Security model

Gate is a security tool that reads your most sensitive configuration. These are the principles it is built on.

Local first

A default scan happens entirely on your machine. No network call is required to produce a complete result. Gate needs no account, no API key, and no model.

This is not only a privacy position. A check that depends on a service stops running when the service is down, and a check that needs an API key is one more thing to provision before it can go into CI.

Telemetry is a small, separable, documented side channel, never a dependency. Turn it off and everything still works identically.

Never exfiltrate secrets

Raw credentials never leave your machine. They are never written to Gate's output, never written to a baseline, and never included in telemetry.

This is enforced structurally rather than by care. Adapters read raw bytes and immediately convert them into redacted structures; everything downstream of that boundary works only with classifications, never values. Gate's own JSON output path re-scans itself for credential shapes before printing and refuses to emit anything that matches.

Read the details in secret handling.

Deterministic security

Findings come from explicit rules with stable IDs. The same configuration always produces the same findings, with no model in the loop and no network access.

Gate's output is meant to fail builds. If it returned different answers on different days, teams would learn to re-run it until it passed.

Gate may one day use a model to help classify tools it has never seen. It will never use one as the authoritative source for a finding a rule can cover, and it will never require an API key for core functionality.

Explain everything

Every finding carries an ID, a severity, a title, an explanation, evidence, a remediation, and references. Every blast-radius score shows the contributors that produced it.

gate explain GATE005

Safe by default

gate scan never executes an MCP server. It reads configuration and stops.

Deep inspection, connecting to a server and asking it what tools it has, requires --inspect, and even then Gate only enumerates capabilities. It never calls a discovered tool.

Launching a local stdio server is different in kind: it means executing a command line taken from a file Gate was asked to audit. If that file is hostile, the command runs as you. Gate refuses by default even under --inspect. There is an explicit, loudly-warned escape hatch, documented as unsafe.

That decision costs Gate accuracy on local servers. It is the right trade.

Small blast radius beats perfect intelligence

Gate assumes models can fail. It assumes they can be manipulated. It assumes that somewhere in your agent's context there will eventually be text written by someone who wants something from it. None of that is pessimism about AI. It is the same assumption security has always made about every other component.

The response is not to make the agent smarter. It is to make its failures survivable:

• an agent that cannot delete cannot delete by mistake
• an agent that cannot reach ~/.ssh cannot be talked into reading it
• an agent that cannot send data outside the system cannot exfiltrate it

Gate measures those boundaries and tells you where they are missing. It does not try to predict what your agent will do.