PrufGate

Checks whether code, and the tests that claim it works, are real.

Linters check that code compiles. PrufGate looks for code that compiles, passes review at a glance and still does not do the job. This is the kind of code an AI coding agent (or a hurried human) writes to make a task look finished:

• a catch block that returns a hard-coded success object;
• a click handler that does nothing;
• a test that asserts true, or mocks the very function it tests;
• a .skip, @ts-ignore or lowered coverage threshold slipped into a diff;
• an import of a package that is not declared anywhere;
• an API route that loads a record by ID without checking who owns it.

PrufGate is deterministic: plain Python, no network calls and no LLM unless you ask for one. It runs in seconds on a pull request, and writes SARIF for code scanning and Markdown for humans. It is meant to sit next to your linters and SAST tools, not replace them.

The six engines

Details, rule IDs, supported languages and known limits for each engine: docs/ENGINES.md.

PrufGate uses pattern and structure heuristics, not a full parser for every language. It will miss things and it will sometimes flag correct code. Every finding names its rule, and inline prufgate-ignore comments, exemptions and baselines let you record why.

Quick start

PrufGate needs Python 3.9 or newer and Git.

pipx install prufgate     # or: pip install prufgate  (the `prufgate` and `prufgate-mcp` commands)
prufgate --self-check     # every engine against its built-in fixtures

Or run the signed container image, which adds the full gate with ast-grep, gitleaks and zizmor:

docker run --rm -v "$PWD:/workspace" ghcr.io/guardianvigil-labs/prufgate:1.0.0          # the fast gate on this repository
docker run --rm -v "$PWD:/workspace" ghcr.io/guardianvigil-labs/prufgate:1.0.0 prufgate check .

Or add the GitHub Action to a pull-request workflow, pinned to the commit SHA of the v1.0.0 tag (full example):

- uses: actions/checkout@<commit-sha>
  with: { fetch-depth: 0, persist-credentials: false }
- run: python3 -m pip install "PyYAML>=6.0"
- uses: GuardianVigil-Labs/Prufgate@<commit-sha-of-v1.0.0>

Every release is signed and carries build provenance and an SBOM: Verify a release.

Then, in your project:

prufgate check .                          # engines 1-5 on the whole repository
prufgate check --changed --base origin/main   # only what this branch changed
prufgate init --hooks                     # starter config + coding-agent hooks

Exit codes are the same everywhere: 0 clean, 1 blocking findings (P0/P1), 2 PrufGate could not run (bad config, bad base ref, unreadable file, engine crash). A crash never reads as a pass.

Ways to run it

The full command and option reference is in docs/GETTING_STARTED.md, and every configuration key is in docs/CONFIGURATION.md.

Configuration in one look

PrufGate works without configuration. To tune it, add .prufgate/config.yaml:

version: 1
packs: [core, web-ui, ai-safety]      # cti is an opt-in domain pack
exclude: ["dist/**", "vendor/**"]
auth_guards: [requireUser, get_current_user]
tenant_keys: [organization_id, account_id]
exempt:
  src/legacy/adapter.ts:
    route-canned-fallback: "#104: legacy fallback until the payments API migration"
known_debt:
  stub-click-handler: 0                # a ceiling that can only go down

Documentation

• Getting started: install, commands, reports, exit codes
• Configuration reference: every key, suppressions, environment variables
• The engines: rules, languages and limits
• CI and agent integration: GitHub Action, other CI, agent hooks, MCP, REST API
• Custom rules: your own ast-grep rules and hooks
• Architecture
• Changelog

Contributing and security

Contributions are welcome: see CONTRIBUTING.md and the maintainer guide AGENTS.md. Please report vulnerabilities privately, as described in SECURITY.md.

PrufGate is published by GuardianVigil under the Apache License 2.0. The name and logo are trademarks: see TRADEMARKS.md.