Rules
Gate ships 22 deterministic security rules. Each one has a stable ID, a documented reason, and a remediation you can act on.
See them in your terminal
gate rules
gate explain GATE005
All rules
| Rule | Severity | Title |
|---|---|---|
| GATE001 | Critical | Hardcoded credential in agent configuration |
| GATE004 | Critical | Credential embedded in URL |
| GATE005 | Critical | Arbitrary command execution capability |
| GATE008 | Critical | Sensitive filesystem path exposed to agent |
| GATE011 | Critical | Financial capability exposed |
| GATE015 | Critical | Excessive capability combination |
| GATE002 | High | Credential passed in command arguments |
| GATE003 | High | Insecure remote MCP transport |
| GATE006 | High | Shell wrapper execution in MCP command |
| GATE009 | High | Filesystem access extends beyond the repository |
| GATE010 | High | Destructive tool exposed |
| GATE012 | High | Administrative capability exposed |
| GATE013 | High | Secret retrieval capability exposed |
| GATE014 | High | Possible production environment access |
| GATE018 | High | Dangerous capability added since baseline |
| GATE020 | High | Environment passthrough exposes multiple credentials to one server |
| GATE007 | Medium | Unpinned MCP package |
| GATE016 | Medium | Tool description contradicts its capability |
| GATE017 | Medium | Remote MCP server has no configured authentication |
| GATE019 | Medium | Agent auto-approves tool execution |
| GATE021 | Medium | MCP server sourced from an unverified remote script |
| GATE022 | Low | Agent configuration is not tracked in version control |
How rules work
Rules are deterministic. Given the same configuration they always produce the same findings, with no network access, no model, and no ambient state. That is what makes it reasonable to fail a build on their output.
Rules reason about capabilities, not tool names. write_file, fs.put and apply_patch are three names for the same consequence, and Gate normalises all of them before any rule runs. That is why a rule written once works across Claude Code, VS Code, Cursor, Windsurf, Codex and anything else that speaks MCP.
IDs are stable forever. A retired rule keeps its number and is marked deprecated rather than being reused, because a suppression written against GATE007 must never silently start suppressing something else.
Every rule on this page was generated from its own definition in packages/rules. The text you read here is the text gate explain prints, because there is only one copy of it.