
• Track model calls, network round trips, storage queries, and tokens per verified success without duplicating existing outcome telemetry.
• Expose a small browser-native WebMCP surface for product context, same-origin health, and allowlisted navigation, with tr

Read the thread · 2026-08-26 · open · 0 comments

feat: feedback attribution to specific tool calls (not just sessions)

Problem

capture_feedback doesn't know which tool call caused the problem. Attributes to whole session.

Proposed

Add optional lastAction field with tool name, contextKey, file, timestamp. Integrate with Thompson Sampling arms — thumbs up increments alpha, thumbs down increments beta for the specific context key.

Read the thread · 2026-03-15 · closed · 0 comments

Most recent

The remaining reports are on the project's issue tracker.