GateTest

One gate. 121 modules. Self-healing CI.

AI-powered code quality. Pay per scan via Stripe.

The 30-second pitch

GateTest is a single CLI plus a composite GitHub Action that runs 121 static-analysis modules against any codebase, then uses an AI fix engine to repair the findings it can. It replaces SonarQube, Snyk, ESLint, Cypress, Lighthouse, axe, pa11y, and twenty-plus other tools with one config, one gate decision, and one report.

It is different because the cost trends to zero. Deterministic AST and rule-based layers run first — these are free and ship the fix in milliseconds. The AI layer only runs on patterns nothing else has seen. Every AI win is distilled into a reusable recipe, so the next time the same pattern appears anywhere in the network it is handled for free. The longer you run GateTest, the less of it is paid work.

What you get depends on the tier. A pull request with the fixes, regression tests pinned to each fix, an architecture-shape critique, a cross-finding attack-chain analysis, and a CTO-readable executive summary — in whichever combination the tier you bought includes. One-time payment per scan via Stripe at checkout. No subscription, no auto-renew.

Install & Usage — 30 seconds

GitHub Action — recommended for most users

Drop this in .github/workflows/gatetest.yml:

name: GateTest Quality Gate
on: [push, pull_request]
jobs:
  gate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Optional: powers the PR summary comment, inline suggestions and
      # auto-repair PRs. Without it the gate still runs and blocks on
      # findings — the comment and suggestions are skipped, with a warning
      # in the log, and no PR opens even if auto-fix finds something to fix.
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: crclabs-hq/GateTest@v1
        with:
          suite: full
          auto-fix: ${{ github.event_name == 'pull_request' }}
        env:
          # Optional: unlocks auto-fix and AI review. Without it the gate
          # still runs and blocks on findings — CI just doesn't open a fix PR.
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

The action is a composite — no Docker pull, no container build. It installs GateTest, runs the gate, and if auto-fix: true and ANTHROPIC_API_KEY is set, runs the AI repair loop on a blocking gate. See action.yml for every input.

The action authenticates with the workflow's own token by default (github-token input, ${{ github.token }}), so the permissions: block above is all it needs: without pull-requests: write the summary comment and suggestions are skipped, with a warning in the log. Add issues: write if you turn on track-non-fixable: true, and security-events: write (plus actions: read) if you upload the --sarif report to the Security tab with github/codeql-action/upload-sarif (see Wire it into CI below).

Your first full run passes. Turning a gate on against an existing codebase would otherwise fail on years of backlog nobody wrote this week, so a full-repo run that finds no .gatetest/baseline.json snapshots what is already there and exits green. Commit that file and every run after it fails on new findings only — pull requests are judged on the files they change from the very first run. Details under baseline mode.

Editor — VS Code, Cursor, Windsurf, VSCodium

The whole engine in your Problems panel, before you commit. Every finding lands on the line that caused it, with the fix. Free, no account, and nothing leaves your machine.

• VS Code: search GateTest in the Extensions view, or install from the Visual Studio Marketplace.
• Cursor, Windsurf, VSCodium, Gitpod, Eclipse Theia: search GateTest in the Extensions view, or install from Open VSX — the registry those editors read. Same build, published on the same run.

Source and the full command reference: vscode-extension/.

CLI — local development

# Install from npm:
npm install -g @gatetest/cli
gatetest --suite quick

# Or run against the current directory with no install:
npx --yes @gatetest/cli --suite quick

# Or clone and run from source:
git clone https://github.com/crclabs-hq/GateTest
cd GateTest && npm install
node bin/gatetest.js --suite quick

Pre-push sweep

Run the full pre-merge sweep locally in one command:

npm run sweep          # ~30-60s — tests + build + gate + secrets + self-scan

This runs the same seven checks that block a merge in CI. Verdict is green or red. Exit code is 0 or 1, matching CI exactly.

Fast path during iteration:

npm run sweep -- --fast    # skip tests + build, gate-only, ~3-5s

See gatetest sweep --help for every flag.

Silencing a false positive — 10 seconds

Every scanner gets it wrong sometimes. When GateTest flags something you've judged safe, add one line to a .gatetestignore file at your repo root:

# Silence one rule from one module:
secrets:generic-api-key

# Silence a whole module:
deadCode

# Silence a rule everywhere it fires:
*:trailing-whitespace

# Scope a suppression to a path:
secrets:generic-api-key@tests/fixtures/**

# Skip a path entirely:
vendor/**

Suppressed findings are excluded from the gate decision and every failure count, but stay visible in a suppressedChecks list — nothing is silently hidden. Two more controls:

• gatetest --noise — ranks your noisiest modules and prints the exact ignore line to copy. The same signal, aggregated across every opted-in scan, is published rule by rule at gatetest.io/noise.
• Auto-softening — a module you chronically dismiss stops blocking the gate on its own (never on thin evidence: it takes repeated dismissals at a high fire-rate).

The policy is reviewed as policy. .gatetest.json and .gatetestignore are what every later PR is judged by, so a PR that changes them says so: a suppression added to .gatetestignore, a module disabled, the gate set to report-only or the block threshold raised in .gatetest.json each produce a Gate policy changed warning on that PR — reported, never blocking, quiet on comments and on tightening. Every signed report records the SHA-256 of both files (gatetest verify-report prints them), so two reports that disagree can be told apart by policy, not only by engine.

Project-wide options live in .gatetest.json (suites, per-module config, severity overrides) — run gatetest --init to scaffold one.

Onboarding a mature repo — baseline mode

Turning a scanner on against a large existing codebase usually means drowning in a backlog you didn't write. GateTest's baseline mode grandfathers everything that exists today so the gate only ever fails on new findings — "clean as you code."

# Snapshot every current finding into .gatetest/baseline.json — commit it:
gatetest --baseline

# From now on, normal runs pass on the pre-existing findings and only
# block on NEW ones. Baselined findings stay visible, never hidden.
gatetest --suite full

Fix a baselined finding and it's gone for good; the count is tracked per file, so adding a second secret to a file that already had one baselined re-blocks the gate (you can't sneak a new problem in behind an old one). Refresh the snapshot after paying down debt with gatetest --baseline; delete .gatetest/baseline.json to see everything again.

Testing pages behind a login — authenticated crawl

The live crawler can carry a session so it reaches authed areas (/dashboard/*, account pages) instead of bouncing off the login redirect:

# A header (repeatable), a cookie, or an exported browser session —
# values support ${ENV_VAR} so secrets stay out of committed config:
gatetest --crawl https://app.example.com --crawl-header "Authorization: Bearer ${TOKEN}"
gatetest --crawl https://app.example.com --crawl-cookie "session=${SESSION}"
gatetest --crawl https://app.example.com --crawl-storage-state state.json

Session material is only ever sent to the target's own origin — never to third-party links, assets, or cross-origin redirects. Without a session, a crawl that hits a login wall tells you exactly which flag to add rather than silently skipping the protected pages. The hosted scanner at gatetest.io accepts the same session auth.

Claude Code / MCP — give your agent eyes, ears & hands

Connect GateTest directly to Claude Code (or any MCP-compatible AI) in one command:

claude mcp add gatetest -- npx -y @gatetest/mcp-server

24 tools across five families: