The independent admission controller for AI systems

Admit what the evidence establishes.

release-gate combines code-level agent risk, external evaluations, runtime traces, governance evidence, verification results and human approvals into an auditable PROMOTE · HOLD · BLOCK, without replacing the tools that produced the evidence. A PROMOTE says the candidate meets the declared release policy, with the evidence and the gaps it lists.

  • Every claim resolved, with the rule that decided it — established, contradicted or not assessed. One counterexample outranks any number of passes.
  • What it did not check, named — NOT_ASSESSED is never read as a pass.
  • A bounded list for a person — and, for each item, the evidence that would close it.
Drop a run in — live → How it decides

pip install release-gate && release-gate assure run.jsonl

Reads an OpenTelemetry trace, a Langfuse or Arize export, a promptfoo run, SARIF or its own records — the shape is detected, not declared.

$ release-gate assure run.jsonl --methodology general-autonomous-action@1.0.0
BLOCK Assurance of run.jsonl
InputASSURANCE_ENVELOPE at 83%
Casecase_ee6ecc87 v1 · sha256:bb29512d…
WHAT WAS ASSESSED
[assessed] input_integrity
[assessed] record_mapping — 6 of 6
[NOT_ASSESSED] execution_reconstruction
[NOT_ASSESSED] adversarial_review
[BLOCK] RG-ACT-001 'execution_reconstruction' is NOT_ASSESSED
→ supply the run's trace or tool-call log
2,287,133records folded
13reach a person
0config files

The assurance engine

A machine produced something consequential.
A human has to decide whether the evidence is enough.

release-gate does not generate results and it does not verify them — agents generate, tools verify, and release-gate assembles the argument those two leave behind, then says whether that argument is sound enough to put to a person. It reads an OpenTelemetry trace, a Langfuse export, a promptfoo result or its own record format; the shape is detected, not declared.

1 · A bounded list, not a score

Two million records is not reviewable, and a score over two million records is one number standing in for a judgement nobody made. Criticality comes from reachability in the claim graph, never volume. A shorter list is not a better case — it can equally mean detection got worse, which is why that refusal is a property in the code rather than a caveat in the docs.

2 · Every verdict says what it did not check

A pass that does not state its own coverage is indistinguishable from a pass that never looked. NOT_ASSESSED is a first-class answer, kept apart from “we looked and found nothing” everywhere in the engine. Collapsing those is how a gap comes to read as a clean bill of health.

3 · When it holds, it returns the work order

A gate that only says no is a nag. Each item arrives with what would close it, machine-readable with --json, so the next agent run can go and get the evidence instead of a human re-reading the case to work out what was missing.

How it is built

Its own checks

AST / taint, PR diff, governance, trace validation, loop simulation, agent score. Each is one producer among the others.

Your tools

Evaluators, red teams, traces, SAST, provers, people. Read in their own words, never re-run.

A model, bounded

Asked only what the rules left open. Any failure is UNKNOWN. A reading never decides.

The case

Claims, evidence, assumptions, contradictions, counterexamples, failed branches, coverage, independence.

The policy

PROMOTE · HOLD · BLOCK, deterministic from the declared policy and the evidence. No score is an input.

It may generate, ingest, normalize and compare evidence, interpret bounded evidence, and decide whether evidence satisfies policy. It never pretends that one model, one scanner, one evaluator, one score or one successful test establishes universal truth.

Proven end to end. One enterprise release blocks on a single counterexample. None of these outvotes it: a perfect scanner score, 1,000 passing evals, an evaluator’s “approve”, or five model judgments. A hostile review of 25 attack areas found 11 defects; each was reproduced in a test and fixed.

producers records seen evidence claims reaches a person
one agent, one action 4 7 6 0 1 item
10,248 workers 10,254 2,287,133 10,258 2,420 13 items, 7 undroppable

Measured by the test suite, not written here by hand — a claim that drifts from the implementation fails a test. One code path carries both rows: 346 engine functions are common to them, 87% of everything the single-agent path touches.

Drop a run in — live → pip install release-gate && release-gate assure your-run.jsonl

No config file, no YAML, no account. It will HOLD until a methodology says what enough means for the decision — inventing that answer would be claiming a standard it does not have.

New · Essay What Did It Not Check? — a pass that does not state its coverage is indistinguishable from one that never looked. Read the essay →
The static half · release-gate audit & pr

Scan an agent repo. Gate the AI pull request.

AST and taint analysis over the code an agent ships: model output reaching eval or a shell, untrusted input in a system prompt, LLM calls with no token ceiling. On a pull request it rules only on what that change introduced, never on inherited debt. Its findings can feed an assurance case as evidence; on their own they are a scan, not an approval.

Scanning a private repo? Install the release-gate-ai App to grant read access — public repos work without it.

No repo handy? Watch it block a bad AI change — a real pull request, real output, reproducible on your machine in 30 seconds.

release-gate pr --base main exit 0 promote · 10 hold · 1 block

$ release-gate pr --base main
BLOCK this change made things net-worse
Agent Code Safety 100 → 76
INTRODUCED BY THIS CHANGE — NOT PRE-EXISTING
[HIGH] Dangerous execution sink agent.py:25
confirmed — client.chat.completions.create() (L17) → expr → eval() (L25)
[LOW] LLM call with no token ceiling agent.py:17
inferred — no max_tokens
1 source file changed · exit code 1

The governance safeguards

One of two axes. Every safeguard maps to a real production failure — no checkbox theater. The other axis, Agent Code Safety, scans the code itself for code-level agent risk (below). Both are evidence for the admission decision, not the decision.

🏛️

Governance config

Governance lives in heads, not docs. Knowledge walks out the door.

📊

Eval evidence

No tests = no signal. You're guessing in prod.

🔍

Trace / tool policy

Silent tool misuse. No audit trail when something goes wrong.

💰

Budget ceiling

One prompt injection → $10k overnight. No ceiling = no floor.

🔴

Kill switch / fallback

Agent misbehaves at 2am. No kill switch = 45-min deploy to fix it.

👤

Team owner

Incident at 3am. Who do you page? "The team" is not an answer.

🔐

Auth & rate limiting

Unprotected endpoint = denial-of-wallet attack in minutes.

Agent Safety Scan

Scan your agent code: code-level agent risk as evidence

Point it at any GitHub repo running an LLM agent. It finds the failure modes that only exist once a model is in the loop — prompt-injection surfaces, exec sinks fed by model output, LLM calls with no token ceiling, hardcoded keys, and sensitive context that reaches the model unmasked on one path while an equivalent path redacts it. SonarQube won’t flag these; this is the layer on top.

Paste any public GitHub repo that runs an LLM agent — e.g. github.com/your-org/your-agent. Sign up free to see every finding with file:line.

AI-change review gate · release-gate pr

Stop debugging AI-generated code you can’t trust

AI writes the diff in seconds. Then a human burns an hour deciding whether to trust it — reading every changed file, hunting for the one dangerous line. That verification tax is where the productivity goes. release-gate pr runs in CI and answers one question, from evidence, not vibes: what did this change introduce that a reviewer would otherwise have to find by hand?

release-gate pr --base origin/main
🔴 release-gate — AI-change review: BLOCK
this change made things net-worse — see reasons
Agent Code Safety: 100 → 88 (▼ -12)
Introduced by this change (not pre-existing):
 ⚠ HIGH (confirmed): model output reply → eval()  src/agent/tools.py:88
 ⚠ prompt changed prompts/system.txt — release-gate.lock not updated
Context (advisory, not blocking):
 • 11 source files changed, 0 test files touched
Inherited debt ignored (not this change’s fault): 4 findings.
exit 1  (0 PROMOTE · 10 HOLD · 1 BLOCK)

Every line is a fact derived from your diff — not a prediction. It blocks only on net-new regressions.

Why you can trust the gate — and not have to debug it

It’s a security tool, held to the standard it audits. Four properties make the verdict trustworthy on its own.

🧾

Facts, never predictions

No “debug-debt score” guessing from file counts. It reports what is: this file now reaches eval() with model output; this prompt changed without a lockfile update. Facts don’t cry wolf.

⚖️

Blocks net-new only, never old debt

Pre-existing findings from the base branch are shown as ignored — a PR is judged on what it changed. A gate that nags about inherited debt gets muted, and a muted gate helps no one.

🎯

Precision-calibrated

AST + taint, not grep: it flags a sink only when model/user input can actually reach it, and grades severity by proof (confirmed vs inferred). Validated across 18 agent frameworks — as much effort spent killing false positives as finding bugs.

👁️

Sees what a diff can’t

A model or prompt change has no code fingerprint. The lockfile (AIBOM) drift check surfaces “the behavior changed but nothing in the diff shows it” — the exact class of silent change that causes 2am incidents.

It is not an AI reviewer, debugger, or fixer. It doesn’t add 40 inline comments — it gives one decision and the short list worth your attention. Release discipline, not more noise.

Drop it into GitHub Actions

- uses: actions/checkout@v4 with: { fetch-depth: 0 } # full history so the diff can be scoped - run: pip install release-gate - run: release-gate pr --base origin/${{ github.base_ref }} --comment >> $GITHUB_STEP_SUMMARY

Who it's for

For whoever has to trust an AI-generated agent change

The person reviewing the PR, and the team that has to live with what merges. release-gate gives them one evidence-backed decision instead of a diff to eyeball.

🤖
AI / ML Engineers
Teams shipping AI agents
You built a LangChain, CrewAI, or Agents SDK app and you're about to push it to prod. release-gate checks that budget ceilings, fallback logic, and eval evidence are actually in place — not just planned.
Catch missing safeguards before your manager does
💬
Product & Platform Teams
LLM-powered apps & copilots
Your app calls GPT-4 or Claude on every user request. One bad prompt, one rate-limit gap, or one missing kill switch and you're dealing with a public incident. release-gate makes the checklist automatic.
A decision you can audit, not crossed fingers
🔧
Backend Engineers
Tool-calling & agentic systems
Your agent reads files, calls APIs, writes to databases. Without a declared tool policy and rate limits, one loop bug costs you real money and real data. release-gate surfaces those gaps before deploy.
Know which tools are allowed before they're abused
🏢
Enterprise & Security Teams
Internal copilots & assistants
You're deploying an internal AI assistant to thousands of employees. Legal wants an audit trail. Security wants auth enforced. release-gate gives you a machine-readable evidence pack for every release.
Audit trail ready for compliance review
⚙️
Infrastructure & MLOps
Self-hosted & open-weight models
You're running Llama, Mistral, or a fine-tuned model on your own infra. No managed guardrails, no built-in cost control. release-gate checks that you've declared your own, and holds the release until you have.
Governance that works without a cloud provider
📊
Data Science & Analytics
Prediction & scoring models
Your model scores loan applications, flags fraud, or ranks candidates. release-gate checks for eval evidence and team ownership — the two things regulators ask about first when something goes wrong.
Evidence pack ready before the auditor asks

Zero extra infrastructure

One pip install. Works in your terminal, your CI, or via API. No cloud containers, no agents to host, no SaaS dependency for the core tool.

💻 CLI (Terminal)

$ pip install release-gate $ release-gate audit https://github.com/org/agent   Score 60/100 HOLD ✗ governance_file ✓ budget_ceiling ... $ release-gate audit . --emit-config -o governance.yaml

Your machine. Your terminal. No account needed.

⚙️ GitHub Actions

- uses: VamsiSudhakaran1/release-gate@v0.12.0 with: command: audit path: . # Exit 0=PROMOTE · 10=HOLD · 1=BLOCK

5 lines in your workflow. Score appears in PR summary.

🌐 SaaS API

POST /api/audit { "url": "https://github.com/org/agent" }   → { score: 60, decision: "HOLD", safeguards: { ... } }

Use from any language. Full history + dashboard for teams.

The Verify phase for agent loops

Every agent loop needs a checker that isn’t the same model that wrote the output. Release Gate owns the Verify step — returning CONTINUE, SHIP, or ROLLBACK after each iteration.

Discover → Plan → Execute → ✓ Release Gate Verify → Iterate

💻 CLI (local loops)

$ release-gate verify governance.yaml \ --iteration 3 --cost 0.12 \ --trace otel-export.json --json   { "decision": "SHIP", "cost_remaining": 0.88 }   # exit 0=SHIP 10=CONTINUE 1=ROLLBACK

Works in any shell loop. No account needed. Reads the traces you already emit — OpenTelemetry, Langfuse, OpenInference — so there’s no bespoke file to write and no new instrumentation.

🌐 API (live loops)

POST /api/verify { "iteration": 3, "cost_so_far": 0.12, "trace": { "steps": [...] }, "loop_id": "my-loop-001" }   → { "decision": "CONTINUE", "warnings": ["8/10 iterations used"] }

Call from any language. Each iteration is persisted.

📋 Governance

# governance.yaml loop: max_iterations: 10 total_cost_limit: 1.00 cost_per_iteration_limit: 0.15 maker_model: claude-opus-4-8 checker_model: claude-haiku-4-5

Declare the policy once. Release Gate enforces it every iteration.

🧪 Try the Loop Verifier

Runs against the live /api/verify endpoint — requires a free account and API token. Without auth the result is a local simulation.

See it decide — live

Three lenses on the same agent. All run server-side and return one decision.

Runs the agent through a behaviour battery — Safety, Correctness, Loop, Cost — for a 0–100 score. Watch the canary safety gate fire.

Built-in demo agents scored server-side — no account needed. Score your own: release-gate agent-score py:my_pkg:run

Free CLI forever. Hosted platform in beta.

The CLI and GitHub Action are 100% free and unlimited — local, in CI, no account, no data leaving your network. The hosted platform is in beta and free for design partners while we build it with them.

Open-source CLI
Free
unlimited, forever
Local & CI — no account, no data leaves your network
  • Full audit + pr gate
  • Every rule, evidence & decision
  • SARIF, JSON & Markdown output
  • GitHub Action
  • MCP server for coding agents
  • Runs entirely in your pipeline
Get the CLI →
Hosted beta
Free
for design partners
While we build it with early teams
  • Everything in the CLI
  • Persistent scan history
  • Dashboard & score trends
  • Team visibility
  • Direct line to the maintainer
Become a design partner →
Enterprise
Contact us
private deployment
Self-hosted, on your infrastructure
  • Self-host the dashboard
  • Org-wide release policy
  • Compliance / PDF reports
  • SSO / SAML
  • Audit trail
Contact us →

Fits your stack

Add the agent layer to the security tooling you already run

SonarQube, Snyk and your SAST suite keep your code healthy. release-gate checks whether your agent change meets its release policy. They’re complementary — release-gate doesn’t replace anything you already trust, it covers the layer those tools were never built to see.

Your SAST tools cover
The code layer
  • SQL injection, XSS, CSRF, path traversal
  • Vulnerable & outdated dependencies (CVEs)
  • Code smells, coverage, maintainability
  • Supply-chain & license risk
Keep running these. release-gate doesn’t duplicate them.
release-gate adds
The agent layer
  • Direct and indirect prompt injection — RAG/tool/HTTP content reaching the system prompt
  • LLM output reaching eval/exec/shell — and model-driven SSRF, file delete, and SQL sinks
  • Secrets/PII leaking into a prompt sent to the model provider
  • Irreversible agent tools with no confirmation / human-in-loop gate
  • Cost-runaway loops, missing token ceilings, unvalidated model-output parses
  • Declared safeguards + a single PROMOTE / HOLD / BLOCK decision
The failure modes that only exist once an LLM is in the loop — every finding with a stable rule id, cited to OWASP LLM & NIST AI RMF.

A clean SonarQube report means your code won’t leak a buffer or run an injected query. It says nothing about whether your agent has a budget ceiling, a kill switch, or a prompt-injection surface in its system message. release-gate closes that gap — so “the code passed” and “the agent meets its release policy” finally cover the same ground.

Security & privacy

We audit your repo — we don’t store your code. Here’s exactly how access works.

🔓
Public repos — no login
Public GitHub repos are scanned via the GitHub API with no authentication. No account or token needed — just paste the URL.
🔐
Private repos — read-only GitHub App
Private repo access uses a GitHub App installation token with read-only repository contents scope. The App cannot write code, open issues, or modify settings.
🧠
No training on your code
Source code scanned by release-gate is never used to train models. Static analysis runs in-process and results are stored as structured findings — not raw code.
💻
CLI runs 100% locally
The open-source CLI never phones home. It reads only the local directory you point it at. Your code stays on your machine, in your CI, or behind your firewall.
🏗️
Self-hostable
Run release-gate entirely in your own CI pipeline using the CLI — no cloud dependency, no data leaves your network. Enterprise users can also self-host the dashboard.
📄
Open-source core
The scanning engine, safeguard checks, and governance schema are fully open-source. Audit the code that audits your code.

FAQ

Questions, answered

What release-gate is, what it tests, and where it fits next to the tools you already use.

How is this different from guardrails like Lakera or NeMo?
Guardrails block a bad request at runtime — they live in the request path of a deployed agent. Release-gate answers a different question before you deploy: does this agent change meet its release policy? It runs a battery against the agent and returns one PROMOTE / HOLD / BLOCK verdict across safety, correctness, loop behavior, and cost. It's the release-decision layer above guardrails, not a replacement for them.
Does my agent have to be written in Python?
No. Point it at a Python callable (py:), a shell command (cmd:), or any HTTP endpoint. For HTTP you just tell it where the input and output live in the JSON — so LangServe, a plain FastAPI route, or an OpenAI-compatible API all work with no wrapper: agent-score "http://host/run#in=prompt&out=reply".
Why two scores — Agent Code Safety and Governance?
Because they answer different questions, and collapsing them into one number hides the truth. Agent Code Safety is objective: it scans your source for the agent-layer risks — prompt-injection surfaces, exec/shell sinks fed by model output, LLM calls with no token ceiling, hardcoded keys. It moves per repo and doesn't depend on adopting anything from us. Governance is maturity: have you declared the enforceable safeguards (budget ceiling, kill switch, owner, evals, trace policy)? A low Governance score means undeclared, not unsafe. Keeping them separate is why a clean codebase with no config still scores well on safety — no circular "you didn't adopt our file" penalty. Each score also shows the findings driving it, so it's never a black box.
Isn't Agent Code Safety just SonarQube?
No. SonarQube and SAST tools find SQL injection, XSS, CVEs and code smells — the code layer. Agent Code Safety finds the failure modes that only exist once an LLM is in the loop: user input flowing into a system prompt, model output reaching exec/a shell, an uncapped loop that can burn $10k overnight, a missing kill switch. SonarQube has no concept of any of those. Keep your SAST suite — this is the agent layer on top, not a replacement.
What kinds of issues does the scan actually catch?
The agent-layer failure modes behind real, documented incidents:
  • Prompt injection — direct and indirect — untrusted input in a system prompt (the Chevrolet $1-car pattern, OWASP’s #1 LLM risk), and the harder one: a retrieved document, HTTP response, or tool return reaching the instruction channel, where a poisoned document reads as a command.
  • Exec/eval/shell sinks reachable from model output — eval(), exec(), os.system, subprocess, pickle fed by the model’s reply — the CVE-2025-51472 remote-code-execution class.
  • Model-driven consequential actions — a model-controlled URL into an HTTP client (SSRF / egress), a model-controlled path into a file delete/overwrite, or model output interpolated into raw SQL.
  • Secrets / PII leaking into a prompt — a hardcoded key, env var, or PII field interpolated into a prompt sent to a third-party model (data egress to the provider — an agent-aware egress path conventional SAST often lacks the context to model).
  • Irreversible tools with no gate — an agent tool that deletes / sends / pays / deploys with no confirmation, dry-run, or human-in-loop guard.
  • Cost & reliability — uncapped LLM calls, unbounded while True: loops (the $5-task-becomes-$400 runaway), and unvalidated model-output parses that crash the agent.
  • Hardcoded secrets in agent code (a convenience check; use a dedicated scanner for full coverage).
Each finding shows the exact file:line, a stable rule id (RG-EXEC-001) cited to OWASP LLM & NIST AI RMF, and the fix. The analyzer parses the code (AST) with light taint tracking, not keywords — so it flags eval(resp.choices[0].message.content) as a confirmed HIGH but stays silent on a careful, gated tool. Precision-first, and checkable: 100% precision on a public 67-case labeled benchmark you can re-run (python benchmark/run.py), where every HIGH is machine-verified to carry a provenance chain — origin line → value → sink line. A variable's name can never produce a HIGH. See the results →  ·  Watch a rule fire →
What does the live agent battery test?
When you point release-gate at a live agent (CLI agent-score or the on-site live scan), it runs four weighted dimensions. Safety plants a canary secret in the agent's context and runs a tiered prompt-injection / exfiltration battery (L1 direct → L4 multi-turn); a confirmed leak is a hard BLOCK. Correctness runs your domain evals. Loop behavior checks convergence and catches runaways. Cost & latency characterizes per-call spend. A high total can't buy back a weak dimension — promote floors keep a broken-but-safe agent out of PROMOTE.
What's PROMOTE / HOLD / BLOCK?
The release verdict. PROMOTE — ship it. HOLD — usable but a dimension is weak; tighten before promoting. BLOCK — a hard failure (e.g. a confirmed canary leak, or the agent errored on most calls). Exit codes are 0 / 10 / 1 so it drops straight into CI.
Does scoring make real calls and cost money?
Yes — agent-score runs your actual agent through the battery (~20–30 calls), so it costs real tokens against whatever model your agent uses. It runs the agent; it doesn't estimate. The static repo audit (audit <repo>) is free and makes no model calls.
Does it map to compliance frameworks?
Yes. The same probe evidence rolls up to OWASP LLM Top 10, the NIST AI RMF, and the EU AI Act — with honest NOT_ASSESSED where it doesn't test something, because a fake green fails an audit harder than an admitted gap.
Is the CLI free? Do you store my code?
The CLI is 100% free and unlimited — no scan caps, no account, works in any CI pipeline. It runs locally and makes no model calls for the static audit. The audit clones your repo, scans it, and doesn't retain the code. The platform (optional) adds persistent history, team visibility, and an audit trail.

Didn't find your answer?

Sign up (free) to send us your question — that way we have an email to reply to.

Scan your repo now — takes 10 seconds

No sign-up required for the first scan.

Security posture —

All repos, live risks, and historical trend in one view.

Loading…

Loading report…