# Reported issues for ThumbGate

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [ThumbGate](/mcp/thumbgate).

## Most discussed

### MCP security scan: thumbgate (score 25/100)

We ran a security scan on `thumbgate@1.10.1` as part of our MCP ecosystem monitoring.

**Score:** 25/100
**Risk:** CRITICAL

### Findings

- **[HIGH]** command injection: Potential command injection: shell execution with template literal input
- **[CRITICAL]** hardcoded secret: Hardcoded secret found (AWS key, OpenAI key, GitHub token, or npm token)
- **[HIGH]** sensitive file access: Code reads sensitive system files

### What this checks

Install scripts, prompt injection patterns in metadata,

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/975) · 2026-04-20 · closed · external user · 3 comments

### P0: workflow-sentinel learned classifier is degenerate (0.038 holdout accuracy) and traps agent sessions

## Summary

The `workflow-sentinel` PreToolUse hook denies benign actions using a learned classifier whose own reported accuracy is **worse than chance**. Once triggered it locks a session's working directory into a persistent deny loop that no documented remedy clears. This blocked a full CTO session on 2026-08-21.

## Evidence

Measured directly this session:

| Metric | Value |
|---|---|
| `trainingAccuracy` | **0.0075** |
| `holdoutAccuracy` | **0.038** (631 holdout samples) |
| Training com

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/3595) · 2026-08-21 · open · 1 comment

### Self-protection: agent can edit/disable ThumbGate's own governance files by default

**Reported by Andy Martin** (LinkedIn review, 2026-07-08). Thank you.

## Observation (verified)
In the shipped \`gate-check\` path, editing ThumbGate's own kill-switch files is **ALLOWED by default** — only \`THUMBGATE_STRICT_ENFORCEMENT=1\` denies:

| Edit target | default | strict |
|---|---|---|
| \`.claude/settings.json\` (disables hooks) | ALLOW | deny |
| \`config/gates/**\` | ALLOW | deny |

So an agent that decides ThumbGate is slowing it down could disable the governance layer before c

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/2781) · 2026-07-08 · closed · 1 comment

### Integration: ThumbGate enforcement layer for secure-claude-code

## Outreach Target

**Repo:** https://github.com/efij/secure-claude-code  
**Stars:** 88 | **Language:** Python  
**Description:** Security guardrails for Claude Code, MCP tools, and Claude cowork workflows. Local-first modular YARA-style guard packs for secrets, exfiltration, prompt injection, MCP abuse, and risky agent actions.

## Why This Is a Natural Fit

`secure-claude-code` focuses on static/pattern-based detection (YARA-style rules). ThumbGate complements this with **runtime enforcement*

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/823) · 2026-04-14 · closed · 1 comment

### feat: prevention rules should generate PreToolUse hook configs (enforcement, not advice)

## Problem
Prevention rules are session-start text that fades from context. Approval rate is 21.7%.

## Proposed
High-recurrence rules (5+ occurrences) should auto-generate PreToolUse hook configs that physically block actions. Gateway exposes `generate_hooks` tool outputting hook JSON. Moves from advisory to enforcement.

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/201) · 2026-03-15 · closed · 1 comment

### bug: ShieldCortex DB writes stale — capture_feedback reports success but SQLite not updated

## Problem
`capture_feedback` MCP tool returns `"status": "promoted"` but the ShieldCortex SQLite DB (`~/.shieldcortex/memories.db`) last write is 3 days stale (2026-03-12).

## Evidence
```
sqlite3 ~/.shieldcortex/memories.db "SELECT created_at FROM memories ORDER BY created_at DESC LIMIT 1;"
→ 2026-03-12 14:28:04
```

## Fix
1. Add integration test: capture_feedback → verify row exists in DB with current timestamp
2. Add DB write verification in the promotion pipeline
3. Return actual DB row t

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/200) · 2026-03-15 · closed · 1 comment

### Add measurable performance budgets and browser-native agent connectors

Implement the highest-ROI improvements from the performance-design guidance, the WebMCP draft, and the IdeaBrowser agent connector.

Acceptance:
- Evaluate measured task p95 latency and cost per verified success against explicit budgets.
- Track model calls, network round trips, storage queries, and tokens per verified success without duplicating existing outcome telemetry.
- Expose a small browser-native WebMCP surface for product context, same-origin health, and allowlisted navigation, with tr

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/3686) · 2026-08-26 · open · 0 comments

### feat: feedback attribution to specific tool calls (not just sessions)

## Problem
capture_feedback doesn't know which tool call caused the problem. Attributes to whole session.

## Proposed
Add optional lastAction field with tool name, contextKey, file, timestamp. Integrate with Thompson Sampling arms — thumbs up increments alpha, thumbs down increments beta for the specific context key.

[Read the thread](https://github.com/IgorGanapolsky/ThumbGate/issues/203) · 2026-03-15 · closed · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/IgorGanapolsky/ThumbGate/issues).