Enforcement that pays for itself

Stop paying for the same AI mistake twice.

Install free with npx thumbgate init. Pro is $19/mo ($149/yr) when you want production infrastructure rule packs, repo-committed policy lock, and the visual debugger. The $499 one-time Setup Sprint hardens one team workflow + CI gate with you. It is not an enterprise contract.

✓Setup Sprint ($499 one-time): one failure mapped, local + GitHub Action CI gate configured, regression + rollout proof.

✓Pro ($19/mo or $149/yr): 6 production rule packs (AWS, Terraform, K8s, Stripe, Supabase, Git), .thumbgate/policy.lock, visual debugger, recall, and DPO export.

✓Free local evaluate: npx thumbgate init — first hard gate usually minutes after install.

✓NVIDIA Inception Program Member: GPU-accelerated NeMo Guardrails, TensorRT-LLM & Morpheus ready.

Done-with-you setup · 1 workflow

$499

We take one repeated miss from review through a configured local + CI gate and one regression test. Fixed price. One supported local workflow, with proof in 2 business days after access and agreed materials are available. No subscription.

Prefer to talk before paying? Book a 15-min triage call first →

Detected secret exfiltration denies by default: literal secrets, secret-file paths in uploads/pipes/redirections/command-substitution, secret env vars to network tools, scp/rsync/cloud CLI uploads of credential files, and common interpreter one-liners. Not a full network sandbox. Other destructive actions warn by default and deny when strict enforcement is enabled.

Plan comparison

Feature comparison: Free (MIT) vs. Pro ($19/mo · $149/yr) vs. Setup Sprint ($499) & Enterprise

Feature / Capability	Free (MIT) npx thumbgate init	Pro — $19/mo or $149/yr · 1 developer	Setup Sprint — $499 one-time · 1 team workflow
Local <0.5ms PreToolUse hook (Claude, Cursor, Codex, Grok, Hermes)	✓ Included	✓ Included	✓ Included + custom wired
Default secret exfiltration & gate-bypass hard deny	✓ Included	✓ Included	✓ Included
Local SQLite lesson store & thumbs feedback ranker	✓ Starter limits	✓ Unlimited	✓ Configured for workflow
Active prevention gates & custom rules	Starter local rules	✓ Unlimited active gates	✓ 1 managed workflow gate
Production infra rule packs (AWS, Terraform, K8s, Stripe, Supabase, Git)	—	✓ All 6 packs included	✓ Tailored to 1 workflow
Repo-committed policy lock (`.thumbgate/policy.lock`) & CI check	Local machine only	✓ Repo policy lock	✓ Wired in repo + GitHub Action
Visual gate debugger (`npx thumbgate dashboard --open`)	CLI output	✓ Full visual debugger	✓ Included
Cross-session hosted recall & lesson match trace	Local only	✓ Included	Local workflow scope
Export thumbs as training data (JSONL / DPO)	—	✓ Included	—
60-minute live working review + failure map	—	—	✓ Included
Custom regression test + 2-day rollout & rollback proof	—	—	✓ Included (or refunded)
Support & onboarding	Community / GitHub	Priority email support	Done-with-you engineer
Enterprise org-wide hosted sync, SSO/SAML & SIEM audit log	—	—	Not generally available (custom scope after 1 workflow sprint)

Price from your exposure

Value is the recovery work the next repeat does not create.

Use your own incident history. ThumbGate does not claim a universal savings number.

00No check on the tool call
01Capture the miss
02Keep the lesson locally
03Write the prevention rule
04Block or warn at the tool call
05Prove it with one regression

Enter last quarter. This multiplies those three numbers. It is not a ThumbGate savings measurement.

Free local install covers the gate on your machine. Pro adds hosted recall. The $499 diagnostic is us doing the review, the gate, and the regression for one workflow.

Choose by buyer value

One product. Three buying decisions.

The fence is scope and service level—not an arbitrary discount.

Solo operator

Evaluate free, then Pro

Pro removes rule limits and adds personal recall, review, dashboard, and export workflows.

Fence: one operator, local-first, self-serve support. $19 monthly or $149 annual.

Choose Pro

Engineering or platform team

Managed diagnostic

Turn one expensive, repeated agent failure into a configured gate and a regression proof.

Fence: one supported local workflow, fixed scope, two-business-day delivery. $499 once.

Harden one workflow

Regulated or multi-workflow team

Enterprise service intake

Scope approval boundaries, rollback evidence, and accountable rollout support after one workflow proves fit.

Fence: custom scope after intake. Hosted team features, SSO, and SIEM are not general availability.

Start with one diagnostic

How ThumbGate stacks up

Make the alternative look expensive.

DIY prompts look cheap but still consume model and review time. Platform hiring and GRC suites require larger commitments.

	DIY / CLAUDE.md	Platform hire	GRC suite	ThumbGate
Monthly cost	Model + review time	Loaded engineering cost	Contract + implementation	$0–$19 · $499 once
Time to first gate	Manual upkeep	Weeks	Months	Minutes after install / 2 business days managed
When agent “looks competent”	Prompt may be skipped	Custom glue	Gateway only	Configured gate at tool call

Delivery

A bounded implementation, not a strategy deck.

The goal is one working enforcement boundary with a test that proves the original mistake cannot silently recur.

Review the failure

Reproduce the risky action and identify the exact point where an external check can intervene.

Install the gate

Configure ALLOW, WARN, or DENY behavior for the supported local agent workflow.

Prove the boundary

Add a regression test and hand back rollout and rollback evidence.

Fit

Know the boundary before you pay.

This is for you if

You are running agent workflows that take real actions across lead gen, content, sales, or ops, and one specific action has gone wrong more than once. You can name the command, tool call, destination, repository, or resource boundary involved. You want the rule enforced where the agent acts, so you can hand your agents more work rather than watching them do it. Not sure yet? Start free with npx thumbgate init — nothing is sent to us, and the verification evidence is public up front.

This is not for you if

The failure is a one-off you cannot reproduce, or the problem is output quality rather than a risky action — a gate stops a bad send, it does not improve the draft. The $499 offer covers one workflow. Org-wide hosted policy, SSO, a hosted audit dashboard, 24/7 incident response, and multi-workflow rollout require separate scope. Hosted Enterprise capabilities are not generally available. If the failure cannot be reduced to a supported gate, the order is refunded rather than turned into open-ended consulting.

Questions

Before checkout

What does the $499 managed gate include?

A 60-minute workflow review, one configured local pre-action gate, one regression test, and rollout and rollback proof within two business days for one supported workflow.

What happens if the workflow is not a fit?

If the failure cannot be reduced to a supported ThumbGate gate, the payment is refunded instead of turning into an open-ended consulting upsell.

How is the exposure number calculated?

It multiplies the repeat incidents, recovery hours, and loaded hourly cost you type. Downstream impact is not included. ThumbGate does not claim a universal savings number.