GATE022: Agent configuration is not tracked in version control

A discovered agent configuration file is not tracked by git, so changes to it are never reviewed.

Name
Severity
Type
Low
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Explain locally
Type
gate explain GATE022
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found an agent or MCP configuration file inside a git repository that git does not track. Repositories that are not git repositories are skipped, as are files that are explicitly git-ignored and named as a local override (settings.local.json), which are meant to be untracked.

Why this matters

An untracked configuration file grants real capability and receives no review. Nobody sees it in a pull request, nobody notices when it changes, and git log cannot tell you when the agent gained the ability to run shell commands. It also differs silently between machines, so "it works on my laptop" becomes a security statement rather than a build one.

This is low because it is a process weakness rather than an exposure. It is reported because it is the reason many of the other findings in this list went unnoticed for months.

Example

This is the shape of configuration that triggers the rule.

.mcp.json          (untracked)
.cursor/mcp.json   (untracked)

Remediation

Commit shared agent configuration so that changes to it go through review like any other change. Keep genuinely personal settings in the documented local-override file (for example .claude/settings.local.json) and git-ignore that file explicitly.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE022',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.