MCP Pre-Action Gates Explained

4 min read · Technical deep-dive for developers building on MCP

What is a pre-action gate?

A pre-action gate is an enforcement rule that intercepts an AI agent's tool call before it executes. If the tool call matches a known-bad pattern, the gate blocks it and returns a rejection to the agent. The agent then adapts its approach without ever having run the dangerous action.

Gates run at the hook layer of the Model Context Protocol (MCP). They are external to the agent's reasoning chain, which means they cannot be overridden by prompt injection, context overflow, or chain-of-thought reasoning.

How it works: the tool call lifecycle

Prompt rules vs. pre-action gates

The three layers of a gate

1. Pattern matcher

Gates match against the tool name and its arguments. For a Bash tool call, the pattern might match git push --force targeting main. For a Write tool call, it might match writes to .env or production.config.

{
  "tool": "Bash",
  "pattern": "git push.*(--force|-f).*main",
  "action": "BLOCK"
}

2. Evidence and reasoning

Every gate decision includes a reasoning chain: why this pattern exists, how many times it has fired, what the original failure was. This transparency lets you audit the system and tune it.

{
  "gate": "no-force-push-main",
  "decision": "BLOCK",
  "reason": "Force-push to main blocked",
  "evidence": "User reported loss of 14 commits (2026-03-15)",
  "fire_count": 7,
  "confidence": 0.94
}

3. Thompson Sampling adaptation

Not all patterns deserve the same enforcement level. Thompson Sampling uses a beta distribution to model each gate's risk profile. High-risk patterns (many failures, few successes) get strict enforcement. Low-risk patterns (rarely triggered, occasionally overridden) stay relaxed.

How gates are created

1. Feedback capture: Developer gives thumbs-down with context about what went wrong
2. Lesson storage: Feedback is stored in SQLite with FTS5 indexing for fast retrieval
3. Corrective inference: ThumbGate matches the failure against similar past failures and infers what should be prevented
4. Rule promotion: After configurable repeated failures, the lesson promotes to a prevention rule
5. Gate activation: The prevention rule becomes an active gate in the PreToolUse hook

Supported agents

Pre-action gates work with any agent that supports MCP hooks:

• Claude Code — PreToolUse hooks in .claude/settings.json
• Cursor — MCP server configuration in .cursor/mcp.json
• Codex — MCP tool interception via server config
• Gemini CLI — MCP server hooks
• Amp, OpenCode — any MCP-compatible agent

Run npx mcp-memory-gateway init to auto-detect your agent and configure the correct hook format.