Documentation

Merge-path first: scan a repository for free, read the per-gate verdict, then put the check in the merge path when you want it enforced on every pull request.

Developer surfaces

The shipgate binary, MCP server, VS Code extension, and GitHub Action all call the same evaluator. None of them invent a SHIP.

CLI

shipgate next — scan the repo, then evaluateShip

MCP

stdio tools: next, evaluate, prove, health, public-verify

VS Code extension

Status bar runs shipgate next

CI plugin

GitHub Action at packages/shipgate/action.yml

Start here — the free scan

Scanning a repository costs nothing and needs no card. Start there before you enforce anything in CI.

Scan a repository

Run all 17 static gates against a GitHub repository or a local folder

Walk a run end to end

A blocked pull request, the finding that blocked it, and the fixed run

What each verdict means

CLEAR, BLOCKED, UNVERIFIED — and why the pull-request check is never green

What green CI misses

The failure classes a passing build and test suite were never asked about

Merge path & CI

Continuous enforcement is the paid half: $50/month, or included with any paid WholeStack plan.

Turn on continuous checks

Install the GitHub App and get the "WholeStack / Readiness Advisory" check on every pull request

What CI costs

Free scans, the ShipGate CI add-on, and what Enterprise adds

Verdict history

Past runs, per-gate results, and the commit each verdict was earned on

Proofs & verification

Every verdict is bound to one revision. These surfaces let anyone re-check one.

Proof register

Published proofs and the artifact each one is bound to

Re-verify a proof

Check a proof id, a deployed contract, or pasted certificate JSON against public inputs

Attestation lookup

Find an attestation by content hash or id, or verify a signed deployment manifest

Security & trust

Data handling, disclosure policy, and what we will put in writing for a review.

Security overview

What leaves your environment, and what does not

Trust & practices

Controls we operate and certifications we do not claim

Vulnerability disclosure

Scope, timelines, and researcher protections

Choosing ShipGate

Where the gate fits next to the tools you already run.

Compared with other tools

What ShipGate does and deliberately does not do

Enterprise overview

SSO, SCIM, audit export, dedicated deployment

Cost model

Put your own numbers against the subscription cost

Source of the developer kit

CLI, MCP, VS Code, and the GitHub Action live in @wholestack/shipgate. Headline command is shipgate next. Build the package, then run node packages/shipgate/dist/devkit/cli.js. This site is the dashboard and hosted scan. Hosted GitHub App checks stay at /scan/repo#continuous.

Need help?

Send the repository, the verdict you got, and what you expected.