Spec Driven Development
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Description from the maker (original English)
RLHF feedback loop for AI agents. Capture signals, promote memories, block mistakes, export DPO.
These three are never merged into one score: opinions, measurements and popularity are different things.
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
Pick the AI app you use, then copy the settings.
You need
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"rlhf-feedback-loop": {
"command": "npx",
"args": [
"-y",
"rlhf-feedback-loop"
]
}
}
}Run this in your terminal
claude mcp add rlhf-feedback-loop -- npx -y rlhf-feedback-loopPaste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"rlhf-feedback-loop": {
"command": "npx",
"args": [
"-y",
"rlhf-feedback-loop"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Paste into .vscode/mcp.json in your project
{
"servers": {
"rlhf-feedback-loop": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"rlhf-feedback-loop"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
Runs on your computer; the tool list appears in your AI app after you install it.
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
The registry name was verified with the GitHub account IgorGanapolsky, which owns the repo
We have not read this repo from GitHub yet
We have not read this repo from GitHub yet
This one runs on your computer; there is no internet endpoint
Runs on your computer and uses local settings instead
Runs on your computer; we can only read tool lists from internet endpoints
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
The registry does not list a required key, though some servers ask you to sign in on first use.
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
The GitHub repo last changed –, and the latest version (0.6.13) reached the registry 8 months ago.
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
In the same category: Spec Driven Development, Remote Desktop Commander, 好縮 Short
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Smart URL shortener: create, tag and track short links on s.gooo.name.
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
ThumbGate is the self-improving pre-action firewall for AI coding agents
AI coding agents repeat mistakes — and one wrong tool call can wipe a directory, leak a key, or push broken code.
ThumbGate is the local-first Pre-Action Checks engine for AI coding agents. It runs in the PreToolUse hook to evaluate the proposed tool call before execution — so costly mistakes can be caught before they happen.
ThumbGate GitHub star growth is measured with GitHub's privacy-safe GET /repos/{owner}/{repo}/stargazers/history endpoint (weekly counts, no stargazer identities). Run npm run stars:history -- --fixture tests/fixtures/github-star-history.json --json for the local proof. Stars are not npm installs and not revenue. The live GitHub Marketplace Action is ThumbGate Agent Governance (uses: IgorGanapolsky/ThumbGate@v1).
Usage over star count. Evaluate ThumbGate from the install path and live usage badges above (npx thumbgate init, Marketplace uses:, npm weekly downloads, GitHub clones), not from whether the repo has twenty stars or twenty thousand. No pitch deck is required. We do not farm GitHub profile badges (no YOLO-merge of protected main, no 5-minute Issue close theater, no fake Co-authored-by). Galaxy Brain needs real accepted answers in Discussions Q&A. npm run github:achievements -- --fixture tests/fixtures/github-achievements.json --json inventories what is already earned vs what we refuse to farm.
ThumbGate is for operators whose AI coding agents can leak a secret or destroy a checkout before a human sees the tool call (Claude Code, Cursor, Codex, Gemini CLI, MCP). Discovery should reach those operators — not a star campaign.
ThumbGate is not a GitHub star package, not fake engagement, and not a substitute for npm installs or merged PRs. Real engagement is npx thumbgate init and a PreToolUse hook that actually fires.
Lightweight visuals for how agents fail without a pre-action gate:
| Meme | Meaning |
|---|---|
| Unchecked tool calls ship destructive commands. | |
| A prompt is advice; a PreToolUse hook is enforcement. |
It hard-blocks detected secret leaks and two direct self-disable command classes by default — commands that terminate the ThumbGate gate process or enable its bypass environment override. Other high-risk classes (rm -rf, force-push, fetch-and-run, direct guardrail edits) warn and log by default. Set THUMBGATE_STRICT_ENFORCEMENT=1 for strict enforcement (warnings become hard denies).
| Verdict | Default behavior |
|---|---|
| ⛔ Hard-block | Detected secret leaks; process-kill/environment-override self-disable |
| 👎 Warn + log | rm -rf, git push --force, fetch-and-run, direct guardrail edits — warn by default |
| 👍 Allow | Everything else |
Accepted feedback is stored as local lessons. Repeated concrete failures can become prevention rules that promote from warnings to blocking gates. The firewall improves from operations without retraining the model. Prompt evaluation (npx thumbgate eval) turns accepted feedback into reusable eval cases and local proof reports.
Honest disclaimer: ThumbGate does not update model weights. It intercepts tool calls at runtime. Local-first — no cloud required for the enforcement path.
Works with Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and other MCP agents.
Agent tries: rm -rf tests/
ThumbGate: 👎 WARN + LOG — "Never delete test directories" Pattern matched: rm.*-rf.*tests Source: your thumbs-down from last Tuesday Strict mode: ⛔ DENY before tool execution
Agentic development is becoming a loop: Guide → Generate → Verify → Solve. ThumbGate is the pre-action gate / pre-action boundary between generated intent and executed action.
Want a phased walkthrough with a verify step at every stage? Follow the Progressive Setup Guide.
Progressive wiring — prove the pipe before you turn matching on. Empty dashboard is success.
npx thumbgate init # Phase 1: hooks only
npx thumbgate doctor # verify: exits 0 only when PreToolUse hook is wired (hidden metric = hook install, not gate count) npx thumbgate dashboard --open # Phase 2: open local HTML; empty stats are OK npx thumbgate capture --feedback=down --context="Never run DROP on production tables" --what-went-wrong="agent proposed DROP" --what-to-change="require review for DROP"
Later DROP attempts in the same scope surface the check:
⚠️ Check fired: "Never run DROP on production tables"
Pattern: DROP.*production Verdict: 👎 WARN + LOG (⛔ BLOCK when THUMBGATE_STRICT_ENFORCEMENT=1)
Numbered configs: config/progressive/. Guide: progressive wiring.
Directories and clients that install ThumbGate as an MCP server must start stdio MCP, not the HTTP API:
npx -y thumbgate serve
npx -y thumbgate mcpnpm start for MCP — that launches the hosted HTTP API (src/api/server.js), not the agent-facing stdio server.▶ 90-second demo · GIF walkthrough
| Agent | Command | Enforcement |
|---|---|---|
| Claude Code | npx thumbgate init --agent claude-code | 🛡️ Hard — PreToolUse |
| Codex | npx thumbgate init --agent codex | 🛡️ Hard — pre_tool_use |
| Gemini CLI | npx thumbgate init --agent gemini | 🛡️ Hard — PreToolUse |
| ForgeCode | npx thumbgate init --agent forge | 🛡️ Hard — pre_tool_use |
| Cursor | npx thumbgate init --agent cursor | 💬 Advisory — MCP gate_check |
| Cline | npx thumbgate init --agent cline | 💬 Advisory — MCP + .clinerules |
| OpenCode | npx thumbgate init --agent opencode | 💬 Advisory — MCP gate_check |
| Any MCP agent | npx thumbgate serve | 💬 Advisory — MCP gate_check |
| Amp | npx thumbgate init --agent amp | 📝 Feedback capture |
| GitHub Actions | uses: IgorGanapolsky/ThumbGate@v1 | 🩺 Marketplace Action — doctor / AI inventory in CI |
Per-agent guides: Claude/Codex bridge · Codex profile · Cursor · MCP setup
| Scope | Command | Settings | Lessons | Best for |
|---|---|---|---|---|
| Machine-wide (default) | npx thumbgate init | ~/.claude/settings.json | ~/.claude/memory/feedback/ | Solo operators — same machine-local feedback store across repos |
| Per-project | npx thumbgate init --project | /.claude/settings.json | /.claude/memory/feedback/ | Client / compliance — separate dashboard / isolated lessons per repo |
Both scopes write mcpServers.thumbgate plus PreToolUse / UserPromptSubmit / PostToolUse / SessionStart hooks. Machine-wide is the right default for most developers. Cross-repo blocking is not automatic: a lesson learned in one project only applies elsewhere when you share the store (machine-wide) or export/import lessons.
MCP tools (surface): gate_check (read/evaluate proposed tool call), feedback capture + session tools (write), dashboard/stats (read). Destructive agent actions stay blocked/warned by PreToolUse — ThumbGate does not execute user shell commands for you.
Spec-driven agent frameworks like GSD (get-shit-done) and GitHub Spec Kit plan and generate work. ThumbGate is the guardrail layer for spec-driven agents: it sits *after* the plan, on the boundary between a generated tool call and its execution — alongside GSD / Spec-Kit, not instead of them.
npx thumbgate init installs these into your agent palette:
| Command | What it does |
|---|---|
/thumbgate-dashboard | Open local project dashboard |
/thumbgate-guard | Turn last mistake into a hard prevention rule |
/thumbgate-rules | List active rules & lessons |
/thumbgate-blocked | Gate stats + enforcement matrix |
/thumbgate-protect | Branch governance + scoped approval |
/thumbgate-doctor | Health-check hooks, MCP, readiness |
Free tier: 2 feedback captures/day (10 total) and up to 3 active auto-promoted prevention rules. Pro ($19/mo or $149/yr) is the individual tier for unlimited rules, history-aware lessons, linked feedback session flow, personal dashboard, and DPO export. Enterprise is custom and scoped after intake; hosted team lesson sync and a hosted org dashboard are not general availability.
| Free | Pro ($19/mo or $149/yr) | Enterprise | |
|---|---|---|---|
| Local CLI + PreToolUse | ✅ | ✅ | Scoped after intake |
| Feedback captures | 2 feedback captures/day (10 total) | Unlimited | S
Only the beginning is shown; read the rest in the repo