scamgate

Open source · MIT · self-hosted

A checkpoint between your agent and the scam.

AI agents now click links and pay for things. scamgate checks every link and payment before the agent acts, and answers allow ask or deny with reasons a person can read.

uv tool install git+https://github.com/odaiameera/scamgate@v0.2.0
Read the docs → See real verdicts

No network calls while checking No LLM judging Same input, same verdict

scamgate-hook · tool calls
    Real scamgate-hook output. deny blocks the call, ask sends it to you, allow means the hook stays silent. Click a row for the reason.
    01 / VERDICTS

    Every point has a reason.

    Rules add points. Under 25 is allow, 25 to 69 is ask, 70 or more is deny. Pick a case: these are exactly what scamgate returns, generated from the code, not typed in.

    Swipe the cases →

    02 / ENFORCEMENT

    A check the agent can choose to skip isn't a check.

    Over MCP the agent decides whether to ask, and a prompt injection can tell it not to. The hook moves the decision into the harness. The mechanics page is the call order, the dialects, and what is not scanned.

    Mode MCP toolscheck_url · check_payment Hookscamgate-hook
    Who runs the checkThe agent, if it remembersThe harness, before every gated tool call
    On denyA warning the agent should respectThe call is blocked
    On askThe agent should stop and ask youHermes sends it to you for approval; Claude Code prompts you
    Destination unreadableNot checkedYou approve it, judged per command (curl "$URL", string-built or encoded links, new packages)
    On its own crashNothing happensFails closed: the call is blocked
    TamperingNothing stops itBlocks edits to its files, rules and hook config, and installed copies verify their own files
    Works withAny MCP clientHermes shell hook, Hermes plugin, Claude Code PreToolUse
    03 / THREAT MODEL

    Yes, a hook can be scammed too.

    So here's how, and what scamgate does about each one. The honest limits are in the docs.

    1. Going around it

      The agent fetches the page with curl, a script, or browser code instead of the browser tool.

      Counter

      Every network-capable tool is gated, including unknown MCP tools. Each command segment is judged alone. A script the command names is read, including scripts that file calls. Disguised hosts are decoded, including https:/ and https:///. A destination it can't read goes to you.

    2. Lying about the payee

      The agent passes is_new_payee=false for someone you've never paid.

      Counter

      Payee facts come from a local history of people you've actually paid, stored as salted hashes. A known name with a new account counts as changed bank details.

    3. Switching it off

      An injected instruction tells the agent to edit the rules, turn Hermes approvals off, start --yolo, or uninstall the gate.

      Counter

      Those commands are blocked, in the shell and inside a script the agent then runs. Writes to the gate, its state, and Hermes or Claude hook config are blocked. Installed copies check their files on every call.

    4. Crashing it

      Malformed input or an exception, hoping the gate fails open.

      Counter

      Fails closed: exit code 2 and a block message. Hermes' fail_closed and Claude Code's onFailure: "block" cover timeouts and crashes too.

    5. Training it

      Hit the same harmless-looking site for a week until it gets allow-listed, then switch.

      Counter

      Nothing is learned automatically. You promote rules yourself, and an allow waives one rule on one exact host, never feeds, your blocklist or intent checks.

    6. Wearing you down

      Enough harmless prompts and you start tapping yes.

      Counter

      Every ask is logged with what you did. scamgate review shows what keeps tripping it, so repeats become rules instead of prompts.

    Gate the click and the payment before the damage.

    uv tool install git+https://github.com/odaiameera/scamgate@v0.2.0
    Documentation → Source on GitHub ↗