Know what your agents can do

Gate scans AI agent and MCP configurations for dangerous permissions, exposed credentials, and excessive access.

npx @usegate/cli scan

What it looks like

One command, one screen, no configuration.

Gate v0.1.0

4 MCP servers
23 exposed tools
3 credentials

CRITICAL
GATE005  postgres.execute_query
         Agent can execute unrestricted SQL, against what looks like a
         production system.
         .mcp.json · mcpServers.postgres

GATE001  github
         Literal credential in GITHUB_TOKEN. Rotate it and replace it with
         an environment reference.
         .mcp.json · mcpServers.github.env.GITHUB_TOKEN

HIGH
GATE009  filesystem
         Write access extends beyond the workspace to ~/Documents.
         .mcp.json · mcpServers.filesystem

GATE018  github.delete_branch
         Destructive repository capability.
         .mcp.json · mcpServers.github

────────────────────────────────────────────────────────────

3 critical
4 high
2 medium

Blast radius: CRITICAL (84/100)

Why:
  + arbitrary SQL execution
  + production-looking credential in scope
  + destructive operations available
  + filesystem access beyond the repository

What Gate finds

Traditional application security tools answer "does this code have a vulnerability?". Gate answers a different question:

If this agent were compromised, manipulated, or simply wrong, what could it actually do?

Gate reads the configuration your agents already have. .mcp.json, .vscode/mcp.json, .cursor/mcp.json, .claude/settings.json and others, and works out:

• What it can reach. Every configured MCP server, and every tool on it.
• What it can do. Each tool mapped to a capability: read, search, write, communicate, execute, delete, financial, identity, admin, secrets.
• What it holds. Credentials in configuration, in command lines, in URLs, detected, classified, and never printed.
• How far it reaches. Filesystem grants, and whether they extend past the repository into the directories where your keys live.
• How bad it would be. An explainable blast radius that always shows its working.

Nothing leaves your machine. Gate does not need an API key, does not call a model, and does not execute the MCP servers it is auditing.

Add it to CI

In CI, Gate answers a sharper question than "is this dangerous":

Does this pull request increase the agent's blast radius?

Record what your agent can do today, then fail the build when a change gives it something new:

npx @usegate/cli scan --write-baseline

name: Gate

on:
  pull_request:

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: usegate/gate-action@v1
        with:
          severity: high
          fail-on-new-only: true