# Agents Shipgate

An open-source CLI and GitHub Action that statically reviews what a pull request changed about an AI agent's tool permissions and capabilities, before that change merges.

Agents Shipgate is local-first and static by default, with no agent execution, tool calls, LLM calls or network access. It scans MCP, OpenAPI, OpenAI Agents SDK, Anthropic Messages API, Google ADK, LangChain and LangGraph, CrewAI, the OpenAI API, Codex repository configuration and plugins, n8n, and Conductor OSS workflow artifacts, and writes a deterministic Tool-Use Readiness Report before an agent gets production-like permissions.

Running its diff command compares a working tree against its merge base and prints each changed grant or replaced rule, with no manifest, saved baseline or account required, for example flagging a pull request that widens a Claude Code allow rule, drops a denial rule, or adds a new MCP server. A separate application-comparison mode can also diff OpenAI Agents SDK and Google ADK tool bindings directly from source code, showing before-and-after signatures and their locations. It is licensed Apache-2.0 and written in Python.

Website: https://threemoonslab.com/agents-shipgate/