> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> CodeGate is a pre-flight security scanner and remediation tool for AI coding tool configuration risk. It surfaces hidden execution surfaces before your coding agent runs.

CodeGate inspects what your AI coding tools are about to trust — before they execute it. Repository-controlled files like MCP server definitions, hooks, rules, and workspace settings can alter agent behavior in ways that are easy to miss. CodeGate makes those surfaces visible at launch time.

## What CodeGate is

* A pre-flight inspection tool that runs before you launch an AI coding agent
* A layered scanner that detects risky configuration and instruction patterns
* A workflow gate that can block dangerous launches with `codegate run <tool>`
* A way to visualize configuration surfaces you may not have reviewed

## What CodeGate is not

<Note>
  CodeGate is not a guarantee of safety. It can produce false positives and false negatives. It does not replace secure engineering judgment, review, and hardening, and it cannot promise that every malicious pattern will be detected. CodeGate is designed to improve visibility and decision quality before execution — not to function as an absolute safety net.
</Note>

## Analysis layers

CodeGate runs a four-layer pipeline on your AI tool configuration surfaces.

| Layer | Name                 | Description                                                                                                                                                                                                                   |
| ----- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| L1    | Discovery            | Locates all AI tool configuration files — MCP server definitions, hooks, rules, skills, IDE settings, and workspace configs.                                                                                                  |
| L2    | Static analysis      | Evaluates each artifact offline using a rule engine. Flags patterns like `ENV_OVERRIDE`, `COMMAND_EXEC`, `CONSENT_BYPASS`, `RULE_INJECTION`, `IDE_SETTINGS`, `SYMLINK_ESCAPE`, `GIT_HOOK`, `NEW_SERVER`, and `CONFIG_CHANGE`. |
| L3    | Deep scan (opt-in)   | Fetches external MCP server metadata and routes it through a local AI meta-agent for deeper behavioral analysis. Requires `--deep` and explicit per-resource consent.                                                         |
| L4    | Remediation (opt-in) | Proposes or applies fixes. Every change is backed up under `.codegate-backup/` and reversible with `codegate undo`.                                                                                                           |

Layers 1 and 2 are offline-first and deterministic. Layer 3 is opt-in and consent-driven per resource and per command.

## Supported AI tools

`codegate run` supports launching these tools after a successful pre-flight scan:

* `claude` — Claude Code
* `codex` — Codex CLI
* `opencode` — OpenCode
* `cursor` — Cursor
* `windsurf` — Windsurf
* `kiro` — Kiro

## All commands

| Command                           | Purpose                                                       |
| --------------------------------- | ------------------------------------------------------------- |
| `codegate scan [target]`          | Scan a directory, file, or URL for AI tool config risks       |
| `codegate scan-content <content>` | Scan inline JSON, YAML, TOML, Markdown, or text content       |
| `codegate run <tool>`             | Scan first, then launch the selected AI tool if policy allows |
| `codegate skills [...]`           | Wrap `npx skills` with preflight scanning for installs        |
| `codegate clawhub [...]`          | Wrap `npx clawhub` with preflight scanning for installs       |
| `codegate undo [dir]`             | Restore the most recent remediation backup session            |
| `codegate init`                   | Create `~/.codegate/config.json` with defaults                |
| `codegate update-kb`              | Show knowledge-base update guidance                           |
| `codegate update-rules`           | Show rules update guidance                                    |

<Note>
  `codegate update-kb` and `codegate update-rules` display guidance for updating the bundled knowledge base and rules. Updates are delivered through new releases — run `npm update -g codegate-ai` or use `npx codegate-ai@latest` to get the latest version.
</Note>

## Where to go next

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Install CodeGate and run your first scan in under two minutes.
  </Card>

  <Card title="scan command" icon="magnifying-glass" href="/commands/scan">
    Full reference for scan flags, output formats, and examples.
  </Card>

  <Card title="run command" icon="play" href="/commands/run">
    Use wrapper mode to scan first and block dangerous launches automatically.
  </Card>

  <Card title="Why CodeGate" icon="shield-halved" href="/why-codegate">
    Understand the threat landscape and CVEs that motivated this project.
  </Card>
</CardGroup>