toolgate 0.15 separates writing a script from running it, 19 of 20 on the paired set

RiskAverseTech/toolgate is a tool-call firewall from the account Risk Averse Technology Company. The LICENSE file is MIT. The npm package is @riskaverse/toolgate. It installs as a Claude Code PreToolUse hook, or as an MCP proxy in front of another server. Before a gated call it asks Jev, through TypeSafe, OpenRouter’s Decisions API, or Vercel AI Gateway, and maps the probabilities to allow, ask, or deny. The September 28 post is version 0.15. We did not install the hook.

Static rules run first and cost no model call. The README’s examples deny rm -rf / and ask on curl | sh. Read-only tools are ungated. Everything else is one request with seven risk questions: destructive, exfiltration, privilege, secret exposure, off task, a broken constraint, and a choice the task reserved for the user. A separate authorized score can soften deny to ask, or ask to allow, when it is at least 0.8 and the call is on task. Secret exposure, a violated constraint, and a reserved choice do not soften. Default thresholds are deny at 0.85 and ask at 0.55. If the model is unreachable, the default fail_mode is ask. Policy is read from ~/.toolgate/toolgate.yaml, not from the project directory. The README says an allow is advisory, Claude Code’s own denies still apply, and the tool is not a sandbox. SECURITY.md says the model path sends redacted tool input and recent prompts to the hosted provider.

The 0.15 piece is a ledger for write-then-execute. When the agent writes a file, the same call scores what that file would do if run later: read secrets, send data, destroy data, change privilege. Those scores do not change the write’s verdict. They are stored as booleans and a path. A later Bash call that runs the path is judged against those facts. If the write is still unconfirmed, the verdict floors at ask. The README’s example allows writing a script that curls .env to an outside host, then denies running it. cat of the same file stays allowed. Scope in this release is Claude Code hooks, from Write, Edit, MultiEdit, or NotebookEdit into Bash. Writes done from Bash itself, and the MCP proxy, are outside that scope.

Frozen set 6 is ten matched pairs, inert text against the same effect actually performed, scored on 0.15.0. The result in the README is 19 of 20, every pair separated, zero permissive errors. The highest risk score on an inert side was 0.32. The deciding axes on the action sides were 0.91 to 0.98. Set 7, 24 write-then-execute cases from the same reviewer, is 20 of 24 with zero permissive allows. Set 8, 22 cases on runtimes the earlier wording had not seen, is 19 of 22. The post’s counts match those three lines: 19/20, 20/24, and 19/22.

The usage number is older than 0.15. The README dates a 1,369-decision window to version 0.9.1, September 21 through 27. A blind second labeling of 455 items found zero permissive misses and put the friction on one axis, too many asks. The README says 0.11.0 is the change that answers that log. The post says that fix is being measured again. Latency for the window, 1,368 timestamped direct-API calls, is 1,060 ms p50 and 1,216 ms p90. A same-minute probe on September 27, one git push --force, put the direct API at a 782 ms median and OpenRouter’s Decisions route at 724 ms. Static rules are described as about 90 ms. The sets are small and aimed at named failure types. The README says they are not a general failure rate.