Scan your first repository

Point Gate at a project. It finds the agent configuration itself. There is nothing to set up first.

Run it

cd your-project
npx @usegate/cli scan

Gate discovers the MCP servers and agent settings in the repository, classifies what each tool can do, runs its rules, and prints a blast radius.

You can also scan a directory you are not in:

gate scan ../some-other-project

The scan is read-only. Gate opens configuration files and nothing else. It does not start your MCP servers, write to your repository, or make network calls.

What Gate read

Gate looks for the configuration formats real agents use:

New agent frameworks appear faster than adapters can be written for them, and nearly all of them copy the same JSON shape, so Gate scans a tool it has never heard of anyway.

See supported agents for the full behaviour.

Nothing found?

No agent or MCP configuration found in this repository.

This is the correct result for a repository with no agents in it.

If you expected a finding:

• Is the config outside the repository? Many editors store MCP servers in a user-level file (~/.claude.json, ~/.cursor/mcp.json). Gate scans the repository you point it at. It reviews what a team ships, not your laptop.
• Is it git-ignored? Gate reads ignored files too, but check your ignorePaths in gate.config.ts.
• Is the JSON valid? Gate warns rather than failing when it cannot parse a file. Look for a warning: line in the output.

Try it on a fixture

The Gate repository ships small fixture repositories that each demonstrate a class of problem, so you can see real output before pointing it at your own code:

git clone https://github.com/usegate/gate
cd gate
npx @usegate/cli scan fixtures/production-postgres
npx @usegate/cli scan fixtures/broad-filesystem
npx @usegate/cli scan fixtures/safe

Every credential in those fixtures is synthetic. They are shaped like the real thing so the detectors have something to detect, and have never been valid for anything.

Next