PrufGate

PrufGate Checks whether code, and the tests that claim it works, are real.

Linters check that code compiles. PrufGate looks for code that compiles, passes review at a glance and still does not do the job. This is the kind of code an AI coding agent (or a hurried human) writes to make a task look finished:

• a catch block that returns a hard-coded success object;
• a click handler that does nothing;
• a test that asserts true, or mocks the very function it tests;
• a .skip, @ts-ignore or lowered coverage threshold slipped into a diff;
• an import of a package that is not declared anywhere;
• an API route that loads a record by ID without checking who owns it.

PrufGate is deterministic: plain Python, no network calls and no LLM unless you ask for one. It runs in seconds on a pull request, and writes SARIF for code scanning and Markdown for humans. It is meant to sit next to your linters and SAST tools, not replace them.

The six engines

Details, rule IDs, supported languages and known limits for each engine: docs/ENGINES.md.

PrufGate uses pattern and structure heuristics, not a full parser for every language. It will miss things and it will sometimes flag correct code. Every finding names its rule, and inline prufgate-ignore: rule -- reason comments, exemptions and baselines let you record why.

Quick start

PrufGate needs Python 3.9 or newer and Git.

pipx install prufgate     # or: pip install prufgate  (the `prufgate` and `prufgate-mcp` commands)

prufgate --self-check # every engine against its built-in fixtures uvx prufgate --version # or run it without installing, with uv

Or download one file, prufgate.pyz, from the latest release (releases after 1.0.0). It is a zipapp with PyYAML (pure Python) inside, so it needs nothing but Python 3.9 or newer:

curl -LO https://github.com/GuardianVigil-Labs/Prufgate/releases/latest/download/prufgate.pyz

curl -LO https://github.com/GuardianVigil-Labs/Prufgate/releases/latest/download/SHA256SUMS sha256sum -c --ignore-missing SHA256SUMS gh attestation verify prufgate.pyz --repo GuardianVigil-Labs/Prufgate python3 prufgate.pyz --self-check python3 prufgate.pyz check .

The hooks that prufgate init --hooks writes call prufgate on PATH, so for them install the file as a command: install -m 755 prufgate.pyz ~/.local/bin/prufgate. The zipapp runs every command a pip install has except mcp (use pipx install prufgate for the MCP server). Like a pip install, it does not include the shell batteries (./prufgate.sh fast / full with ast-grep, gitleaks and zizmor); prufgate.pyz fast and full run the Python engines only. For the full battery use the container image or a checkout. There are no native per-OS binaries: they would need a build on three operating systems for every release, and the zipapp covers the same need. python3 scripts/build_pyz.py builds the same file from a checkout; it downloads the hash-locked PyYAML sdist from PyPI and refuses one that does not match requirements.txt.

Or run the signed container image, which adds the full gate with ast-grep, gitleaks and zizmor:

docker run --rm -v "$PWD:/workspace" ghcr.io/guardianvigil-labs/prufgate:1.3.0          # the fast gate on this repository

docker run --rm -v "$PWD:/workspace" ghcr.io/guardianvigil-labs/prufgate:1.3.0 prufgate check .

Or add the GitHub Action to a pull-request workflow, pinned to the commit SHA of the v1.3.0 tag (full example):

- uses: actions/checkout@<commit-sha>

with: { fetch-depth: 0, persist-credentials: false }

• run: python3 -m pip install "PyYAML>=6.0"
• uses: GuardianVigil-Labs/Prufgate@

Every release is signed and carries build provenance and an SBOM: Verify a release.

Or add it to your pre-commit configuration, .pre-commit-config.yaml (details):

repos:

• repo: https://github.com/GuardianVigil-Labs/Prufgate rev: v1.3.0 hooks:
• id: prufgate # changed files, on every commit
• id: prufgate-full # whole repository, before a push (pre-commit install --hook-type pre-push)

Then, in your project:

prufgate check .                          # engines 1-5 on the whole repository

prufgate check --changed --base origin/main # only what this branch changed prufgate init --hooks # starter config + coding-agent hooks prufgate baseline # record existing findings; only new ones are reported

Exit codes are the same everywhere: 0 clean, 1 blocking findings (P0/P1), 2 PrufGate could not run (bad config, bad base ref, unreadable file, engine crash). A crash never reads as a pass.

Ways to run it

| Tools for an agent over MCP | prufgate mcp: ten