Agents Shipgate
Agents Shipgate returns a deterministic merge verdict on AI-generated agent PRs before the code lands.
Shipgate earns its place in an agent PR pipeline because it never executes your agent code and still names what a bound tool reaches — endpoint, request fields, credential variable, model-chosen arguments. The v1.2.0 diff --application comparison across OpenAI Agents SDK and Google ADK source is more substantive than a generic CI lint. It is pre-merge evidence, not a runtime guardrail or a safety certification, and v1.2.0 diff --application deliberately supplies no verdict or merge permission —
Verified 2d ago · liveness 62/100 · cite: rightaichoice.com/tools/agents-shipgate
- AI engineers shipping tool-using agents who want PR-time capability review before merge
- Platform teams building agent CI/CD merge gates that never execute agent code
- Security and GRC reviewers who need release evidence and audit trails for agent changes
- Teams running Codex, Claude Code, or Cursor that want a machine-readable verdict the agent can act on
- Teams needing runtime guardrails or call-time policy enforcement — Shipgate is pre-merge only
- Projects with no AI-generated agent code or tool-surface changes in their PRs
- Anyone wanting LLM evals or output-quality testing rather than a merge gate
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Agents Shipgate if you have no CI pipeline or PR review process to hang a verdict on — it needs a manifest, a base/head ref pair, and a merge gate to act as, and it never runs your agent at runtime.
Agents Shipgate is published under Apache-2.0 and the CLI and GitHub Action run locally, so the cost driver is engineering and CI time, not a subscription. Compare it against commercial agent-observability or MCP-gateway products that charge per seat or per volume, and against building the gate yourself: the real spend here is the hours spent declaring shipgate.yaml inputs and validating adapter coverage on your own tool surfaces.
In short
Agents Shipgate — Agents Shipgate returns a deterministic merge verdict on AI-generated agent PRs before the code lands. Best for AI engineers shipping tool-using agents who want PR-time capability review before merge, Platform teams building agent CI/CD merge gates that never execute agent code, Security and GRC reviewers who need release evidence and audit trails for agent changes. Free to use.
What's new in Agents Shipgate
Checked 6 days agoAcross the latest 3 updates: 1 feature update, 1 launch and 1 changelog entry.
v1.2.0 adds diff --application and closes three fail-open host comparisons
diff --application compares agent application wiring from OpenAI Agents SDK and Google ADK source across two Git refs with no manifest and no verdict. It also names what a bound tool reaches — endpoint, request fields, credential variable, model-chosen arguments — and closes thre
v1.1.0 makes refusals and comparisons state what they established
A refusal now names the files that blocked an incomparable host comparison, every comparison lists the sources the run read or tried to read, and each permission change carries its direction and allow/deny/ask scope. diff --json row semantics were aligned with the text output.
v1.0.0 freezes report contract and adds manifest-free host diff
v1.0.0 ships the never-published 0.16.0 work and adds shipgate diff: one row per host grant a change touches, with no manifest and no committed baseline. The report contract is frozen at 1.0 with a 1.x stability line keeping codex-boundary-json through 1.x.
What people actually say about Agents Shipgate — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
2 mentions across 1 source (GitHub) · researched Jul 4, 2026.
Average across the 1 source that answered — each source counts once, not each post.
- +Deterministic merge verdicts prevent unsafe agent code from landing.
- +Local-first design: no network calls, no LLM, no telemetry by default.
- +Supports MCP, OpenAPI 3.x, and multiple agent SDKs out-of-the-box.
- +Capability lock and diff artifacts create clear audit trails.
- +GitHub Action offers multiple enforcement modes (advisory, strict).
- −Too early for production trust—only 104 GitHub stars.
- −No community discussion outside GitHub—lack of third-party validation.
- −Only one documented issue, a demo rehearsal, not real bug reports.
- −Static analysis cannot catch all runtime agent misbehaviors.
- −Learning curve for writing shipgate.yaml manifests and interpreting diffs.
- • No hidden costs—entirely free open-source tool.
Viability Score
How well maintained and how widely used is Agents Shipgate? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Static analysis of MCP tool exports against declared sources
- OpenAPI 3.x spec analysis for changed operations
- OpenAI Agents SDK Python entrypoint checks
- Anthropic Messages API artifact support
- Google ADK Python and YAML config analysis
- LangChain and LangGraph static Python input checks
- CrewAI static Python input checks
- Codex repo config analysis (.codex/config.toml, .codex/hooks.json)
- Codex plugin package and marketplace stub analysis
- Claude Code plugin marketplace detection
- n8n workflow JSON and source-control stub analysis
- Deterministic merge verdict with four reviewer labels
- shipgate diff --application compares OpenAI Agents SDK and Google ADK application wiring across two Git refs
- shipgate check --agent codex|claude-code|cursor emits shipgate.codex_boundary_result/v1 JSON
- Capability lock and semantic diff artifacts (capabilities.lock.json, capability-lock-diff.json/.md)
About Agents Shipgate
Agents Shipgate is an open-source, local-first CLI and GitHub Action that verifies AI-generated agent capability changes and returns a deterministic merge verdict before agent code lands. It is built by Three Moons Lab, and the package, CLI, repository and GitHub Action all carry the name agents-shipgate. Run it when Codex, Claude Code, Cursor, or a human adds or changes MCP tools, OpenAPI operations, framework-declared tools, prompts, permission scopes, approval and confirmation policies, prohibited actions, shipgate.yaml, or CI release gates. The workflow is deliberately narrow: Shipgate reads a shipgate.yaml manifest plus declared local tool sources, policy and trust-root files, and PR diffs, then writes verifier artifacts and a PR comment that tell reviewers whether a capability change can merge. Static inputs span MCP exports, OpenAPI 3.x specs, OpenAI Agents SDK Python entrypoints, Anthropic Messages API artifacts, Google ADK Python and YAML config, LangChain/LangGraph and CrewAI static Python inputs, Codex repo config (.codex/config.toml, .codex/hooks.json), Codex plugin packages and marketplace stubs, and n8n workflow JSON. Nothing executes your agent and nothing imports user code. The adoption object is the verdict. The wire signal is release_decision.decision and reviewers see one of four labels: mergeable, human review required, insufficient evidence, or blocked. v1.2.0 publishes the agent-native merge contract: eight contracts (trigger, capability change, merge verdict, repair, forbidden action, human authority, trust root, attestation), each mapped to the artifact implementing it, all deterministic projections of the single gate. A coding agent reads agent-handoff.json first, treats verifier.json.agent_controller as the authoritative substrate, or asks in one command with shipgate check --agent codex|claude-code|cursor. It suits AI engineers shipping tool-using agents, platform teams wiring agent CI/CD, and security or GRC reviewers who need release
Behind the Verdict
Most agent release tooling wants to sit in the request path or score model output. Shipgate takes a narrower, more defensible slot: the capability review that happens between a generated PR opening and a human clicking merge. We'd reach for this when generated agent changes touch tool surfaces — a new MCP tool, an added OpenAPI operation, a widened permission scope, a changed approval policy. Those diffs are exactly where a reviewer's eyes glaze over, and that is the surface Shipgate reads. The four-label verdict (mergeable, human review required, insufficient evidence, blocked) is a usable wire signal rather than a wall of findings, and it is honest enough to return insufficient evidence instead of guessing. The agent-native contract in v1.2.0 is the part that changes workflows. Eight contracts map to concrete artifacts, and a coding agent can branch on agent-handoff.json or verifier.json.agent_controller without a human translating the result. If you run Codex, Claude Code, or Cursor against your own repo, that turns review into a loop the agent can exit or continue on its own. Where it bites: diff --application compares wiring across two Git refs but ships no verdict and no merge permission, so it is a comparison utility, not a gate. Coverage breadth is also a real variable — a run that extracts tools can still come back insufficient evidence when adapter support is thin for your framework, so budget time for a pilot on your own refs before you make it blocking in branch protection. Teams with no agent code, or no tool-surface churn in PRs, will get nothing out of it. In practice, the honest comparison is CI linting plus a hand-written reviewer checklist. Shipgate replaces the checklist with a machine-readable decision and a capability lock you can diff over
Researching Agents Shipgate? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Agents Shipgate actually fits — and what changes day-one when you adopt it.
A Codex-generated PR adds two MCP tools and widens a permission scope. You run agents-shipgate verify --workspace . --config shipgate.yaml --base origin/main --head HEAD --ci-mode advisory --format json, read report.json (schema v0.28) plus the PR comment with its semantic capability diff, and see the scope widening labelled human review required rather than mergeable.
Outcome: You get a reviewer label and capability lock diff before anyone merges, with the widened scope surfaced as evidence rather than buried in a diff.
You wire the GitHub Action into the repo and let it gate agent PRs, emitting SARIF into GitHub code-scanning so findings land in the security tab, and agents-shipgate attest writes a content-addressed attestation.json per release.
Outcome: Agent capability changes hit a deterministic gate in the same workflow as the rest of your CI, with an attestation record attached to each release.
The agent runs shipgate check --agent codex --workspace . --format codex-boundary-json and reads the single stdout object: decision, completion_allowed, must_stop, first_next_action, repair, and verifier.json.agent_controller with fix_task and forbidden_file_edits.
Outcome: The agent stops, repairs, or merges on a machine-readable verdict without a human translating the result, and cannot silently edit files the contract forbids.
Use Cases
- Add a release gate to GitHub Actions that blocks PRs expanding agent capabilities without approval policies.
- Scan every PR touching MCP exports for missing scopes, wildcard paths, or undocumented side effects.
- Generate a structured release-readiness report for AI agent PRs before staging or production deployment.
- Give coding agents (Codex, Claude Code, Cursor) a deterministic merge verdict contract they can act on autonomously.
- Attest release artifacts with a content-addressed record for audit trails and compliance reviews.
- Review OpenAI Agents SDK PRs: statically reads @function_tool decorators for findings.
- Review Claude tool-use agent PRs: scans JSON tools array and system prompt for findings.
- Compare agent application wiring between two Git refs with diff --application (no manifest, no verdict).
Limitations
- Agents Shipgate requires a declared shipgate.yaml manifest — it does not discover your agent configuration on its own unless you use the manifest-free shipgate diff or diff --application paths.
- It does not run the agent or import user code by default, so it cannot observe behavior, only declared surfaces.
- Static analysis can miss dynamic tool registrations or runtime-derived schemas. v1.2.0's diff --application reads only OpenAI Agents SDK and Google ADK source wiring and supplies no release verdict or merge permission, so it is not a gate.
- The 2026-07-18 adapter pilots found coverage can wobble: two pinned fixtures returned insufficient-evidence verdicts despite extracting tools.
- The project spent a long pre-1.0 stretch on contract churn — v0.14.0 withdrew the premature 1.0.0-alpha line and replaced the legacy agent-json format with codex-boundary-json — before v1.0.0 froze the report contract at 1.0 (2026-09-14) with a 1.x stability line.
- It produces merge-review evidence and does not certify an agent as safe.
as of 2026-10-07
Verification history
We have re-verified Agents Shipgate 9 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 9 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Agents Shipgate tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Open Source
$0/mo
Ideal for
AI engineers and platform teams who already run agent PRs in CI and can maintain a shipgate.yaml manifest for the repos they want gated.
What this tier adds
Starting tier and the only published plan: Apache-2.0 local-first CLI and GitHub Action at $0/mo, including deterministic merge verdicts, static analysis of MCP/OpenAPI/framework tool sources, agent-handoff.json, verifier.json and verify-run.json artifacts, SARIF output, and
Where the pricing makes sense
The company stage and team size where Agents Shipgate's pricing actually pencils out — and where peers do it cheaper.
Agents Shipgate is published under Apache-2.0 and the CLI and GitHub Action run locally, so the cost driver is engineering and CI time, not a subscription. Compare it against commercial agent-observability or MCP-gateway products that charge per seat or per volume, and against building the gate yourself: the real spend here is the hours spent declaring shipgate.yaml inputs and validating adapter coverage on your own tool surfaces.
Setup time & first value
How long it actually takes to get something useful out of Agents Shipgate — broken out by persona, not the marketing-page minute.
AI engineers: install the CLI, write shipgate.yaml for one repo, and run agents-shipgate verify against a real agent PR — the vendor points at the quickstart and the coding-agent workflow instructions first. Platform engineers: add the GitHub Action to an existing pipeline and start on --ci-mode advisory. Security/GRC reviewers: first value comes from the PR comment and report.json on a real
Switching to or from Agents Shipgate
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From ad-hoc CI lint scripts: replace bespoke shell checks on MCP/OpenAPI files with shipgate.yaml plus the GitHub Action.
- →From a runtime guardrail only: keep the runtime guardrail and add Shipgate in the pre-merge slot, since it owns capability review rather than call-time enforcement.
- →From per-framework review checklists: point one shipgate check at MCP, OpenAPI, OpenAI Agents SDK, Anthropic, Google ADK, LangChain/LangGraph, CrewAI, Codex and n8n inputs.
- →From legacy agent-json consumers: v0.14.0 replaced the legacy agent-json format with codex-boundary-json, and the 1.x line keeps codex-boundary-json and legacy policy discovery through 1.x.
- ↗To an LLM eval framework: run output-quality evals alongside Shipgate, which does not score model output.
- ↗To a runtime guardrail or MCP gateway: add call-time enforcement on top of the pre-merge verdict.
- ↗To an agent observability platform: add production tracing where you need post-deploy runtime visibility.
Integrations
Resources & Guides
Tutorials & Learning
YouTube returned 6 videos for “Agents Shipgate”, and we withheld 5: 5 did not mention Agents Shipgate. Showing the 1 we can prove is about Agents Shipgate.
Official links
Tools that pair well with Agents Shipgate
Common stack mates teams adopt alongside Agents Shipgate, with the specific reason each pairing earns its keep.
Endor Labs
Agentic application security that governs AI coding agents and verifies reachable vulnerabilities before code ships
Snyk
Snyk scans AI-written code, governs coding agents, and pentests AI apps before they ship.
GitHub Copilot
GitHub Copilot is an AI coding agent that completes code, reviews pull requests, and runs tasks from issue to merge.
Featured Head-to-Head Comparisons
Agents Shipgate vs Spider Cloud
Choose Agents Shipgate if you need deterministic, pre-merge verification of AI agent capability changes in CI/CD—it's free, open-source, and integrates with multiple agent SDKs. Choose Spider Cloud if your AI agents require fast, reliable web data extraction at scale, with a freemium model and strong anti-blocking capabilities. They address fundamentally different stages of the AI agent lifecycle: governance vs. data ingestion.
Agents Shipgate vs Presto Voice
Presto Voice and Agents Shipgate serve entirely different domains. If you're a QSR chain needing to automate drive-thru ordering with upselling, Presto Voice is the clear pick. If you're an AI engineering team shipping agent tools and need deterministic pre-merge capability checks, Agents Shipgate's open-source free model is a no-brainer. There's no direct competition—choose based on your problem: restaurant operations or agent CI/CD.
Agents Shipgate vs Temporal Ai
Choose Agents Shipgate if your bottleneck is pre-merge trust and audit for agent tool changes — it's free, deterministic, and integrates directly into CI. Choose Temporal if you need post-deploy durability, crash recovery, and long-running (possibly human-in-the-loop) agent orchestration where state persistence is critical. They solve different halves of the 'reliable agent' problem.
Alternatives to Agents Shipgate
View all
Endor Labs
Agentic application security that governs AI coding agents and verifies reachable vulnerabilities before code ships
Snyk
Snyk scans AI-written code, governs coding agents, and pentests AI apps before they ship.
GitHub Copilot
GitHub Copilot is an AI coding agent that completes code, reviews pull requests, and runs tasks from issue to merge.
Frequently Asked Questions
Best-of guides
Used Agents Shipgate? Help shape our editorial sentiment research.