Claude's browser tool can click "Buy" by accident. Anthropic's browser_toolset_20260801 docs are explicit that confirmation, spend limits, and audit logging are entirely up to the integrator — there's nothing built in. Gatekit is the executor layer that sits between your agent loop and whatever actually drives the browser, so a bad click can't silently turn into a purchase.

It doesn't talk to the browser itself. You hand it a run(action) function — the thing that actually clicks, types, or submits — and Gatekit decides whether that call is allowed to happen, then records that it did.

const { Gatekit, GatekitDeniedError } = require('gatekit-executor');

const gk = new Gatekit({
  allowlist: [{ domain: 'shop.example.com' }],
  confirm: async (action) => askHumanToApprove(action), // e.g. Slack, CLI prompt
  spendCap: 50,
  actionCost: (action) => (action.type === 'purchase' ? action.amount : 0),
  rateLimit: { max: 20, windowMs: 60_000 },
});

try {
  await gk.execute({ type: 'click', domain: 'shop.example.com', label: 'Buy' }, async (action) => {
    return browser.click(action.label);
  });
} catch (err) {
  if (err instanceof GatekitDeniedError) {
    // denied by allowlist, spend cap, rate limit, or a declined confirmation
  }
}

What it does

Confirmation gate — anything that isn't a plain read (navigate, screenshot, extract, scroll, wait) requires your confirm(action) callback to return true before it runs. Override isConsequential if your action taxonomy differs.
Domain + action allowlist — fails closed. No allowlist entry means no action, full stop.
Spend cap — track running cost via actionCost(action) and refuse anything that would push the total over spendCap.
Rate limit — a sliding window (max actions per windowMs) to blunt runaway loops.
Tamper-evident audit log — every allowed and denied action is appended to a SHA-256 hash chain. verifyAuditLog() recomputes it and tells you if any entry was edited or reordered after the fact.
Checkpoint / rollback — snapshot whatever state you're tracking (cart contents, DOM hash, cookies) before a risky step and restore it if things go wrong. This rolls back your tracked state, not a purchase that already went through server-side.