gate.config.ts

Gate works with no configuration at all. Add a config file when you want to change the threshold, suppress a finding, or record why something is acceptable.

Creating one

gate init

gate.config.ts

import { defineConfig } from '@usegate/core'

export default defineConfig({
  severity: 'high',

  ignore: [
    {
      rule: 'GATE007',
      reason: 'Internal development MCP server, pinned in our own registry',
    },
  ],

  telemetry: true,
})

Options

Name
severity
Type
'info' | 'low' | 'medium' | 'high' | 'critical'
Description
Severity at which gate scan exits non-zero. Default 'high'.
Name
ignore
Type
IgnoreEntry[]
Description
Suppressed findings. Each entry may match on rule, path, server, or a combination, and requires a reason. See ignoring findings.
Name
ignorePaths
Type
string[]
Description
Repository-relative paths excluded from discovery. Supports * and **.
Name
adapters
Type
{ include: string[]; exclude: string[] }
Description
Which adapters run. An empty include means all detected adapters.
Name
telemetry
Type
boolean
Description
Send anonymous aggregate usage data. Default true. See telemetry.
Name
baseline
Type
string | false
Description
Baseline path, or false to disable. Default '.gate/baseline.json'.
Name
requireIgnoreReason
Type
boolean
Description
Refuse to honour an ignore entry with no reason. Default true. Turning it off lets exceptions accumulate with no record of why.
Name
limits
Type
{ maxFiles: number; maxFileSizeBytes: number }
Description
Hard caps on discovery. Defaults: 2000 files, 2 MB per file.

File formats

Gate looks for these, in order:

gate.config.ts
gate.config.mts
gate.config.mjs
gate.config.js
gate.config.json
a "gate" key in package.json

gate.config.json

{
  "severity": "high",
  "ignore": [
    { "rule": "GATE007", "reason": "Pinned in our internal registry" }
  ],
  "telemetry": true
}

TypeScript config files need Node 22.18 or newer, which strips types natively. On an older runtime Gate reports the problem and exits 2. It will not skip the file quietly. Use gate.config.json in constrained CI images.

Precedence

Command-line flags beat the config file. That lets a pipeline be stricter than a developer's laptop without editing anything:

gate scan --severity critical   # overrides severity: 'high'
gate scan --no-telemetry        # overrides telemetry: true