gate CLI
gate redacts personal data from database and MCP tool results before the model sees them, using fixed rules instead of another LLM
- 214 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The hook rewrites the agent's Bash commands, and `gate init` changes agent settings and MCP entries
- Sees database and MCP response content before redaction and writes a local stats log
- It is no sandbox: unlisted commands and free text pass without protection
Install
- Works in
Manual install
brew tap GaaraZhu/gate && brew install gateHomebrew on macOS and Linux. If Homebrew 6 complains about trust for a third-party tap, run `brew trust GaaraZhu/gate`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The hook rewrites the agent's Bash commands, and `gate init` changes agent settings and MCP entries
- Sees database and MCP response content before redaction and writes a local stats log
- It is no sandbox: unlisted commands and free text pass without protection
This is third-party code. Review the repository files before installing.
What it does
gate is a Rust command-line tool that sits between an agent's tools and the model. It intercepts query results, finds JSON fields that hold personal data (email, phone, tax ID, card number) and swaps the values for markers such as `[PII:email]`. The response keeps its structure and gets a `_gate_summary` field with a redaction count. There are two paths to the data. Bash commands go through an agent hook: `gate hook` rewrites a call to a configured tool into `gate run -- <command>`, and the output is checked before it returns to the chat. MCP calls go through the transparent stdio proxy `gate mcp`, which forwards traffic unchanged and processes only `tools/call` responses. Regular expressions, column-name heuristics and a Luhn check make the decision. No model takes part, and the overhead is under 10 ms per query. Before the hook goes in, `gate scan` assesses a database schema and shows where personal data sits. `gate retro` later aggregates statistics over every intercepted response.
Who it is for. Developers and analysts who let Claude Code, Cursor or Codex read production databases through psql, CLI clients and MCP servers and do not want emails and card numbers in the model context.
Good fit when
- The agent runs SELECT against a production database and the results can hold emails, phones and card numbers
- A third-party MCP server returns customer data and you cannot change its code
- An audit needs a reproducible outcome: the same value is always replaced by the same marker
- Before connecting an agent to a schema you need to know how many columns hold personal data
- A team wants a shared config of thresholds and patterns in the repository that members pull with `gate config --sync`
Not a fit when
- Personal data sits in free-form text: gate rules look for it in structured JSON fields
- You need a sandbox against a hostile agent: gate targets accidental leaks, not deliberate evasion
- The tool returns plain text or CSV: non-JSON output passes through unchanged
- You can enable masking on the database side: it is stronger there, and gate stays an extra safety net
Example request
Run gate scan on the database schema, then connect gate to Claude Code and confirm that a query on the customers table returns markers instead of emailsLimitations
- gate processes only commands listed under `tools:` in the config and MCP `tools/call` responses. Other commands run unchecked, and `resources/read` and `prompts/get` are forwarded without inspection.
- Plain text and CSV pass through unchanged. Personal data inside free text is not detected by the rules.
- It is a redaction layer, not a sandbox: a deliberate agent under prompt injection can route around it, see `THREAT-MODEL.md`.
- Data that already reached the model context earlier stays untouched.
How to disable. The `gate init` command writes a hook into the agent settings, and `gate init --wrap-mcp` wraps MCP entries. To remove protection, delete the hook from the agent settings, restore the original MCP server entry, then run `brew uninstall gate`. Stats live in a local JSONL file, and `stats.enabled: false` turns collection off.
FAQ
How does gate differ from masking at the database level?
gate changes nothing in the database and works with any source that returns JSON, including vendor databases and MCP tools. Database masking is stronger when you administer the database, so the two complement each other.
How does gate decide a field holds personal data?
Through regular expressions on values, column-name heuristics and a Luhn check for card numbers. Every decision traces to an explicit rule, so results repeat from run to run.
How do I connect gate to Cursor or Codex?
Run `gate init --harness cursor` or `gate init --harness codex`. Then restart the session, and in Codex also mark the hook as trusted in the permissions window.
Does gate slow queries down?
The overhead is under 10 ms per query, because the check runs rules on your machine and makes no network calls.
What does gate scan do?
It reads a list of table and column pairs from the database schema and prints a report for every table that scores its personal-data columns. It needs no config, and the hook can be installed after the report.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
An MCP memory server for agents plus a free gate that stops dangerous commands before they run
Vigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
An intercepting HTTP proxy with a terminal UI and MCP server: the agent reads captured traffic, replays requests and runs scans.
README in short
The README opens by arguing why rules beat a second model and compares gate with database masking. It continues with a three-step demo, a five-step quickstart, team setup, the two data paths and a section on what gate does not protect against. A table of supported agents closes it.