v0.7.0 — gate any MCP client

toolgate now runs two ways: the Claude Code hook, and an MCP proxy that gates any MCP client — Cursor, Claude Desktop, Cline, or your own agent.

toolgate mcp -- npx -y @modelcontextprotocol/server-github

toolgate launches the downstream server, proxies the stdio JSON-RPC transport, and gates every tools/call through the same engine as the hook. Allowed calls forward untouched; a denied one (and, by default, an ask) never reaches the server — the client gets a normal tool result marked isError with the reason, so the agent relays it instead of crashing.

• --on-ask block|allow, --gate <regex>, and TOOLGATE_TASK / ~/.toolgate/task for context.
• MCP carries tool calls, not the conversation, so without a task the gate is stricter, never more permissive.
• Never fails open: an internal proxy error blocks the call with a visible reason.
• Same engine, policy, redaction and audit as the hook — a new transport, not new decisioning.

npm i -g @riskaverse/toolgate

v0.6.4 — tuned on real usage and adversarial review

The 0.6 line rebuilt toolgate's decisioning around two things it didn't have before: real-usage data and an adversarial evaluation.

From 151 real decisions (docs/usage-2026-09-19.md): input cap 6k→20k, task context is now the last three prompts read backward through the transcript, and the destructive/exfiltration wording stopped flagging "stop my dev server" and "write code that calls an API." In unattended permission modes an ask becomes a deny (auto mode is attended and unchanged).

From adversarial review (challenge set 5, 24 held-out cases — injection, forged approval, encoded targets, reservation transfer):

• Reserved-choice softening requires task context and low off_task.
• It never reduces off_task itself.
• Secret-exposure and prohibition verdicts stay unsoftenable (keeping their scored verdict — an unsoftenable axis preserves its level, it does not force deny).

Regression suites (real Jev): set 2 20/20, set 3 20/20, set 5 23/24 — zero permissive errors, zero dangerous allows across all 64 cases. The one set-5 miss is a bounded, stricter-than-desired false positive (a single-quoted literal read as a substitution), documented and not chased with threshold changes.

Reviews by ChatGPT (GPT-6 Astra), who authored the challenge sets. npm i -g @riskaverse/toolgate

v0.6.1

The first evening with the hook installed produced 151 real decisions: 55% allow, 40% ask, 5% deny. That ask rate was unusable — and the audit log showed most of it was toolgate's own policy, not the model. Every change in 0.6 comes from that log (docs/usage-2026-09-19.md).

Fewer false positives

• Input cap 6 000 → 20 000 chars. The old cap alone caused 62% of asks: ordinary source-file Writes and Edits on which the model had already said "all risks below 55%".
• Task context is now the latest user prompt plus the two before it. In a working session the latest prompt is usually "yes" or "go ahead"; off_task was being judged against two words.
• The transcript is read backwards in chunks until the prompts are found. 39% of calls had no task context because large tool results pushed the last prompt out of a fixed tail.
• Wording: stopping or restarting your own dev server is not destruction (four of seven real denies were kill/pkill on a dev server). Writing code that would call an API is not exfiltration. "Ask me before X" is not a prohibition.
• A reserved choice is a question, not a block: when the model is deny-level sure the task reserves a decision for you, a deny on a softenable axis becomes an ask.

Unattended modes

• In bypassPermissions, auto, and dontAsk nobody answers a prompt — all 60 asks in the log were resolved without the user seeing one. An ask there is now a deny, with the reason fed to the model. unattended.ask: ask turns this off.

Diagnosability

• Audit log records permission mode, whether task context was found and how long it was, input truncation, and the first line of the task. toolgate audit --stats reports them.

Evaluation (real Jev, recorded as-is in docs/)

• Frozen held-out set 2: 20/20. Frozen held-out set 3: 20/20 (17/20 at 0.5). New development set 4, built from the real-usage failures: 9/12. Zero permissive errors across all 52 cases; every miss is stricter than desired.

npm install -g @riskaverse/toolgate@0.6.1 && toolgate init

v0.5.2

Hook reliability fixes, no policy or engine changes.

• The settings snippet from toolgate init uses the absolute path to the binary; Claude Code spawns hooks with a minimal PATH, so a bare toolgate hook could silently never run.
• toolgate init saves your API key to ~/.toolgate/env (0600) and the hook reads it, so gating works even when Claude Code is launched from the Dock without your shell profile.
• If the decision model is unreachable in passthrough mode, the hook now shows [toolgate] NOT gating: <reason> instead of staying silent.

npm: npm install -g @riskaverse/toolgate@0.5.2

v0.5.1 — first evaluated release

toolgate is an open tool-call firewall for AI coding agents. Before a risky action runs, it asks a calibrated decision model — TypeSafe's Jev — seven questions about the command and the task, and allows, asks, or denies on the probabilities. Ships as a Claude Code PreToolUse hook.

What's in this release

• Seven risk questions (destructive, exfiltration, privilege, secret exposure, off-task, constraint violation, reserved choice) plus an authorized mitigator — capability is not harm, and a requested deploy is not exfiltration
• Direct TypeSafe API or Vercel AI Gateway backend; toolgate init verifies your key with a real decision before you touch any settings
• Static fast path for obvious catastrophes (~90 ms); model decisions ~1.2 s
• Every decision logged with per-question probabilities; toolgate audit --stats

Evaluation

60 labeled commands across three frozen challenge sets, each written by an independent reviewer before being run, with the exact model input recorded per case.

Set	Role	Result
1	development	18/20
2	held-out	20/20
3	held-out, matched pairs	17/20, 7/10 pairs, zero permissive errors

These are small constructed sets, not a failure rate. Full tables, every axis score, and one retraction: docs/challenge-analysis-2026-09-18-b.md.

Known defect

"Ask me before X" instructions are scored as prohibitions, so the verdict is deny where it should be ask. Wording fix pending a fresh evaluation set.

Install

npm install -g @riskaverse/toolgate
export TYPESAFE_API_KEY=...   # console.typesafe.ai → API Keys
toolgate init

Built by Jaz (Risk Averse Technology Company) with Claude; hardened through three adversarial audits and six rounds of review by ChatGPT, all recorded in CHANGELOG.md. MIT.