Loading ShipGate
ShipGateThese products solve different problems. ShipGate is merge-path policy and an audit trail — not a CVE scanner. Use what fits your threat model. This table is maintained by the ShipGate team; corrections welcome.
| Feature | ShipGate | Snyk Code | SonarQube / Cloud | GitHub Advanced Security | Cursor |
|---|---|---|---|---|---|
| Positioning | |||||
| Primary purpose | Verification / attestation gate (WholeStack builds + MCP) | Vulnerability scanning (SCA + SAST) | Code quality + SAST at PR time | SAST + secret scanning + dependency review | AI coding assistant (IDE) |
| AI-code focus ShipGate is positioned around governing AI-generated code at the merge point. | Yes | — | — | — | Generates AI code (different layer) |
| CI / PR Integration | |||||
| Native GitHub Actions gate The pull-request check and ShipGate CI add-on are not shipping products today. The live ShipGate surface is MCP + WholeStack build verification. | Not built yet | Yes | Yes | Yes | — |
| Blocks merge on policy fail All CI-integrated tools require you to mark the check as required in your repo. ShipGate is deliberately different: a spec-free repository scan never reports a green check, so it is advisory and must not be made a required check. The blocking gate applies to a WholeStack build with an approved spec. | Advisory check by default | When required check enabled | When required check enabled | When required check enabled | — |
| Per-gate result on the pull request | Not built yet | Partial | Yes | Partial | — |
| Machine-readable run record The ShipGate workflow writes a readiness report as a JSON build artifact. It does not emit SARIF today. | JSON report artifact | JSON / SARIF | JSON / SARIF | SARIF | — |
| Security Analysis | |||||
| SAST (static analysis) | Focused on merge-path policy | Yes | Yes | Yes | — |
| SCA (dependency vulnerabilities) ShipGate is not a CVE scanner. Use Snyk or Dependabot alongside it for SCA. | — | Yes | Yes | Via Dependabot | — |
| Secret scanning Use GHAS or a dedicated secret scanner; ShipGate focuses on policy enforcement. | — | Partial | Partial | Yes | — |
| Merge-path policy enforcement | Yes | — | — | — | — |
| Audit & Compliance | |||||
| Verdict history bound to commits | On WholeStack builds | Yes | Yes | Yes | — |
| Signed audit-log export ShipGate exports the audit log as an NDJSON bundle with a manifest, hash chain, and HMAC signature, so the export can be re-verified rather than merely trusted. | Enterprise | Enterprise tier | Enterprise tier | GitHub Enterprise | — |
| Signed provenance / proof chain A signed certificate comes from running the exact revision through the WholeStack pipeline. A static repository scan is advisory and never issues one. | On a WholeStack build | — | — | Partial | — |
| SSO — SAML 2.0 or OIDC SAML SSO is not implemented. Security page already says so; this table must not sell it. | Not built | Enterprise tier | Enterprise tier | GitHub Enterprise | — |
| SCIM 2.0 directory sync SCIM directory sync is not implemented. | Not built | Enterprise tier | Enterprise tier | GitHub Enterprise | — |
| Deployment | |||||
| Public CLI package There is no public npm package. The shipgate binary lives in @wholestack/shipgate (private, unpublished). Local next is advisory CLEAR / BLOCKED. Merge CI is the hosted GitHub App. | — | Yes | Yes | — | — |
| Self-hosted option SonarQube Community Edition is free and self-hostable. SonarCloud is SaaS-only. | Not built | Enterprise | SonarQube on-prem | GitHub Enterprise Server | — |
| Analysis runs on your runners VPC / dedicated deployment is not a shipping product. Do not treat Enterprise contact-sales as an available VPC checkbox. | — | Partial | Partial | Yes | Processed by the model provider |
| Pricing | |||||
| Free tier No hosted free-scan quota product. Preview is free under NORTH-STAR §9; the public scan page is a labelled demo. | Preview / labelled demo — free | Yes — limited scans | Yes — SonarQube Community | No — licensed add-on | Yes — limited |
| Recurring / one-time price NORTH-STAR §9 / BILLING_CATALOG only. The former $50/mo ShipGate CI add-on is retracted — not in §9 and not implemented. | Included in every plan — Starter $49/mo · Pro $99/mo · Ultra $229/mo | See vendor pricing | See vendor pricing | See vendor pricing | See vendor pricing |
| Enterprise pricing | Contact sales | Custom | Custom | Custom (GitHub Enterprise) | See vendor pricing |
Methodology. The ShipGate column is read from this product's own source and NORTH-STAR §9, so it cannot drift into a fake CI SKU. Competitor columns are a qualitative reading of each vendor's public documentation — no price figures, because a number copied here goes stale. Corrections: team@shipgate.dev · Snyk · SonarCloud · GHAS · Cursor.
ShipGate is not a CVE scanner. Today it verifies WholeStack builds and exposes a live MCP endpoint — not a $50/mo CI add-on or SSO checklist.