GATE018: Dangerous capability added since baseline

This change gives the agent a capability class it did not have in the recorded baseline.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Explain locally
Type
gate explain GATE018
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate compared the current capability set against .gate/baseline.json and found a newly-present capability from the dangerous set: execute, delete, financial, admin, secrets or identity. This rule only runs when a baseline is supplied, which in practice means in CI.

Why this matters

This is the finding that makes Gate useful in a pull request. A repository that has always had a shell tool does not need to fail every build: the team made that decision and lives with it. A repository that just gained one has made a new decision, usually inside a diff about something else, and usually without anybody framing it as a security change.

A one-line addition to .mcp.json can grant an agent the ability to delete production data. It reviews like configuration and behaves like a privilege grant. Baseline diffing is how that becomes visible.

Example

This is the shape of configuration that triggers the rule.

Blast radius: HIGH  (was MODERATE)

NEW capabilities: execute, delete

  + postgres.execute_query
  + postgres.drop_table

Remediation

Review the change as a permission change, not a configuration change. If the new capability is intended, update the baseline in the same pull request so the decision is recorded alongside the reason. If it is not intended, remove it before merging.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE018',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.