ShipGateHow It WorksScanning a repository is 3 free web scans per month — 17 static gates, each one named, on the exact revision you point at. Continuous enforcement on every pull request is $50/month: the GitHub check, evidence bound to the exact artifact hash, and persisted SHIP / NO_SHIP history.
3 free scans / month · Continuous CI $50/mo, or included with any paid WholeStack plan
Built to catch what these tools generate
Works with your AI editor
A build that compiles is not a change that is safe. These are the three ways a merge gets waved through anyway.
Tests and linters answer whether the code compiles. They do not answer whether a protected route lost its auth guard, or whether a caught failure now renders a success toast anyway.
A tool that returns green on unreadable input is worse than no tool. ShipGate keeps an UNVERIFIED verdict for exactly that case: it never reports a result it did not earn.
A verdict is only true for the artifact that earned it. Once the tree moves on, an old SHIP is not evidence — which is why every verdict here is bound to an exact hash and flagged when it goes stale.
ShipGate exists for the moment someone asks “what did we actually check before this merged?” The answer is a named gate, a finding, and a hash — not a screenshot of a green tick.
A gate is only worth having if it tells you when it cannot answer. ShipGate publishes its own limits in the same places it publishes verdicts.
Manifest verification checks the content hash and a local Ed25519 service signature. That is authenticity — not a public CA, and not a third-party attestation.
The free scan has no approved spec, no runtime evidence, and no signed certificate. It never issues SHIP and never returns a green branch-protection check.
Continuous CI answers 401 without an account and 402 without the entitlement, and refuses activation when the GitHub App lacks Checks: write.
The check WholeStack posts back on the commit — the same 17 gates as the free scan, run on that commit alone.
Free scan → advisory verdict → the check on every pull request.
Point ShipGate at a GitHub repository or a local folder. All 17 static gates run and each one reports its own result. 3 free web scans per UTC month.
The report names the failing gate, the finding, and the revision it was earned on. A spec-free static scan is advisory by design — it never issues SHIP and never returns a green check.
Continuous CI installs the WholeStack GitHub App. Nothing is added to your repository and no runner minutes are spent: WholeStack fetches that one commit onto its own infrastructure, runs the gates there, deletes the checkout, and posts a commit-bound check. Included with every paid WholeStack plan; $50/month on its own.
Readiness guidance, not a release decision. CLEAR is the best a spec-free scan can earn, and it still never authorizes a deployment.
The report names the blocker, the gate that caught it, and the fastest path back to a fresh scan. In continuous CI the pull-request check fails with it.
Unreadable, empty, or unsupported input never becomes a reassuring green result. A missing answer is reported as missing.
Persisted runs live behind the ShipGate dashboard — part of continuous CI, and of every paid plan. The free scan reports; CI remembers.
Every persisted run with its decision, tree digest, file count, and source commit.
Completed runs counted into a ship rate — exactly what ShipGate persisted, never a recomputed verdict.
When the project's tree moves past a run, that verdict is marked stale instead of shown as current.
Scanning a repository is free. Continuous enforcement on every pull request is $50/month — or already included in the plan you pay for.
Anyone can scan. 3 free web scans per month.
Continuous enforcement on every pull request
Already paying for WholeStack? You already have it.
What is free, what costs $50/month, and what ShipGate refuses to claim.
The free scan is the demo: 17 gates on your code, per-gate findings, one advisory verdict. Turn on the pull-request check when you want it to happen on every merge.
ShipGate© 2026 ShipGate. All rights reserved.
