DiffGate is a deterministic guardrail that your coding agent runs itself before code is written to disk. It provides deterministic checks against AI-generated diffs, scores only changed lines, and classifies them by impact into three levels—green (mergeable), yellow (needs a look), and orange (needs verification)—so reviewers focus their attention on what truly matters.
Key capabilities:
- Diff scoping: reports only changed lines, against the committed baseline, without whole-file noise or rehashing unchanged code.
- Tiered triage: green to merge, yellow to skim, orange to gate, rather than a flat list.
- Run tests on demand: for orange changes it runs your testCommand and shows the real exit code and output, while green and yellow pass instantly.
- Conditional blocking: cross-language injection findings are advisory on their own, and are escalated to blocking only when an optional code graph proves the sink is reachable from an untrusted entry point (HTTP/event handler).
- Change-impact awareness: with the optional code graph it carries cross-file impact scope (caller count, suggested reviewers, untested call sites), and exported symbols with no callers are downgraded.
- Fast: review of changed lines completes in milliseconds, fitting into the agent and editor inner loop.
- Provably low-noise: diffgate bench runs a versioned corpus and achieves 100% precision / 0 false blocks on clean changes.
Security rule coverage: real AST analysis via @babel/parser (JS/TS) and tree-sitter (Python, PHP, Go, Ruby, Java, C#, Kotlin, via WASM), with precise rule matching that avoids false positives in comments or strings, detects export signature changes, and performs sink localization, parameter awareness, and sanitizer awareness for SQL injection. Other languages use comment-aware pattern rules as a deterministic baseline, covering secrets, destructive/schema changes, auth/crypto, dynamic execution/shell invocation, raw queries, and network calls.
How to use it:
- In your coding agent (via MCP): the agent self-checks generated code before it is written to disk, returns structured findings (zero LLM tokens), and shows what it corrected (original + fix + reason). diffgate.mcpb can also be installed with one click in Claude Desktop.
- In your editor (VS Code / Cursor): shows inline squiggles on changed lines, hover cards (reason · owner · quick fix), a risk review tree, and a statusStatus bar summary and deep review (blast-radius analysis for orange findings). Installable from the VS Code Marketplace or Open VSX.
- On the command line and in CI: diffgate check reviews your diff and exits non-zero on high-impact findings; it can be used locally as a pre-commit hook, and the same gate can run in your pipeline. Supports GitHub Action, shared learnings, and organization policy packs. CI runs can optionally layer an external scanner (Semgrep) through the same gate, advisory only and off by default.
Common commands: diffgate init generates .diffgate.json; diffgate check reviews the current diff; check can also point at an existing commit in the log for AI-authored history auditing (history mode is report-only, does not run test commands and does not block commits, and supports --json and --limit); diffgate --help shows the full command list (report, bench, stats, graph, marginal, etc.).
Use cases:
- Coding agents self-checking after generating code and before writing to disk.
- Developers quickly reviewing AI-assisted changes in the editor.
- Teams gating AI-generated code in pre-commit and CI.
- Auditing the history of recently AI-authored commits.
Limitations:
- Coverage varies by language: JS/TS, Python, PHP, Go, Ruby, Java, C#, and Kotlin get deep AST analysis; other languages get only a pattern baseline.
- SSRF is an advisory check across the eight Deep-AST languages; XXE covers JVM (Java, Kotlin) and .NET (C#).
- DiffGate is a deterministic gate on the diff, not an exhaustive whole-repository taint analysis engine. A clean result means "no match at that language tier," not "proven safe." For deep cross-file taint analysis, use it alongside a dedicated SAST.
- The optional AI layer (plain-language explanation and fixes) and cross-file blast-radius analysis are off by default.
- Test commands run only on orange changes.
License: Apache 2.0.
