Gatekeeper AI

Security problems slip through pull request review because reviewers are busy and static analysis tools are noisy. Teams that run Semgrep or SonarQube on every PR quickly learn to ignore the flood of warnings, including the real ones.

Gatekeeper AI set out to act like an automated senior security reviewer in the pipeline: look only at what changed, combine scanners with an LLM that understands context, drop the false positives, and stop a risky merge before it reaches production, without slowing down everything else.

The core engine and CLI are Python 3.12 with Typer, Pydantic v2, Rich, GitPython and httpx, managed with uv. It runs as a GitHub Action (with SARIF 2.1.0 upload) or a Bitbucket Pipelines pipe (with Code Insights reports). For each pull request it extracts the changed hunks, and every scanner's results are filtered to those lines so untouched legacy code is not re-reported.

Semgrep, Bandit, Gitleaks and the SonarQube API run alongside two Claude 3.5 Sonnet passes, one for security and one for code quality, using tool calling and structured JSON output. Scanner alerts are then sent to Claude with the surrounding code for false-positive triage. Before any code leaves the pipeline, a high-entropy redactor strips secrets, and SHA-256 content-addressed caching skips chunks that were already reviewed.

The gate computes a verdict of PASS, FAIL, ERROR or SKIPPED against policy thresholds, posts a summary and inline comments with suggested fixes, and sends alerts to Slack, Microsoft Teams Adaptive Cards and email. Baselines (.gatekeeper/baseline.json) and inline ignore markers accommodate known debt. Runs are published to a Nuxt 4 dashboard on Neon PostgreSQL with Drizzle that shows pass rates, LLM spend, risk categories and a PR audit drawer. A deterministic mock LLM lets tests and offline CI run without API tokens.