Tools

ShipGate runs tools through catalog metadata — each entry describes how to install, invoke, and normalize one check id. For how YAML becomes argv and reports, see Check flow.

List the catalog

shipgate list tools
shipgate list tools --tag security
shipgate list checks    # alias

Bundled tools

Tool	Purpose
Bandit	Security issue scanner for Python
codespell	Common misspellings in text and code
deadcode	Unused Python code via static analysis
deptry	Missing / unused / misplaced declared dependencies
Gitleaks	Secret scanning for git repositories
Hadolint	Dockerfile linter
import-linter	Layer and forbidden-import contracts
JSCPD	Copy/paste / duplication detector
markdownlint	Markdown style linter
mdformat	Markdown formatter
pip-audit	Dependency CVE / vulnerability audit
pydeps	Python dependency graphs
Policy gates	Bundled in-process / project-local policy checks
Radon	Cyclomatic complexity and maintainability metrics
Ruff	Fast Python linter and formatter
Semgrep	Pattern-based security and quality analysis
ShellCheck	Static analysis for shell scripts
shfmt	Shell script formatter
ty	Astral static type checker for Python
Vulture	Dead Python code with high confidence
yamlfmt	YAML formatter
yamllint	YAML syntax and style linter

Run one tool without changing project policy:

shipgate check --check ruff.lint --target src
shipgate check --check gitleaks.scan --target .

Project extensions

When the bundled catalog is not enough:

• Catalog overlays — add or override tool YAML under .shipgate/catalog/tools/ (use extends: to patch a bundled entry).
• Suites — define named checklists in .shipgate/catalog/suites.yaml.
• Policy gates — scaffold scripts under .shipgate/gates/ and register them in the project catalog.

Tool configs live under .shipgate/configs/. Project-specific allowlists go in .shipgate/allowlists/. See Usage — project-local gates and Contributing for maintainer-oriented detail.