# agents-shipgate

> Static release-readiness gate for AI agent tool surfaces. CLI and GitHub Action. Apache-2.0.

## Identity

- Display name: Agents Shipgate
- Package name: agents-shipgate
- Repository name: agents-shipgate
- CLI binary: agents-shipgate
- CLI binary alias: shipgate
- Publisher: Three Moons Lab
- Publisher URL: https://threemoonslab.com/
- License: Apache-2.0
- Latest public release: v0.10.0
- Canonical repository: https://github.com/ThreeMoonsLab/agents-shipgate
- Do not use: Agent Shipcheck, Agent Shipgate, agents shipgate, Agents-Shipgate

## What it is

- Agents Shipgate is a static, manifest-first scanner.
- Agents Shipgate reads `shipgate.yaml` plus declared local tool sources.
- Agents Shipgate writes deterministic findings as Markdown, JSON, and SARIF.
- Agents Shipgate fits the release-gate slot for tool-using AI agents.
- Agents Shipgate runs in CI on pull requests before promotion.
- Agents Shipgate checks seven dimensions of tool-use readiness: inventory, schema, auth, approval policies, side effects, idempotency, and blast radius.

## What it is not

- Not an LLM eval framework.
- Not a runtime guardrail.
- Not an LLM gateway.
- Not a security audit.
- Not a compliance certification.
- Not a SOC, ISO, or HIPAA toolkit.
- Does not invoke models.
- Does not run agents.
- Does not call tools.
- Does not connect to MCP servers.
- Does not make scanner network calls by default.
- Does not collect scanner telemetry by default.

## Inputs

- Model Context Protocol (MCP) exports.
- OpenAPI 3.x specifications.
- OpenAI Agents SDK Python entrypoints, using static AST extraction.
- Anthropic Messages API artifacts: system prompts, tools.json, and policy YAML.
- Google ADK Python and YAML config.
- LangChain and LangGraph Python entrypoints, using static AST extraction.
- CrewAI Python entrypoints, using static AST extraction.
- OpenAI API artifacts: prompts, function schemas, response formats, tests, and traces.

## Outputs

- Markdown report: `agents-shipgate-reports/report.md`.
- JSON report: `agents-shipgate-reports/report.json`.
- JSON report schema (current): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/report-schema.v0.16.json
- Release Evidence Packet (Markdown / JSON / HTML, optional PDF): `agents-shipgate-reports/packet.{md,json,html}`.
- Packet schema (current): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/packet-schema.v0.5.json
- SARIF report: `agents-shipgate-reports/report.sarif`.
- Check catalog: https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/checks.json
- Release gating signal: `release_decision.decision` ∈ `{"blocked", "review_required", "insufficient_evidence", "passed"}` in `report.json` (baseline-aware; v0.8+; `insufficient_evidence` added v0.14; consumers should treat unknown future values as `review_required`).
- Installed CLI contract: `agents-shipgate contract --json`.

## Quickstart

- Install with pipx: `pipx install agents-shipgate`.
- Install with pip: `python -m pip install agents-shipgate`.
- Install with uv: `uv tool install agents-shipgate`.
- Run a zero-config fixture: `agents-shipgate fixture run support_refund_agent`.
- Initialize a repo manifest: `agents-shipgate init --workspace . --write`.
- Scan a repo: `agents-shipgate scan -c shipgate.yaml`.
- GitHub Action: `ThreeMoonsLab/agents-shipgate@v0.10.0`.

## Source of truth

- Landing page: https://threemoonslab.com/
- Product page: https://threemoonslab.com/agents-shipgate/
- Quickstart: https://threemoonslab.com/quickstart/
- Glossary: https://threemoonslab.com/glossary/
- Blog: https://threemoonslab.com/blog/
- Check catalog page: https://threemoonslab.com/checks/
- Repository: https://github.com/ThreeMoonsLab/agents-shipgate
- Wiki: https://github.com/ThreeMoonsLab/agents-shipgate/wiki
- Latest release: https://github.com/ThreeMoonsLab/agents-shipgate/releases/latest
- AGENTS.md: https://github.com/ThreeMoonsLab/agents-shipgate/blob/main/AGENTS.md
- STABILITY.md: https://github.com/ThreeMoonsLab/agents-shipgate/blob/main/STABILITY.md
- Discovery metadata: https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/.well-known/agents-shipgate.json
- Website discovery metadata: https://threemoonslab.com/.well-known/agents-shipgate.json
- Trigger catalog (machine-readable mirror of the AGENTS.md trigger table): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/triggers.json
- Error-kind catalog (machine-readable enumeration of agent-mode error kinds with exit codes and recovery hints): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/errors.json
- Long-form agent reference (AGENTS.md + recipes + checks + concepts + autofix policy concatenated): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/llms-full.txt
- Zero-install detector (stdlib-only Python; same structural verdict as `agents-shipgate detect --json` — emits the canonical `DetectResult` fields plus `script_version`, but NOT the CLI's `diagnostics` or `next_actions` arrays): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/tools/shipgate-detect.py
- Zero-install paths overview (single-file detector, uvx, GitHub Action): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/zero-install.md
- Manifest schema: https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/manifest-v0.1.json
- Report schema (current): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/report-schema.v0.16.json
- Packet schema (current): https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/packet-schema.v0.5.json
- Current agent contract: https://raw.githubusercontent.com/ThreeMoonsLab/agents-shipgate/main/docs/agent-contract-current.md

## Category vocabulary

- Agent release readiness: static, manifest-based pre-flight checks on AI agent tool surfaces before promotion.
- Agent release gate: the CI mechanism that runs tool-use readiness checks on every PR.
- Tool-use readiness: the seven-dimensional release check on an agent's tool surface.
- Tool surface: the set of named, schemaed actions an agent can invoke.
- Tool surface drift: divergence between the tools reviewed at release time and the tools exposed at runtime.
- Manifest-first: the source-of-truth release artifact is a checked-in YAML file named `shipgate.yaml`.
- Baseline: a reviewed finding snapshot used so strict mode fails only on new findings.
- Suppression: an explicit ignored finding with a required written reason.

## Trajectory

- Today: static release-readiness checks for declared AI agent tool surfaces.
- Next: baselines, suppressions, runtime evidence, and release-review evidence across the agent lifecycle.

## Maintainer

- Three Moons Lab: https://threemoonslab.com/
- Contact: help@threemoonslab.com