Measured on 19 real repositories, the bad numbers published.121 checks in one gate: it blocks on your new code, not your backlog, says what it didn't check, and opens the pull request with the fix already written, tested, and pair-reviewed by a second AI.
Pay per scan — no seat licences, no minimum. Built on Claude — Fable 5 on the fix tiers, Sonnet 5 everywhere else.
GitHub or Gluecron. Public repos scan free.
Measured on code we didn't write
Every push runs a full scan of 19 pinned commits of repositories we do not control. Each is held to a ceiling that only ever goes down. If a rule starts over-firing on express or Django, our CI goes red before yours does.
| Repository | Blocking | Ceiling |
|---|---|---|
| express | 0 | 0 |
| flask | 2 | 2 |
| fastify | 3 | 3 |
| got | 12 | 12 |
| hono | 20 | 20 |
| zod | 5 | 5 |
| django | 59 | 59 |
| rails | 41 | 41 |
| spring-petclinic | 8 | 8 |
| gin | 1 | 1 |
| axum | 5 | 5 |
| laravel | 4 | 4 |
| cleanarchitecture | 11 | 11 |
| ktor | 7 | 7 |
| vapor | 0 | 0 |
| nest | 9 | 9 |
| trpc | 7 | 7 |
| apollo-server | 0 | 0 |
| prisma | 13 | 13 |
The same 121-module engine backs all four — you just point it at whatever you actually have.
Every push runs the gate. When CI goes red, GateTest opens a pull request with the fix already written, tested, and reviewed by a second AI.
Free deterministic gate on every push after install — no card
Install the GitHub AppSee how the fix flow works →Paste a URL. GateTest loads the real page in a real browser and reports what is actually broken for your visitors — no repository, no git, no install.
Paste your site's address. GateTest checks the things WordPress owners get burned by — exposed versions and admin paths, XML-RPC, weak headers, slow pages — and tells you what to fix first. No plugin to install.
The full 121-module scanner runs inside Claude Code, Cursor, or any MCP client — so your agent can find the bug, fix it, and prove the fix worked without leaving the editor.
Three independent products from one team, built to work together and used on each other every day. Keep GitHub if you like — GateTest runs there too — or move your git to Gluecron and your jobs to Vapron and get the whole loop from one place.
The git host built around Claude.
Git hosting built for small teams — no tickets, no politics. GateTest is wired into it natively: every push lands on Gluecron's Signal Bus and triggers a scan from the same queue that serves GitHub.
Dogfooded: GateTest gates Gluecron's own codebase on every push.
Scheduled jobs that actually run. Cron with receipts.
AI-native, edge-first, zero ops. The cron and background jobs that power your product — run with receipts, so "did the job fire?" is never a mystery again.
Dogfooded: the live demo on this page replays a real Vapron failure that GateTest caught and fixed.
Most tools tell you what's broken. We open the PR that fixes it. This is what a single GateTest run looks like, end-to-end.
× vapron-api.service failed
ReferenceError: resolveTenantCapForHotPath
is not defined
at apps/api/src/cdn/handler.ts:65:22
Bun v1.3.14 (Linux x64)
::error file=apps/api/src/cdn/handler.ts,
line=65::ReferenceErrorA real Vapron failure from 2026-05-24. The api crashed at module load. Rollback also failed.
Typically well under a minute per fix. Fixes ship at Scan + Fix ($199) and above.
+ import { resolveTenantCapForHotPath }
+ from "./quotas";
const handler = createSomething({
tenantCapResolver:
resolveTenantCapForHotPath,
...
});
✓ Tests added (1) ✓ Gate greenOne-click “Commit suggestion” in GitHub. CI re-runs green. You wake up to a merged fix instead of a 47-message Slack thread.
No other tool ships scan + fix + regression test + pair-review + cross-finding correlation on pay-per-scan pricing. We do.
Built to be trusted, not tolerated
The first run on a mature repo records what is already there and passes. Every run after fails only on findings that are new. Adoptable on day one, still able to say no.
.gatetest/baseline.json · --diff on pull requests
How it works →Findings are attributed by changed line, not by file. A pre-existing warning three functions down does not become your problem because you touched the file.
inDiff / inChangedFile on every finding
How it works →A deferred module, a missing toolchain, a scan that timed out — printed in the console, the PR comment and the JSON report. A pass from a fallback never wears the green tick.
Not checked: · Partial scan · provenance.modules.skipped
Each finding carries the exact ignore line that silences it and nothing else. In a PR, reply with the command and it is done.
.gatetestignore · @gatetest ignore <module:rule>
Every JSON report carries provenance and an HMAC signature. A CI job asserts the same tree gives the same findings, run after run.
gatetest verify-report <file> · determinism gate
How it works →The blocked gate leads with the replay command for that run, so the fix starts on your machine, not in a log viewer.
gatetest replay <run-url>
Hover any tile to see the GateTest module that replaces it. The full table's in the breakdown below — 30+ tools across the entire QA stack.
--module security--module codeQuality--module lint--module e2e--module compatibility--module performance--module accessibility--module dependencies--module dependencies--module dockerfile--module terraform--module ciSecurityThe others tell you what's wrong. GateTest fixes it, proves it, and lets you drive.
| Capability | GateTest | SonarQube | Snyk | DeepSource |
|---|---|---|---|---|
| Finds bugs, security holes & CI rotSnyk is dependency/security-focused | ✓ | ✓ | ~ | ✓ |
| Opens the fix as a real pull requestothers: dep bumps or suggestions only | ✓ | ✗ | ~ | ~ |
| Re-scans to PROVE the fix worked | ✓ | ✗ | ✗ | ✗ |
| You pick the AI model | ✓ | ✗ | ✗ | ✗ |
| Bring your own API key | ✓ | ✗ | ✗ | ✗ |
| Pay per scan — no per-seat tax | ✓ | ✗ | ✗ | ✗ |
| One gate across the whole stack121 modules, one verdict | ✓ | ✗ | ✗ | ✗ |
✓ yes · ~ partial · ✗ no. Competitor cells reflect each product's default offering as of 2026.
unitTestse2elintsecuritydependenciesdockerfileciSecurityshellsqlMigrationsterraformkubernetespromptSafetyaiGuardrailsdeadCodesecretRotationwebHeaderstypescriptStrictnessimportCycleredosperformanceaccessibilityvisualcodeQualitysecretslinksPlus ten modules with no direct competitor: AI code review, fake-fix detector, mutation testing (via GitHub Action), chaos / fuzz pass (via GitHub Action), autonomous exploration, live crawling, data integrity, documentation validation, compatibility analysis, integration-test detection — and CI config generation and SARIF output built into the CLI.
One command runs all 121 — deterministic, zero AI tokens, under a minute. One verdict at the end. Here's what's inside the gate.
The foundation. Catches the bugs every linter and compiler should have caught but didn't.
OWASP-grade scanning that goes beyond CVE lookups into your actual code paths.
The bugs that don't break on your machine but break in production at 3am.
Surfacing the user-visible problems static analysis usually pretends don't exist.
Catches the supply-chain takeovers, container exploits, and CI/CD foot-guns.
Pulls bad-process bugs out of CI before they cost a 90-minute review.
Where deterministic scanning stops and reasoning starts. Used sparingly, not by default.
The classic suite — unit, integration, end-to-end — wired into the same gate as everything else.
Nine non-JS language backends. Same engine, language-aware patterns.
Live-URL probes for the WordPress health check at /wp. Run against any public WordPress site.
Active probes against your running site. Pen Test tier only — requires explicit written authorization for the target.
Every competitor either ships pattern matchers (cheap, brittle) or ships LLM-only fixes (slow, expensive, hallucinates). We stack three deterministic layers in front of Claude, and every recipe a Claude fix produces makes the cheap layers catch more next time. Margin improves as the cache grows. Quality compounds. And every fix is re-scanned to prove it worked — we don't tell you it's fixed, we show you the green.
Deterministic transforms on the parse tree.
rejectUnauthorized: false → true. httpOnly: false → true. The compiler proves correctness; no LLM needed.
Codemod recipes per finding class.
Wildcard CORS origin + credentials. Missing CSP. Cookie hardening. One regex-bounded rewrite per pattern.
Cached fixes from every prior scan, compounding.
When a scan resolves a novel finding, the diff is stored. Next time that finding shape arrives — local or someone else's repo — we apply the cached patch.
Only the genuinely novel cases reach the LLM.
Iterative loop with N retries, syntax gate, scanner re-validation, pair-review on $199+, attack-chain correlation on $399.
When CI breaks, the agent reads the failing log, walks back to the failing line, applies the right layer (AST → rule → recipe → Claude), runs the gate again, opens a PR. You review the diff and merge. The build was red for fifteen minutes; you didn't have to look at it. The recipe layer remembers, so the next time the same failure happens — your repo or someone else's — it's fixed before you see it.
How it actually worksLayer percentages are derived from our own self-scan + the four real-repo proofs in docs/proofs/. Your mileage will vary by tier and codebase shape.
The 121-module scan runs on zero AI tokens — pure deterministic speed. When a fix needs real intelligence, you decide how it's powered. No other QA tool lets you do this.
Point GateTest at your own ANTHROPIC_API_KEY. You pick the model, you own the spend, and there's no cap. On the CLI and MCP server, calls go straight from your machine to Anthropic — never through our servers. On the web fix route your key is used for that one request and never stored.
No key? We supply one. Usage is metered and budget-capped — every fix is priced at the model that actually ran, so there are no surprises on the bill. Just run the scan and take the PR.
Fast and cheapest. The default for scans, chat, and everyday fixes.
Heavier reasoning when a fix is subtle or spans many files — half the cost of Fable.
The previous-generation Opus, kept for teams that pinned it.
The most capable model Anthropic ships — powers the $199 / $399 fix tiers.
SonarQube can't fix it. Snyk can't fix it. DeepSource picks the model for you. GateTest hands you the keys.
The three things every AI coding agent is missing — it writes UI it can't see, guesses at errors it can't read, and claims “fixed” without proof. GateTest closes all three over one connection: 24 tools driven by the full 121-module engine, in Claude Code, Cursor, Windsurf, and any MCP agent.
AI agents write UI they never actually see.
capture_screenshot returns a real JPEG/PNG of the rendered page — nav, layout, font sizes, broken CTAs — so the AI reviews its work exactly like a developer looking at a browser tab.
// See the rendered page — works with localhost too
capture_screenshot({
url: "http://localhost:3000/pricing",
width: 390 // mobile viewport
})
// → returns an actual image the AI can seeUse after every UI change
AI agents guess what's broken instead of reading the real errors.
get_production_errors pulls your top errors from Sentry, Datadog, or Rollbar with file:line attribution. run_live_checks catches JS errors, console warnings, API timeouts, and CSP violations on any live URL — including localhost.
// Fix what production says is broken, first
get_production_errors({ source: "all" })
// → TypeError: cart is undefined | src/checkout.ts:44 | 412 occurrences
// Or check your local dev server right now
run_live_checks({ url: "http://localhost:3000" })
// → apiHealth: 2 broken, runtimeErrors: CSP violation on /dashboardUse before deciding what to fix
AI agents claim “fixed” without re-checking anything.
verify_fix picks the scan modules relevant to your changed files, re-runs them in-process, and returns a hard ✅/❌ scoped to exactly what was edited. No assumptions — proof.
// After editing — prove it actually worked
verify_fix({
path: "/your/project",
files: ["src/auth/session.ts"] // exactly what you edited
})
// ✅ FIX VERIFIED — 0 error-severity findings remain
// ❌ NOT VERIFIED — secrets: hardcoded key still at line 14Use after every code edit
Works with any MCP-compatible AI — Claude Code, Cursor, Windsurf, Continue, Cline. No account, no webhook, no infra. The engine runs in-process on your local filesystem.
$ claude mcp add gatetest -- npx -y @gatetest/mcp-serverGateTest runs against itself on every push to main. If our own gate were red we'd have no business asking you to use it. Below is the live status panel — same shape you'll see on your repo.
The self-scan workflow lives in .github/workflows/ci.yml. Bible Forbidden #24 means continue-on-error: true is banned on the gate step — so a red gate would block the commit, not just warn.
One npx command for local. One YAML file for CI. The whole thing runs on Node 20+. No build step, no Docker image, no daemon.
$ npx @gatetest/cli --suite quick# scan a single repo locally
$ npx -p @gatetest/cli gatetest --suite quick
# full suite (88 modules), blocking gate
$ npx -p @gatetest/cli gatetest --suite full
# crawl and test a live website
$ npx -p @gatetest/cli gatetest --crawl https://yoursite.com
# watch mode — re-run on every file change
$ npx -p @gatetest/cli gatetest --watch
# .github/workflows/gatetest.yml
name: GateTest
on: [push, pull_request]
jobs:
gate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- run: npx -p @gatetest/cli gatetest --suite full --sarif
# NOTE: do NOT add continue-on-error: true here
# The whole point of a gate is that it gates.
Four small runtime dependencies. Anonymized telemetry only — module and rule ids with integer counts, never code, file paths or repository names; opt out with GATETEST_NO_TELEMETRY=1. Source is on GitHub — MIT-licensed. The CLI itself is free; the auto-fix tiers are paid.
The real math
Each with its own config, dashboard, and per-seat bill.
One engine, 121 modules, one decision.
npx -p @gatetest/cli gatetestEnterprise plans for SonarQube + Snyk alone run well into five figures a year. GateTest bills on what you scan, not how many engineers you employ.
Real scan · real production repo
The 14 secrets each look survivable in isolation. GateTest's correlator connected them into two critical chains a linter would never report: hard-coded credentials in a frontend component plus an admin onboarding route → credential exposure and admin takeover; and a leaked queue-client secret in auto-deploy scripts → supply-chain takeover via CI.
Verbatim from a real scan of a production codebase — full report in docs/proofs/. We publish the receipts because "AI finds your bugs" is a crowded, over-promised space and you should be skeptical.
Why this isn't a fad
Every new model generation arrives smarter — and the same failure modes remain. The model still can't see the rendered page, doesn't know what production is throwing, and can't prove its own fix worked. GateTest is the permanent layer around that: a deterministic gate, real senses, and proof — not a bet on one model generation.
The engine is free and open-source if you run it yourself — npx -p @gatetest/cli gatetest --suite full. Quick and Full below run the same scan on our infra: zero setup, a shareable hosted report, nothing to install. Pay per run for auto-fix and deeper AI analysis, or subscribe for continuous protection.
4-module rapid scan: syntax errors, lint violations, exposed secrets, and code quality. Results in seconds.
The full engine suite — 121 modules: security, supply chain, auth hardening, CI security, AI safety, and more. (Mutation + chaos ship via the GitHub Action.)
Full-suite deep scan with iterative auto-fix PR, pair-review agent, and architecture annotations.
Everything in Scan+Fix plus Claude-driven per-finding diagnosis, attack-chain correlation, and executive summary.
Subscriptions
The hosted GateTest MCP endpoint: use GateTest from claude.ai on web and mobile — no terminal, no npm, nothing installed. The full local MCP server stays 100% free on your own machine.
Every repo in your org — one flat price, no seats, no per-repo billing. Unlimited deterministic scans on every push; AI reviews metered by a shared monthly allowance.
Running GateTest across a large organisation? We'll shape a plan around you: custom scan volume, a raised AI-review budget, priority support, and invoicing on your terms.
Point GateTest at your own live site and it will run safe, non-destructive security probes against it — the checks a penetration tester runs first, automated, repeatable, and only ever against a target you own and have authorized.
Be first to know when it’s ready:
One email when it launches — nothing else. Questions? support@gatetest.io
Answers calibrated for the engineer who showed up from a Hacker News thread. We are too.
continue-on-error: true on the gate step. We dog-food this: our own self-scan is a hard gate on every push to main. If a competitor lets you silently skip a failing check, that's how 80% of the wins in QA-platform marketing slip into prod anyway.docs/proofs/.Still have questions? support@gatetest.io · file an issue
Scans every major framework, runtime, and infra primitive
Eaten our own dog food
GateTest currently protects Vapron.ai and Gluecron.com as a CI gate.
Same engine, same rules, same gate. The integration script is published — feel free to clone the workflow.