When Claude Code, Codex, or Cursor changes what your agent can do—its tools, scopes, prompts, or policies—Shipgate turns the diff into a deterministic merge verdict, before anything reaches production.
Abstract. Static analysis only. No agent execution, LLM calls, tool calls, or telemetry by default. Same evidence, same verdict.
Bundled fixture · ai_generated_refund_pr
+ stripe.create_refund+ stripe:*Registered procedure
One command, a frozen fixture, and a verdict anyone can reproduce before installing the CLI.
$ uvx agents-shipgate fixture run \
ai_generated_refund_pr
capability delta + stripe.create_refund
release decision blocked
human authority requiredTools, scopes, prompts, policies, and CI.
No agent, model, tool, or network execution.
Verdict, capability delta, evidence, next action.
A capability changes. A coding agent or human changes what the released agent can do.
Shipgate reads the diff. Declared tool sources and release policy become one review surface.
The PR gets a verdict. The same decision is projected into JSON, SARIF, and a reviewer-shaped PR comment.
Public evidence
These are demonstrations on public sources—not vulnerability claims or project rankings.
2 declared tools · static AST
Representative findingupdate_seat changes customer state without enough scope and policy evidence for release review.
Inspect source3 tools · destructive action
Representative findingcancel_order is destructive and needs a declared approval policy before promotion.
Inspect source591 operations · broad surface
Representative findingInfrastructure deletion and mutation operations are present without explicit approval coverage.
Inspect source167 operations · declared read-only
Representative findingDELETE-capable operations contradict the manifest’s stated read-only purpose.
Inspect sourceWhat the verdict examines
The published catalog currently contains 144 deterministic checks. This index shows the review logic, not every rule.
What tools, actions, or host grants did this PR add or broaden?
Do high-risk actions stop for the right human authority?
Does an irreversible action require an explicit user confirmation?
Can a retried write repeat money movement or state change?
Are permissions narrower than wildcard or administrative access?
Are inputs bounded, typed, and reviewable at release time?
Does the actual tool surface match the agent’s declared job?
Did the PR weaken the verifier, policies, baselines, or CI gate?
Are suppressions, waivers, and accepted gaps named and owned?
Source-adapter support is not a validated integration: promotion requires a reproducible pilot, zero low-confidence tools, published limitations, and an independently documented adopter or field case.
MCP · OpenAPI 3.x · OpenAI Agents SDK · Anthropic Messages API · Google ADK · LangChain / LangGraph · CrewAI · OpenAI API · Codex · n8n
What Shipgate is—and is not
Runtime controls and behavior tests stay essential. Shipgate occupies the merge-time layer between code generation and promotion.
Constrains capability when a call happens.
Observes behavior on tested inputs.
Compares static authority with intended purpose and controls.
vs evals · vs observability · vs MCP gateways · vs LLM gateways · vs LangSmith · vs Promptfoo · vs Braintrust
Falsifiable by design
Open checks, local artifacts, explicit failure states, and no hidden model judgment in the default path.
Default verifier guarantees
Shipgate is beta. On dynamic or weakly declared tool surfaces, static extraction can return insufficient_evidence rather than inventing confidence.
Begin in advisory mode. Promote to strict CI only after your team has reviewed the baseline, policies, and expected failure modes.
Read the validation roadmap ↗Frequently cited
Agents Shipgate is an open-source CLI and GitHub Action that reviews AI-agent capability changes at PR time and returns a deterministic merge verdict with the evidence and next safe action attached.
Agents Shipgate is static and local-first by default: no agent execution, LLM calls, tool calls, MCP server connections, verifier network calls, or verifier telemetry.
MCP exports, OpenAPI 3.x, OpenAI Agents SDK, Anthropic Messages API artifacts, Google ADK, LangChain and LangGraph, CrewAI, OpenAI API artifacts, Codex configuration and plugins, and n8n workflows. Source-adapter support is not a validated integration: promotion requires a reproducible pilot, zero low-confidence tools, published limitations, and an independently documented adopter or field case.
Start with the ThreeMoonsLab/[email protected] GitHub Action in advisory mode, keep full Git history available, and move to strict mode after your team has reviewed the baseline and policy.
Shipgate returns insufficient_evidence and routes the change to a person. It does not convert an incomplete dynamic tool surface into a confident pass.
Agents Shipgate is a release-evidence gate, not a safety certification, runtime sandbox, behavioral eval, or gateway.
Begin with one pull request
Run locally, post the reviewer-shaped comment, and tighten the gate when the team is ready.
$ agents-shipgate verify --workspace . --config shipgate.yaml --base origin/main --head HEAD --ci-mode advisory --format jsonThen read report.json → release_decision.decision.
Three Moons Lab is building “healthcare for agents”: reproducible checks across release readiness, capability drift, and the evidence trail between them.
About the lab →