gate4.ai

Open source · runs on your computer

Your AI agents get only what you allow.

gate4.ai is a guard for your computer. Claude, ChatGPT, OpenClaw and Hermes reach your browser and files through it, under your rules: allow, deny, or ask you first. Agents never see your passwords, and every action leaves proof.

macOS / Linux Windows
curl -fsSL https://gate4.ai/install.sh | sh

macOS, Linux, Windows · no admin rights · v0.7.24

gate4ai · live journal
  1. Agent
    Claude.ai wants browser.act
    account.example.org · “Pay the October utility bill”
  2. Sites
    account.example.org is not on your list of allowed sites ask
  3. You
    Telegram · gate4ai Claude.ai wants to act on account.example.org DenyAdd to allowed sitesAllow
  4. Proof
    done screenshot of the receipt · saved to journal #1842

Agents are getting the keys to everything. One bad email is enough to turn that into actions.

  1. 01

    Too much access

    Personal agents get a whole shell, a logged-in browser and every file on the disk. There is no “only this site, only this folder”.

  2. 02

    Prompt injection becomes action

    A web page or an email with hidden instructions can make an agent forward your data or pay someone.

  3. 03

    “Done” without proof

    Agents report success they did not achieve. Without a server response or a screenshot, you cannot tell.

How it works

One gate between all your agents and your computer.

Your agentsClaude.ai · ChatGPT · Claude Code · OpenClaw · Hermes
gate4.ai allowdenyask you rules · limits · vault · journal
Ways outBrowser · Files · connectors to sites

Two lists you control

Sites for the Browser, folders for Files, each line with its mode: allow, read, ask or deny. Wildcards work, the most specific line wins, and every connector lives inside the same lists.

Passwords stay with you

Agents and connectors see aliases like @bank.main. gate4ai signs in itself, only on the site the account belongs to.

Proof for every action

Each request, decision and result goes to a tamper-evident journal. gate4ai journal verify checks it end to end.

Approve from anywhere

A desktop notification and the tray icon, Telegram, or the local Web UI. No answer in time means no.

Rules in plain words

Say what is fine. gate4ai holds the line.

“Read my bank freely. On the utility site, ask me before every action. Everything else is closed.”

A list of sites, each with its mode. Reading is silent; anything beyond reading on an ask site waits for your tap.

access:
  sites:
    - { domain: "*.bank.example", access: read }
    - { domain: "account.example.org", access: ask }
    - { domain: "*", access: deny }

“Read my notes. Add to them, but never rewrite. Downloads: only through connectors I installed.”

A list of folders. append adds lines without touching what is there; connector keeps the agent out and lets a trusted connector in.

access:
  folders:
    - { path: "~/Documents/notes", access: append }
    - { path: "~/Downloads", access: connector }
    - { path: "~/.ssh", access: deny }

“Never pay to an account the agent found on a web page. And no more than 20 page actions a day.”

gate4ai tracks where each argument came from, so a payee planted by a page is refused.

- id: no-injected-payees
  action: utilities.pay_bill
  when: "'untrusted_content' in provenance.payee"
  effect: deny
limits:
  - { id: acts-per-day, action: browser.act, per_day: 20 }

Works with your agents

Cloud or local, one set of rules.

Claude.ai

Remote MCP through the relay. No open ports, and the relay cannot read your traffic.

How to connect

ChatGPT

The same remote MCP connector, connected with a one-time code.

How to connect

Claude Code

MCP over stdio, or fully isolated with gate4ai run: network and files only through gate4ai.

How to connect

OpenClaw · Hermes

CLI plus a ready skill file: gate4ai skill > SKILL.md.

How to connect

Built to be checked

You should not have to trust us. So you can verify.

  • Open source

    Core with the Browser and Files, relay and SDK are on GitHub. Core and relay are AGPL-3.0, the SDK is Apache-2.0.

  • Signed releases

    Checksums are signed with cosign; the installer refuses a tampered archive.

  • Signed connectors

    Store connectors are WASM modules without network access, signed by the publisher; the store index is signed by gate4.ai. Revoked versions do not install.

  • Local first

    No account and no cloud. Your rules, secrets and journal stay on your computer; the relay is optional.

Put a guard on your agents in a minute.

macOS / Linux Windows
curl -fsSL https://gate4.ai/install.sh | sh

Then run gate4ai ui: the setup wizard opens in your browser and connects your agent, folders and sites. The installer opens it for you on a computer with a desktop. More