ThumbGateThumbGate Verification evidence
ThumbGate vs Cloudflare WriteGuard

WriteGuard gates MCP writes at the portal. ThumbGate gates every tool call at the runtime. A hyperscaler just validated the category.

WriteGuard (by Cloudflare, private beta) intercepts MCP requests at Cloudflare's portal, classifies operations from read-only through contained write to critical, and enforces tool-specific policies centrally — reusing existing OAuth identity and labeling agents in the audit trail. ThumbGate gates the tool call an AI coding agent is about to execute — bash, SQL, file write, HTTP fetch, MCP tool — locally, before the side effect happens when the harness supports it: mandatory PreToolUse hooks on Claude Code, Google Gemini CLI, and other hook-capable runtimes; MCP gate_check plus advisory rules/skills on Cursor, Sourcegraph Amp, Cline, and OpenCode (enforcement there depends on the agent calling the gate). Rules grow from your own operator feedback.

Both pre-action Both agent-labeled audit Different layers Portal gate + runtime gate = full coverage

Side-by-side scope comparison

Capability Cloudflare WriteGuard ThumbGate
What it intercepts MCP requests flowing through Cloudflare's portal, evaluated against tool-specific policies before passing or blocking Tool calls the agent harness exposes (bash, SQL, file write, HTTP fetch, MCP tool): mandatory PreToolUse hooks where supported; MCP gate_check / advisory rules on MCP-only adapters
Where the gate runs Cloudflare's network — a centralized portal layer in front of MCP servers Locally, inside the developer's agent session; no cloud dependency on the enforcement path
Action classes covered MCP operations only — anything that does not flow through the portal is out of scope (local shell, file system, git, direct database clients) All tool-call classes the agent harness exposes, MCP included
Risk taxonomy read-only (no risk) → contained write (e.g. creating merge requests) → critical (production deployments, bulk deletions) 👍 allow → 👎 warn + log → ⛔ hard-block; strict mode turns warns into denies. Maps 1:1 onto WriteGuard's tiers
Rule source Tool-specific policies authored centrally — the stated goal is implementing them once at the portal instead of re-implementing per MCP server Operator feedback (👍/👎) distilled into lessons and auto-promoted to prevention rules only after passing precision/recall gates; each rule traceable to the lesson that produced it
Identity model Existing OAuth credentials, with agent context added to downstream audit logs — no standalone agent accounts Per-agent inventory and per-gate hit rates on /dashboard; agent id and metadata captured on every gate decision
Audit output Portal audit trail with agent labels, omitting values for keys considered secret or sensitive Local audit log with rule version, source lesson, decision, and timestamp; signed execution receipts per attempt (see the receipt schema)
Availability Private beta; no public cost information disclosed MIT-licensed npm package, installable today: npx thumbgate init; hosted plans on /pricing

The shared architectural insight

Cloudflare's engineers describe their motivation in language any ThumbGate operator will recognize:

"We wanted centralized control over the write actions agents could perform, agent labels to appear in downstream applications, and an audit trail."

That is the pre-action thesis: evaluate the action before it executes, attribute it to an agent, and keep evidence. The two products disagree only about where that evaluation belongs.

  • WriteGuard's answer: at the network portal. Centralization means one policy set governs every MCP server without modifying any of them — Cloudflare notes that re-implementing policies in each server "would take more work and produce inconsistent behavior."
  • ThumbGate's answer: at the tool-call boundary inside the runtime. That is the only vantage point that sees every action class — an agent about to run a destructive shell command or overwrite a local file never issues an MCP request, so a portal never sees it.

The layers compose. A portal gate governs what crosses the network; a runtime gate governs what the agent does, full stop.

The dual-deploy story for larger teams

An engineering organization routes its shared MCP servers (issue trackers, deployment tooling, data warehouse connectors) through Cloudflare. WriteGuard enforces the central policy: agents may file merge requests (contained write) but production deployments and bulk deletions (critical) require explicit approval, all under existing OAuth identity.

The same organization's developers run Claude Code and Cursor locally. ThumbGate blocks the classes the portal never sees — destructive shell commands, force-pushes to protected branches, secret-leaking file reads, direct database writes — via PreToolUse hooks on Claude Code (and other hook-capable agents) and via MCP gate_check / advisory wiring on Cursor. It keeps learning, because every operator thumbs-down becomes a candidate rule for the whole team.

Portal gate for shared infrastructure. Runtime gate for every keystroke-adjacent action. Full perimeter.

FAQ

Is WriteGuard a competitor to ThumbGate?

Adjacent, mostly complementary. WriteGuard governs MCP traffic at Cloudflare's portal; ThumbGate governs every tool call inside the agent runtime, including everything that never crosses a network portal.

What does WriteGuard's launch mean for this category?

Hyperscaler validation. Cloudflare building centralized write-gating for agents confirms that pre-action enforcement is infrastructure, not a novelty. The remaining question is placement — portal vs runtime — and the honest answer is that complete coverage needs both.

How do the risk tiers map?

read-only → allow. contained write → warn + log. critical → hard-block. ThumbGate additionally promotes new rules from operator feedback, so tier assignments adapt to observed agent behavior rather than staying fixed.

Where do I start?

If your MCP servers already sit behind Cloudflare, watch for WriteGuard's beta. For the agents on your developers' machines, npx thumbgate init wires the runtime gate today.

Related reading

See also ThumbGate vs Gatekeeper (workforce-input gate at the browser boundary), ThumbGate vs Arcjet (app-inbound firewall), and ThumbGate vs Unity AI Gateway.