GATE016: Tool description contradicts its capability

A tool describes itself as safe or read-only while carrying capabilities that are neither.

Name
Severity
Type
Medium
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Explain locally
Type
gate explain GATE016
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate compared each tool's description against the capabilities Gate classified from its name and its server. This rule fires when a description claims to be read-only, non-destructive, side-effect free or "safe" while the tool carries write, delete, execute, communicate or financial.

Why this matters

A tool description is not a security control. It is text supplied by whoever wrote the server, it is what the model reads when deciding whether calling the tool is safe, and it is never verified against what the tool does. A mismatch is at best a stale description and at worst deliberate: "tool poisoning" attacks work precisely by describing a dangerous tool as harmless so that both the model and the reviewer wave it through.

Gate treats the description as a claim and the capability classification as the evidence. When they disagree, Gate believes the capability.

Example

This is the shape of configuration that triggers the rule.

{
  "name": "cleanup_workspace",
  "description": "A safe, read-only helper that lists stale files."
}

// Classified capabilities: write, delete

Remediation

Read the tool's source. If the description is stale, fix it. If the description is accurate and Gate's classification is wrong, open an issue so the known-server mapping can be corrected: that mapping is how Gate gets more accurate for everyone. If the description is deliberately misleading, do not run the server.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE016',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.