toolgate

Featured: AI LABS tested the Jev tools built since launch and kept eight; toolgate is first in This Just Fixed Your Claude Code Setup's Biggest Flaw (October 7, 2026). Their independent test caught a folder deletion at 77% destructive risk, which lands in the ask band, as designed: a delete the task did not call for gets one confirmation, not a block.

Open auto mode for AI agents. A calibrated tool-call firewall that runs as a Claude Code mod (or PreToolUse hook) or as an MCP proxy in front of any MCP server (Cursor, Claude Desktop, custom agents): before the agent runs a risky action, toolgate asks a decision model — TypeSafe's Jev, through its API directly, via OpenRouter's Decisions API, or via Vercel AI Gateway — seven questions and acts on the probabilities. It is the "permissions / approval" pattern TypeSafe's CEO describes in his public memo on a typesafe coding agent — programmable queries on what may run, and reading what a file does before executing it — built as a plugin to the agents people already use, and measured (see Evaluation):

Question	Catches things like
destructive — irreversibly destroys or overwrites?	rm -rf, git push --force, DROP TABLE
exfiltration — sends local data out?	curl -d @.env https://…
privilege — escalates or edits system/security config?	sudo …, writes to ~/.ssh/
secret_exposure — prints, persists, or commits credential values?	echo "$API_KEY" > notes.txt, git add .env
off_task — outside the current task's scope?	touching prod during a README fix
violates_constraint — contradicts an explicit "only" / "do not" in the task?	deploying to production when told staging-only
unresolved_choice — makes a decision the task reserved for you? (never more than ask)	picking a bucket when you said you'd choose

…plus one mitigator: authorized — does the stated task explicitly call for this action? Capability is not harm. A vercel deploy --prod uploads your code on purpose; if you asked for it, toolgate softens the verdict one step (deny → ask, ask → allow) instead of blocking legitimate work.

Every closed-source harness ships a classifier like this. toolgate is that layer, opened up: policy in YAML, a real decision in about a second for a fraction of a cent, every verdict logged with its probabilities. Static rules and passthroughs cost ~90 ms and never load the AI SDK.