Baselines

A baseline records what your agent could already do, so the next scan can answer a much sharper question than "is this dangerous?"

Did this change make it more dangerous?

Why

That is the question a pull request needs answered.

A repository that has always had a shell tool does not need to fail every build: the team made that decision and lives with it. A repository that just gained one has made a new decision, usually inside a diff about something else, and usually without anyone framing it as a security change.

A one-line addition to .mcp.json can grant an agent the ability to delete production data. It reviews like configuration and behaves like a privilege grant. Baseline diffing is how that becomes visible.

Recording one

gate scan --write-baseline

Writes .gate/baseline.json. Commit it. A baseline in .gitignore is a baseline that does nothing in CI.

Using one

gate scan --baseline .gate/baseline.json

Gate uses .gate/baseline.json automatically when the file exists, so in practice you just run gate scan.

Blast radius: CRITICAL (79/100)

This change increases the agent's blast radius.
NEW capabilities: execute, delete
2 new · 5 unchanged · 1 resolved
Baseline blast radius was MODERATE, recorded 2026-08-01.

Findings are marked NEW in the output. Combined with fail-on-new-only, that lets you adopt Gate on a repository with existing findings without disabling it on day one.

What's in the file

{
  "version": 1,
  "gateVersion": "0.1.0",
  "createdAt": "2026-08-01T09:14:22.104Z",
  "blastRadius": { "level": "moderate", "score": 34 },
  "capabilities": ["read", "search", "write"],
  "findings": [
    {
      "fingerprint": "5f1c9a2e77b04d13",
      "ruleId": "GATE007",
      "severity": "medium",
      "subject": ".mcp.json claude-code:github"
    }
  ],
  "servers": [{ "name": "github", "capabilities": ["read", "write"] }]
}

Fingerprints, rule IDs, severities, capability names, server names. That is all.

Baselines get committed to repositories, frequently public ones, so a baseline that carried evidence would be a way to publish exactly the findings Gate exists to keep quiet. Fingerprints are derived from rule ID, location and subject, never from a value.

Updating it

When you deliberately add a capability, update the baseline in the same pull request:

gate scan --write-baseline
git add .gate/baseline.json

The diff then shows the decision alongside the change that motivated it, which is exactly where a reviewer wants to see it.