Gate

Changelog

Gate follows semantic versioning. Rule IDs are stable across every version: a retired rule keeps its number and is marked deprecated rather than reused, because a suppression written against GATE007 must never silently start suppressing something else.

0.1.0

The first release. Gate scans AI agent and MCP configurations for dangerous permissions, exposed credentials and excessive access.

The CLI

  • gate scan: static, local, read-only analysis of agent configuration
  • gate explain: explain a rule, a capability, or a tool
  • gate rules: list every check
  • gate init: write a documented gate.config.ts, and optionally a CI workflow
  • gate fix: scaffolded; applies only provably safe transforms, and there are none yet

Detection

  • Adapters for Claude Code, VS Code, Cursor, Windsurf, Codex CLI and Gemini CLI
  • A generic adapter for any JSON file containing an mcpServers object, so an ecosystem Gate has never heard of still gets scanned
  • A TOML subset parser for Codex configuration, with no new dependency

Analysis

  • Ten capability classes with deterministic classification
  • 22 rules, GATE001 through GATE022
  • An explainable blast radius with named contributors and escalation floors
  • Conservative secret detection with heavy false-positive suppression
  • Baselines and diffing, so CI can say "this change increases the agent's blast radius"

Output

  • Human-readable terminal output, with all scanned content sanitised against terminal escape injection
  • --json, validated against a published schema and re-scanned for credential shapes before printing
  • --sarif for GitHub code scanning
  • Documented exit codes that distinguish findings from internal errors

CI

  • A composite GitHub Action that runs the published CLI rather than a bundled copy, with job summaries and fail-on-new-only

Known limitations

  • Local stdio MCP servers are not launched during --inspect without a second explicit flag. Starting one runs a command line out of the file being audited, and Gate cannot sandbox that yet.
  • GATE016 (description contradicts capability) only fires on tools discovered by --inspect, because static configuration carries no tool descriptions.
  • Production detection is a heuristic and is phrased as possible production access.

Was this page helpful?