Does ThumbGate replace Aperture's no-API-keys model?

No. Key brokering at the network layer is Aperture's job, per Tailscale's GA announcement. ThumbGate's secret-exfiltration deny is complementary: even when an agent legitimately holds no provider key, it can still try to read or send other secrets, and the PreToolUse gate is the layer that sees that tool call.

When should I use ThumbGate with Aperture?

Use both. Route model access through Aperture on the tailnet so agents never hold API keys, and run ThumbGate PreToolUse hooks on the coding agents themselves so the Bash, Write, and git calls they emit are evaluated before execute. Aperture cannot see a local rm -rf; ThumbGate cannot broker tailnet model access.

comparison | thumbgate vs tailscale aperture

ThumbGate vs Tailscale Aperture

Q: Is Tailscale Aperture a ThumbGate competitor?

Adjacent, not a substitute. Aperture is Tailscale's identity-aware AI gateway: which people and machines on a tailnet may reach which models and connectors, with audit, and no API keys handed to agents. ThumbGate intercepts the tool call a coding agent is about to run (Claude Code, Cursor, Codex) with allow, warn, or deny before execute. One governs model access on the network; the other governs actions at the tool boundary.

Tailscale Aperture (GA August 2026) is an identity-aware AI gateway that lives on your tailnet: users and agents reach models and connectors through Tailscale identity instead of distributed API keys, with per-project tool permissions and audit trails. ThumbGate is not a gateway and not a network product. It evaluates the tool call a coding agent is about to run, blocks the unsafe ones, and leaves a reviewable record.

ThumbGate: PreToolUse allow / warn / deny on Claude Code, Cursor, Codex

Aperture: identity-aware model access on the tailnet (their layer, not ours)

The short answer

Adjacent, not a substitute. Same instinct — agents need governance infrastructure, not vibes — applied at different layers. Aperture answers “which identities on this network may reach which models and connectors, with what audit?” ThumbGate answers “should the Bash, Write, or git call this agent just proposed run at all?” Tailscale shipping an AI gateway is category confirmation that agent governance is infrastructure; it is not a PreToolUse hook, and we are not a tailnet.

An identity gateway is not a tool-call gate

Sample — not a live buyer run. Mandate: let an agent use a model over the tailnet. Do not let it exfiltrate a credential.

01 Agent requests a modelAperture authenticates the machine and user via tailnet identity. No API key was ever distributed.

02 Agent emits a tool callThe model responds; the agent proposes curl with a token in the command line. This happens on the developer machine, below the gateway.

03 PreToolUse checkpointThumbGate evaluates the call. Secret exfiltration is a hard floor: deny before execute.

04 Recorded resultBoth layers keep their own audit trail. Network identity did not make the local action safe; the gate did.

Comparison table

Dimension	Tailscale Aperture	ThumbGate
What it is	Identity-aware AI gateway on the tailnet (GA per Tailscale's announcement)	Local PreToolUse firewall for coding agents
Question it answers	Which identities may reach which models and connectors?	Should this tool call run at all?
Where it sits	On the network path between agents and model providers	Inside the agent harness, on the PreToolUse hook, before execute
Credential story	No API keys distributed to engineers or agents; access flows through tailnet identity	Secret-exfiltration deny on the tool call itself; single-use credential and secret-egress guards
Default hard blocks	Access rules and approvals defined by tailnet policy	Secret exfiltration and self-protect; destructive git/fs warn unless STRICT
Tool permissions	Projects group chats with shared context and default tool permissions	MCP allowlist profiles (default, readonly, locked) plus per-gate policy
Audit	Audit trails for agent actions through the gateway	Allow / warn / deny verdicts logged locally per tool call, reviewable by a security owner
What it cannot see	A local `rm -rf` or `git push --force` that never touches the gateway	Tailnet topology or model-provider access it was never hooked into

When to use Aperture

Your team is on Tailscale and you want model access without distributing API keys.
You need network-level identity, access rules, and audit for AI usage across an organization.
You want per-project defaults for which connectors and tools agents may use, enforced at the gateway.

When to use ThumbGate

Claude Code, Cursor, or Codex is about to run Bash, Write, or git on a sensitive repo.
You need secret-exfil deny locally, with a log you can show a security owner.
Network identity is not a substitute for a hook: a fully authenticated agent can still propose a destructive local action.

FAQ

Is Tailscale Aperture a ThumbGate competitor?

Adjacent. They govern model access at the network layer with tailnet identity. We gate coding-agent tool calls at the PreToolUse boundary. Do not pitch us as a gateway, and do not pitch them as a hook.

Do we claim Aperture's capabilities?

No. Identity-aware gateway, tailnet MCPs, token bundling, and project permissions are Tailscale's features per their GA announcement. We do not run your tailnet and do not broker model access.

Can they compose?

Yes, cleanly: Aperture on the network path so agents never hold provider keys; ThumbGate on the agent harness so every proposed tool call is evaluated before execute. The layers do not overlap and neither replaces the other.

Install ThumbGate

One command. Local evaluate is free.

npx thumbgate init

See the product