Capabilities

Tool names differ across ecosystems. Consequences do not. write_file, fs.put, edit and apply_patch are four names for "this agent can change bytes on disk", and Gate normalises all of them to one capability before any rule runs.

This is the idea the rest of Gate is built on. It is why a rule written once works across Claude Code, VS Code, Cursor, Windsurf, Codex and a tool nobody has built yet.

The ten classes

Name
read
Type
baseline risk: low
Description
Observe data the agent has been granted access to. read_file, get_issue, retrieve_record.
Name
search
Type
baseline risk: low
Description
Discover data across a corpus, including data nobody pointed at. search_repositories, grep, query_documentation.
Name
write
Type
baseline risk: medium
Description
Modify persistent state. write_file, update_record, create_issue.
Name
communicate
Type
baseline risk: medium
Description
Send information outside the system. send_email, post_message, create_comment, and also fetch, because an outbound request is how data leaves.
Name
delete
Type
baseline risk: high
Description
Destroy state, often irreversibly. delete_file, drop_table, delete_branch.
Name
identity
Type
baseline risk: high
Description
Change who is able to act, or issue credentials. create_user, reset_password, issue_token.
Name
admin
Type
baseline risk: high
Description
Change the rules of the system: permissions, policy, ownership, branch protection, webhooks.
Name
secrets
Type
baseline risk: high
Description
Read credential material. read_secret, list_secrets, or filesystem access to ~/.aws.
Name
execute
Type
baseline risk: critical
Description
Run arbitrary code or commands. Shell tools, code interpreters, container exec, unrestricted SQL.
Name
financial
Type
baseline risk: critical
Description
Move or commit money. create_refund, transfer_funds, create_charge.

A tool usually carries several. postgres.execute_query is execute + read + write + delete. The name alone tells you none of that.

How classification works

Deterministic and layered, most trustworthy first:

Known-server mapping. When Gate recognises the exact package, it knows the real tool list and what each tool does. This is fact, not inference.
Name tokens. The verb in the tool name, tokenised across snake_case, kebab-case, dotted.paths and camelCase.
Description keywords. Only ever additive, and never sufficient on their own to raise something to execute or financial.

That third restriction is a security boundary, not a heuristic. A tool description is text written by whoever wrote the server, and it is what the model reads when deciding whether calling the tool is safe. If a description could lower a classification, a hostile tool could describe its way out of a finding.

gate explain postgres.execute_query
gate explain execute

Dangerous combinations

Individual capabilities get reviewed individually, and individually most of them look reasonable. The danger is compositional.

Combination	Severity	Why
`secrets` + `communicate`	critical	A complete exfiltration path. One malicious instruction is enough.
`execute` + `communicate`	critical	A remote shell with extra steps.
`execute` + `delete`	critical	A mistake can destroy state nothing can restore.
`financial` + `execute`	critical	Money movement should never share a blast radius with arbitrary code.
`admin` + `execute`	critical	The agent can grant itself anything it is missing.
`identity` + `secrets`	high	Lateral movement becomes trivial.
`read` + `communicate`	medium	Anything readable is sendable. Reported when reads reach outside the repository.

GATE015 checks for these. The read + communicate row is the general case of what Simon Willison named the lethal trifecta: access to private data, exposure to untrusted content, and a way to communicate externally.

Implied capabilities

Some capabilities include others by definition, and Gate expands them:

delete implies write
financial implies write
identity implies write
admin implies write

execute implies nothing. It does subsume everything (an agent that can run sh -c can read, write and delete whatever the process can) but expanding it would make every execution finding fire three other rules as well. Instead the blast-radius engine treats execution as dominant, with its own contributor and its own escalation floor.

When Gate is unsure

Gate does not invent tool lists. When it recognises a server's category but not its exact package, it records a capability posture instead:

GATE005  db
         db: PostgreSQL server; tool set not enumerated, capabilities
         inferred from the server type - can execute arbitrary commands
         or queries.

That is why a scan can report 0 tools and still produce a critical finding. Counting tools a server might not have would make Gate's headline numbers wrong, and wrong numbers are worse than coarse ones.

The fix is a known-server mapping, which turns a guess into a fact, for you and for everyone else who scans that server.