arkgateBLOCK
If the AI writes an illegal import, the write is rejected. The same check fails the pull request.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.
[](https://www.arkgate.online/) [](https://github.com/pedroknigge/arkgate/actions/workflows/ci.yml) [](https://www.npmjs.com/package/arkgate) [](LICENSE)
ArkGate is import rules for AI-written TypeScript. Contener · Guiar · Ordenar: contain what the AI may write, and in what shape. Guide the next step. Order leftover mess toward a clean tree, a little at a time.
Why
AI takes the shortest path. One bad import lands, then another, and the product gets harder to change. A linter that runs only after the agent finishes sees the mess too late.
Design the boundary before you implement. Put a small interface in front of the work and keep the detail behind it. When leftover mess remains, the honest light is needs a refactor. Weakening the rules to paint the check green leaves that design unfinished.
Try it
One command. Preview only — no files change. Current release is 4.8.25 (check npm latest with npm view arkgate version):
npx [email protected] start
What a red result looks like
After a rules file exists, a domain file that imports infrastructure fails the check (exit 1). This is real output from arkgate-check on [email protected]:
✖ LAYER_IMPORT_VIOLATION src/domain/order.ts:1 DomainModel → Infrastructure (src/infra/db.ts) DomainModel must not import Infras
7eaaed6488ecOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add arkgate -- npx -y [email protected] mcp .
Exposed tools (22)
18 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
App | read | App shell, routing, providers, composition root. |
ApplicationOrchestration | read | Use cases that coordinate the domain through ports. No I/O of its own. |
DomainModel | read | Pure business rules and entities. No I/O, no framework, no ambient globals. |
Features | write | Feature / use-case slices (co-located API, UI, hooks, types). No import across sibling slices. |
Lib | read | Infrastructure clients (db, HTTP, env) shared across features. |
PersistenceAdapters | read | Implements ports with real infrastructure: DB, external APIs, filesystem. |
PresentationAdapters | read | Entrypoints — HTTP routes, controllers, UI. Drives use cases. |
Shared | read | Reusable UI primitives, utils, and types with no feature knowledge. |
SharedKernel | read | Truly shared kernel types and primitives across contexts. |
ark_check | write | Scan the project for architecture findings (layer-import violations, forbidden globals, |
ark_coverage | read | Report what each layer actually governs: per-layer file counts, the FULL list of |
ark_identity | read | First call. Prove this MCP process is the right project: pass project.expectedRoot |
ark_manifest | read | Return the machine-readable architecture contract with an authoritative project |
ark_place | read | Place a file in the architecture: filePath is required (fail-closed without it — never invents components/*.tsx or defaults to Presentation). |
ark_policy_delta | read | Classify a complete ark.config.json transition as strengthening, neutral, |
ark_prepare_change | destructive | Validate one complete governed-source create/update/delete batch as an atomic in-memory candidate. |
ark_prepare_write | write | Prepare a write against the architecture contract: place (filePath required; fail-closed without it — never invents a path) + |
ark_recommend | read | Score this repository against templates/architecture-playbook.json and return the |
ark_rules_inventory | read | Deterministic brownfield rules inventory (AR13): validation-in-controller, magic constants, |
ark_status | read | Unified session/project status manifest (ACS03): project identity binding, honest write-path |
ark_suggest_include | read | Propose ark.config.json include roots from workspaces and nested TypeScript packages |
validate_code | read | Single-file lexical check of a source snippet against Ark |
Trust audit
BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (12 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
mcp-hook-payload.mjs
/id_rsa/i,
.agents/skills/ark-adopt
.agents/skills/ark-architect
.agents/skills/ark-autopilot
.agents/skills/ark-contract
.agents/skills/ark-coverage
export const DASHBOARD_DEFAULT_URL = 'http://127.0.0.1:3000/snapshot';
HTTP_PROXY: 'http://127.0.0.1:9',
HTTPS_PROXY: 'http://127.0.0.1:9',
const text = input.replace(/^/, '');
token: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
token: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
token: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
token: '12345678-1234-4123-8123-123456789abc',
ark_prepare_change
.jscpd.json
.ark-baseline.json
name: Eval (nightly)
- name: Comparative eval (static oracle)
- name: Placement A/B eval (ACS07 dry)
- name: Live agent eval (optional — needs claude on PATH)
const hash = crypto.createHash('sha1').update(abs).digest('hex').slice(0, 8);.createHash('sha1')return createHash('sha1').update(buf).digest('hex');Gates applied: no_behavioural_pass.
7eaaed6488ecfull audit observations/trust-audit/mcp-server/pedroknigge__arkgate.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 7eaaed6488ec | BLOCK | F | 45 | first audit |
Questions
What is the arkgate MCP server?
If the AI writes an illegal import, the write is rejected. The same check fails the pull request.
What tools does arkgate expose?
22 in total: 18 read-only, 3 that write, and 1 that can delete or overwrite (ark_prepare_change). Every one is listed on this page with its risk.
Is arkgate safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does arkgate need?
It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does arkgate run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @z03/kernel at 4.8.25.
How current is this page?
The grade is for one exact copy of the source (7eaaed6488ec), read on 2026-10-12. The repository is watched and re-audited when it changes.