Quick start

Requirements

Node.js 22+
pnpm (for the from-source install below)

Install

git clone https://github.com/wookat/agentgate.git
cd agentgate
pnpm install
pnpm build

alias agentgate="node $PWD/packages/cli/dist/index.js"

1. Scan

Audit every MCP server your clients (Claude Desktop, Claude Code, Cursor, VS Code, Codex, OpenCode) are configured to run — config paths are discovered automatically:

agentgate scan                 # static config analysis, terminal table
agentgate scan --live          # also connect to stdio servers and audit their live tool surface

Machine-readable output:

agentgate scan --format json -o report.json     # open it in the report viewer
agentgate scan --format sarif -o report.sarif   # for GitHub code scanning

Drop report.json into the report viewer for a visual, filterable report.

You can also scan an MCP server repo for source-level issues:

agentgate scan path/to/repo

2. Lock

Pin the tool surface your agent sees — every tool’s name, description, and input schema — into agentgate.lock:

agentgate lock
git add agentgate.lock

Commit the lockfile. It is your reviewed, approved baseline (format: lockfile spec).

3. Gate

Fail the build when anything drifts from the baseline or a severe finding appears:

agentgate diff                 # exit 1 + human-readable diff on any drift
agentgate ci --fail-on high    # drift OR high-severity findings → non-zero exit

GitHub Actions:

name: mcp-gate
on: [push, pull_request]
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: wookat/agentgate/packages/action@main
        with:
          command: ci
          args: --fail-on high

Recipes for GitLab CI, CircleCI, Jenkins, and Azure Pipelines: CI integration guide.

Next steps

CLI reference — every command and flag.
Rule reference — what each of the seven rules detects.
Threat model — what AgentGate defends against, with real incidents.
Advisory database — known-bad MCP packages, cross-checked on every scan.