> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# CodeGate

> Pre-flight security scanner for AI coding tool configurations. Detect malicious intent in MCP servers, hooks, rules, and workspace settings before execution.

CodeGate inspects what your AI coding tools are about to trust — before they execute it. It scans MCP server configs, hooks, rules, skills, and workspace settings for hidden risks, giving you visibility and control before any agent runs.

<CardGroup cols={2}>
  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Install CodeGate and run your first scan in under two minutes.
  </Card>

  <Card title="Why CodeGate" icon="shield-halved" href="/why-codegate">
    Understand the threat landscape that motivated this project.
  </Card>

  <Card title="scan command" icon="magnifying-glass" href="/commands/scan">
    Scan directories, files, or URLs for AI tool config risks.
  </Card>

  <Card title="Configuration" icon="gear" href="/configuration/overview">
    Customize thresholds, suppression rules, and output formats.
  </Card>
</CardGroup>

## How CodeGate works

CodeGate runs a layered analysis pipeline on your AI tool configuration surfaces before anything executes.

<Steps>
  <Step title="Discovery (Layer 1)">
    CodeGate walks your project directory and locates all AI tool configuration files — MCP server definitions, hooks, rules, skills, IDE settings, and workspace configs.
  </Step>

  <Step title="Static analysis (Layer 2)">
    A rule engine evaluates each discovered artifact offline, flagging patterns like environment variable overrides, command injection paths, consent bypass attempts, and rule injection.
  </Step>

  <Step title="Deep scan (Layer 3, opt-in)">
    When you pass `--deep`, CodeGate fetches external MCP server metadata and routes it through a local AI meta-agent for deeper behavioral analysis.
  </Step>

  <Step title="Remediation (Layer 4, opt-in)">
    With `--remediate` or `--fix-safe`, CodeGate proposes or applies fixes. Every change is backed up under `.codegate-backup/` and reversible with `codegate undo`.
  </Step>
</Steps>

## Key capabilities

<CardGroup cols={2}>
  <Card title="Wrapper mode" icon="play" href="/commands/run">
    `codegate run claude` scans first and blocks dangerous launches automatically.
  </Card>

  <Card title="Workflow audits" icon="code-branch" href="/scanning/workflow-audits">
    Audit GitHub Actions workflows for supply chain risks and injection patterns.
  </Card>

  <Card title="Multiple output formats" icon="file-export" href="/scanning/output-formats">
    Export findings as JSON, SARIF, Markdown, HTML, or terminal output.
  </Card>

  <Card title="CI integration" icon="circle-check" href="/integrations/ci-github-actions">
    Upload SARIF results directly to GitHub Code Scanning.
  </Card>
</CardGroup>

<Note>
  CodeGate is an awareness and pre-flight inspection tool. It improves visibility and decision quality — it is not a guarantee of safety and does not replace secure engineering review.
</Note>