ThumbGate Verification evidence
comparison | thumbgate vs heidi

# ThumbGate vs HEIDI

HEIDI (Meterian) scans dependency manifests for known CVEs and feeds live vulnerability data to AI assistants via MCP. ThumbGate intercepts AI agent tool calls before they fire and blocks ones matching previously-seen failure patterns. Same audience, different layers.

ThumbGate: agent behavior enforcement (PreToolUse hook)
HEIDI: supply-chain scanning (manifest + MCP)

## The short answer

Not a direct competitor. HEIDI answers "is this package vulnerable?" ThumbGate answers "did the AI just repeat a mistake we already saw?" Different threat surfaces. Both local-first. Both free at base tier. Run both if you ship AI-generated code to production.

## Comparison table

Dimension | HEIDI (Meterian) | ThumbGate
--- | --- | ---
Question it answers | Is this package vulnerable? | Did the AI just repeat a mistake?
Surface scanned | Manifest files (package.json, requirements.txt, etc.) | AI agent tool calls (Bash, Edit, Write, etc.)
Integration model | Passive — AI assistant queries HEIDI via MCP for vuln data | Active — PreToolUse hook intercepts tool call before execution
Threat category | Supply chain (CVE-driven) | Behavioral (lesson-DB-driven from your thumbs-up/down)
IDE / agent support | VS Code, JetBrains, Cursor, Windsurf, Claude Code, Copilot, Gemini CLI, Codex CLI | Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode (via MCP / PreToolUse hooks)
Source code stance | Scans only manifest files; source stays on-machine | Local-first; lesson DB stays on-machine; no source uploaded
Pricing | Free | Free CLI (5 active rules) → $19/mo Pro for unlimited
Maker | Meterian (established supply-chain security firm) | ThumbGate (open-source devtool)

## When to install HEIDI

- Your AI assistant keeps suggesting deps with known CVEs.
- You want live vulnerability data injected into Copilot / Cursor / Claude Code at suggest-time, not after.
- You need a free, IDE-native CVE scanner for npm / pip / maven manifests.
- You care about supply-chain attestation more than agent-behavior repeat-prevention.

## When to install ThumbGate

- You've watched the same class of AI-agent failure recur across runs (wrong path, wrong env, repeated lint failure, file overwrites).
- You want failure patterns blocked at the tool-call layer, not caught post-hoc by CI.
- You're running 5+ agents and need shared lesson memory across them.
- You want a thumbs-down → prevention-rule loop instead of writing rules manually.

## Running both

HEIDI's MCP server and ThumbGate's PreToolUse hook do not conflict. A reasonable stack for a serious AI-coding workflow:

- HEIDI — query layer your AI assistant calls to check CVEs before suggesting a dep.
- ThumbGate — gate layer that blocks the agent's tool call if it matches a known-bad pattern from your own feedback history.
- Both run local-first. Both are free at base tier. Together they cover supply-chain risk + behavioral risk for under 10 minutes of setup.

## FAQ

Is HEIDI a direct ThumbGate competitor?

No. Different threat surfaces. Same buyer category, but addressing distinct failure modes. Heidi is from Meterian, an established supply-chain security firm; ThumbGate is an independent open-source devtool focused on agent behavior.

Should I install HEIDI or ThumbGate first?

If your blocker is "the AI keeps suggesting vulnerable packages," install HEIDI first. If your blocker is "the AI keeps making the same tool-call mistake," install ThumbGate first. Most teams shipping AI-generated code need both eventually.

Can ThumbGate import HEIDI's CVE data?

Not today. Both expose MCP servers, so a future integration where ThumbGate consults HEIDI's vulnerability index before allowing a `npm install ` tool call is technically feasible. We're open to that conversation.