PreToolUse Hooks vs Advisory Prompt Rules
Why files like .cursorrules and CLAUDE.md cannot protect your codebase from high-risk agent operations, and how protocol-level PreToolUse hooks enforce deterministic safety.
Why this page exists
- Advisory files like CLAUDE.md are hints that the model can choose to ignore under pressure.
- Real security requires blocking unsafe operations before they hit the terminal or file system.
- PreToolUse hooks fire on every tool call and cannot be reasoned away by the agent — the gate always evaluates and logs the action, and hard-blocks secret exfiltration and guardrail-tampering by default.
The Vulnerability of Prompt-Level Rules
Files like .cursorrules, CLAUDE.md, or custom prompt instructions are simply part of the model's context window. They instruct the model on how it should behave. However, this model suffers from structural weaknesses:
- Context Drift: As conversations grow, early prompt instructions are deprioritized or pushed out of attention.
- Jailbreaking: The user prompt or an external file read can override instructions, forcing the agent to bypass its own rules.
- Self-Modification: Agents with file-writing privileges can edit or delete
.cursorrulesfiles to bypass constraints.
Deterministic PreToolUse Hook Enforcement
A PreToolUse hook intercepts execution at the Model Context Protocol (MCP) or platform layer. When the agent attempts to run a bash command, modify a file, or query a database, the call is evaluated by a local policy engine before execution.
If the action matches a known-bad pattern or violates a policy, the hook flags and logs the decision by default and returns a structured response. For secret exfiltration and attempts to disable ThumbGate's own guardrails, it hard-blocks the call by default, preserving system state before the error can happen; rm -rf-class destructive commands, force-push, and supply-chain risks warn by default. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block every matched rule.
FAQ
Why are CLAUDE.md and .cursorrules files insufficient for security?
They are advisory prompt-level files. The agent can ignore them, overwrite them, suffer from context drift, or be jailbroken into bypassing them since they are not enforced at the runtime level.
How does a PreToolUse hook protect the codebase?
PreToolUse hooks intercept every tool call at the protocol layer before it executes, flagging and logging each decision deterministically rather than probabilistically. If a command matches a catastrophic class (secret exfiltration, rm -rf, supply-chain), the hook denies execution by default; other matched patterns warn by default and are denied when THUMBGATE_STRICT_ENFORCEMENT=1 is set.