Validated on real agent workflows. Full audit trail. Zero friction setup.
No credit card required
$ skillgate scan ./my-agent-skill --enforce
SkillGate v1.0.0 | Agent Skill Security Scan
Scanning: ./my-agent-skill
Files: 12 (Python, JS, Shell)
Rules: 120 active
⚠ SG-SHELL-001 subprocess.run() with shell=True main.py:23
⚠ SG-NET-001 urllib.request to external URL fetch.py:45
✕ SG-CRED-001 Hardcoded API key detected config.py:12
✕ SG-EVAL-001 eval() with user input handler.py:67
Risk Score: 74/200 (Medium)
Policy: FAIL: 2 critical findings exceed threshold
✕ Deployment blocked. Fix critical findings to proceed.Blocks risky actions before local and CI execution
Protects Claude and MCP tool workflows with trust checks
Secures Codex runs with safe defaults and provider controls
Generated from public agent repositories and replayed with authenticated SkillGate sidecar enforcement.
Total testbed corpus
3,470 invocations
awesome-llm-apps corpus
496 invocations
antigravity corpus
2,856 invocations
openclaw corpus
106 invocations
nanobot corpus
12 invocations
Authenticated sidecar replay
1,735 baseline invocations
One control plane from static scan to runtime enforcement, built for agent security teams.
Block risky tool actions before they run across editor, local, and CI workflows.
Keep protections reliable with secure sessions and safe fallback behavior.
Protect MCP tool paths before requests reach external providers.
Protect Claude workspaces from unsafe configuration and prompt injection.
Run Codex safely with policy checks and strict CI defaults.
Generate records your security and compliance teams can trust.
From First Scan to Production Protection
Flexible Pricing
Start with local visibility, then add CI blocking and runtime enforcement as you scale.
Free: basic visibility. Pro: stronger policy checks. Team: CI protection across repos. Enterprise: advanced controls and evidence for high-trust environments.
Three layers: static policy checks, CI enforcement, then runtime and org controls.
Coverage Progression
Local and Policy ChecksCI and Team ProtectionProduction and Org ControlsBilling
Yearly saves 17%Pick a plan by how much control you need in real production paths.
Full capability matrix across policy, CI, runtime, and compliance needs.
| Capability | Free | Pro | Team | Enterprise |
|---|---|---|---|---|
Static Governance Static governance baseline scans | Included | Included | Included | Included |
Policy-as-code customization | Not included | Included | Included | Included |
Signed attestations and verification | Not included | Included | Included | Included |
CI & Fleet Governance Fleet-wide scanning across multiple skills and repositories | Not included | Not included | Included | Included |
CI/CD PR blocking and deterministic annotations | Not included | Not included | Included | Included |
Org risk posture summaries and drift controls | Not included | Not included | Included | Included |
Runtime & Org Control Plane Runtime capability budgets | Not included | Not included | Not included | Included |
Transitive risk and trust propagation graph | Not included | Not included | Not included | Included |
Org-scale policy simulation and rollout modeling | Not included | Not included | Included | Included |
Private relay and air-gapped enforcement modes | Not included | Not included | Not included | Included |
Audit export bundles and control-mapping evidence workflows | Not included | Not included | Not included | Included |
Compliance & Evidence Control mapping evidence packages (EU AI Act, SOC 2, internal controls) | Not included | Not included | Limited | Included |
Signed governance decision logs and provenance export support | Not included | Not included | Limited | Included |
Start with runtime protections locally, then enforce the same guardrails for MCP and Codex in CI.
Built on regression testbeds that replay capability patterns from large public agent skill collections.
# Install
pip install skillgate
# Scan a skill
skillgate scan ./my-skill --enforce
# Verify a signed report
skillgate verify report.json