The problem. Coding agents run shell commands, edit files and read untrusted content. One poisoned file or one bad guess can leak your .env, push over your main branch or run a downloaded script.

What AgentGate does. It hooks into Cline’s beforeTool step, so every tool call is checked before it runs:

1. Normalize: pull the real commands and file paths out of the call.
2. Hard rules: fixed patterns that block secret reads, data sent out, downloaded code, sudo, destructive git, bulk deletes, changes to the gate itself, and disguises like quote splitting or encoded payloads. They take about 1 ms and need no model.
3. Kev-4B: a small decision model that runs locally and handles the indirect cases the rules miss. Examples are a secret filename built from variables, an interpreter one-liner that opens an env file, or a project-wide archive.
4. Policy: turn Kev’s answer into allow, ask the user, or block.
5. Log: write one line per decision with secrets removed, viewable live in a colored terminal viewer.

Design choices. The rules can only make decisions stricter, and Kev only fills the gaps the rules leave. If Kev is unreachable, returns bad output or the plugin crashes, the call is blocked. If Kev times out, the user is asked. A bundled skill also tells the agent up front what will be blocked, so it wastes fewer turns. That skill is only advice, not a security boundary. When Kev isn’t running, Cline stops the task and shows the steps to download and start it.

Install. One command on macOS/Linux (curl … | bash) or Windows (irm … | iex) installs the plugin and skill into Cline and checks that Kev is reachable.

Built with: TypeScript, Bun, the Cline SDK plugin hooks, and Kev-4B (Apple Silicon via MLX, or a CUDA/ROCm GPU).