How to Stop AI Agents From Force-Pushing to Main

2 min read · Works with Claude Code, Cursor, Codex, and any MCP agent

The problem

You write never force-push to main in your CLAUDE.md. Your agent reads it. Then it force-pushes to main anyway. Prompt rules are suggestions. Agents can and do ignore them when the context window fills up or when a chain of reasoning overrides the instruction.

Why prompt rules fail

• Context overflow — as the conversation grows, early instructions get compressed or dropped
• Reasoning override — the agent decides force-push is the "correct" solution to a merge conflict
• No enforcement layer — nothing physically stops the tool call from executing

The fix: a pre-action check

A pre-action check intercepts the tool call before it executes. It pattern-matches the command against known-bad actions. By default it flags and logs the attempt so you see it; in strict mode (THUMBGATE_STRICT_ENFORCEMENT=1) it hard-blocks the call at the MCP hook layer, outside the agent's reasoning chain.

Step 1: Install ThumbGate

npx thumbgate init

This auto-detects your agent (Claude Code, Cursor, etc.) and configures the PreToolUse hook.

Step 2: Give feedback

The next time your agent tries a force-push (or anything dangerous), give it a thumbs-down with context:

👎 "Never force-push to main. This destroyed 14 commits last time."

Step 3: Check auto-generates

ThumbGate captures the feedback, matches it against the tool call pattern, and auto-generates a prevention rule. After repeated failures (configurable), it promotes to a hard check:

# Auto-generated prevention rule
pattern: "git push --force"
target_branch: "main"
action: WARN            # flags + logs by default; hard-blocks under THUMBGATE_STRICT_ENFORCEMENT=1
reason: "Force-push to main flagged — destroyed 14 commits (2026-03-15)"

Step 4: Check fires on every future attempt

The PreToolUse hook checks every Bash tool call. If it matches git push --force targeting main, the attempt is flagged and logged before execution by default, and hard-blocked in strict mode. Either way the agent receives the reason and adapts.

What about other dangerous actions?

The same pattern works for any tool call you want to prevent:

• DROP TABLE on production databases
• rm -rf on project directories
• Committing .env files with secrets
• Running untested migrations on prod
• Skipping test suites before deploy

Every thumbs-down teaches the system. Thompson Sampling adapts check sensitivity: high-risk patterns get strict enforcement, low-risk ones stay relaxed.