gate explain

The answer to "so what?". Works on a rule ID, a capability class, or a tool name, because developers do not memorise rule numbers: they see a tool in their config and want to know whether it is dangerous.

Usage

gate explain GATE005
gate explain execute
gate explain postgres.execute_query

No network access, no configuration, nothing to look up. The text lives in the rule definition, so the terminal and the rule reference cannot disagree.

Explaining a rule

gate explain GATE005

Prints the full rule page: severity, capabilities, what Gate detected, why it matters, a realistic example (and a safer version of it where one exists), remediation, and references.

Rule IDs are case-insensitive, so gate explain gate005 works too.

Explaining a capability

gate explain execute

Prints what the capability means, its baseline risk, the combinations it becomes dangerous in, and every rule that checks for it.

Valid values: read, search, write, communicate, delete, identity, admin, secrets, execute, financial.

Explaining a tool

gate explain postgres.execute_query
gate explain delete_branch

Classifies the tool the same way a scan would, and shows the result:

postgres.execute_query  tool
Risk: CRITICAL
Capabilities: read, write, delete, execute
Recognised server: PostgreSQL

What this means

  read - Observe data the agent has been granted access to.
  write - Modify persistent state.
  delete - Destroy state, often irreversibly.
  execute - Run arbitrary code or commands.

Dangerous combinations present in this tool alone

  arbitrary execution + destructive operations

Rules that would fire

  GATE005  CRITICAL  Arbitrary command execution capability
  GATE010  HIGH      Destructive tool exposed

This is the fastest way to evaluate a tool you are considering adding, before it is in your configuration at all.