CodeGate
CodeGate was a free, open-source security gateway that ran locally between AI coding assistants and large language models, redacting secrets and personal data from prompts and flagging risky dependencies. The project is no longer maintained.
What is CodeGate?
CodeGate was a local security gateway for AI-assisted development, built by Stacklok and published under the Apache-2.0 licence. It sat between a coding assistant and the language model behind it — the project called itself a guardian angel that sits between your AI assistants and LLMs — inspecting every prompt on the way out and every completion on the way back, without that traffic leaving the developer's machine.
It shipped as a single container image, ghcr.io/stacklok/codegate:latest, running on Docker Desktop, Docker Engine or Podman across Windows, macOS and Linux, on x86_64 and arm64. Three ports were exposed: 8989 for the proxy, 8990 for a second provider endpoint, and 9090 for a local web dashboard listing detected security risks and the history of assistant-model interactions.
Six capabilities were documented. Secret redaction stripped credentials out of prompts before transmission. PII detection redacted personal data such as card and social security numbers, then restored the original values in the response returned to the client. Dependency risk awareness analysed direct, transitive and development dependencies found in manifests, install scripts and imports, on the premise that a model's training cut-off makes it recommend packages that are deprecated, dangerous or simply do not exist. Security reviews flagged unsafe patterns in generated code. Model muxing routed prompts to different models by workspace or file type, as a cost and latency lever. Workspaces isolated models, configuration, prompts and history per project.
Supported assistants were GitHub Copilot in VS Code (JetBrains was announced as coming soon and never shipped), Cline, Continue, Aider and Open Interpreter. Model providers included Ollama, LM Studio, llama.cpp and vLLM locally, plus Anthropic, OpenAI and compatible APIs. The privacy claim was explicit: everything stays local, no external data collection, no calling home or telemetry. The site summed the design up as Local, Open and Quiet — largely invisible, speaking only for a leaked secret or a security risk.
The project gathered some 790 GitHub stars from a repository created in November 2024, and it is now closed: the README states that CodeGate was an experimental project and is no longer maintained, the repository is archived, the last commit dates from June 2025, and codegate.ai redirects to stacklok.com, which no longer mentions the product.
What it does
- Detect and mask secrets in a prompt before it is sent to a language model
- Detect and redact personal data such as card numbers and social security numbers, then restore it in the reply
- Warn about deprecated, vulnerable or non-existent packages suggested by a model
- Produce security-oriented code reviews that surface unsafe patterns and potential vulnerabilities
- Route prompts to different models according to the workspace or the type of file
- Centralise the credentials and API keys of several model providers in one place
- Show detected risks and the full assistant-to-model exchange history in a local dashboard
When to use CodeGate / When not to
A quick filter to help you decide if CodeGate is the right fit.
When to use CodeGate
- Developers using AI coding assistants such as GitHub Copilot, Cline, Continue, Aider or Open Interpreter who wanted a single checkpoint in front of the model
- Application security teams trying to stop API keys, tokens and other secrets from reaching third-party LLM providers
- Platform and DevOps engineers centralising model-provider credentials instead of scattering them across individual workstations
- Developers working with several models at once who wanted prompts routed by task through the muxing layer
- Engineers studying prior art in local prompt gateways, who can still read or fork the archived Apache-2.0 codebase rather than deploy it
When not to use CodeGate
- Teams that need a supported, maintained tool: development stopped, the repository is archived and the last commit dates from 5 June 2025
- Organisations requiring an SLA, contractual support or security certifications — no SOC 2 or ISO 27001 attestation was ever published
- Environments where Docker or Podman is unavailable: a container image was the only distribution channel
- Non-developers: there was no consumer-facing interface, and every assistant and model provider had to be wired up by hand
- Enterprises looking for a managed SaaS or for MCP and agent governance: no hosted edition existed, and Stacklok has since moved to ToolHive and its MCP platform
How to use CodeGate
A typical end-to-end flow, from setup to results.
- Install a container engine: Docker Desktop, Docker Engine or Podman
- Start the gateway with the single documented command: docker run --name codegate -d -p 8989:8989 -p 9090:9090 -p 8990:8990 --mount type=volume,src=codegate_volume,dst=/app/codegate_volume --restart unless-stopped ghcr.io/stacklok/codegate:latest
- Reconfigure your coding assistant to point at CodeGate instead of the model provider
- Enter the credentials and API keys of your model providers in CodeGate
- Open the local dashboard at http://localhost:9090
- Create one workspace per project, each with its own models and prompts
- Configure the muxer to route requests according to the task or the type of file
- Watch the dashboard for secret-leak alerts and dependency-risk warnings
- Expect to work from the archive: the original documentation site is offline, and only the README and the docs/ directory of the GitHub repository remain
Pros & Cons
Pros
- Fully local execution: code and secrets never left the machine
- Open source under Apache-2.0, so the code can be audited and forked
- Installed with a single Docker command
- One checkpoint covering several assistants and several model providers at once
- Muxing let each task run on the model that suited it, a lever on both cost and speed
- Free, with no paid tier and no account to create
- Addressed a genuine blind spot: hallucinated or vulnerable dependencies suggested by models
Cons
- Discontinued and unmaintained: no security fix will be issued again
- The GitHub repository is archived and read-only, with a last commit on 5 June 2025
- Website and documentation are gone: codegate.ai and docs.codegate.ai both redirect to stacklok.com
- No privacy policy is reachable any more — the published one returns 404
- Docker or Podman was mandatory; there was no native installer
- Narrow assistant coverage: Copilot only inside VS Code, and the announced JetBrains support never shipped
- No support, no SLA and no published security certification
Pricing & Plans
CodeGate was supplied free of charge as an open-source project under the Apache-2.0 licence. There was no paid plan, no subscription, no account requirement and no time-limited trial, and no pricing page ever existed on codegate.ai. The only expense borne by the user was their own local infrastructure: a workstation and a container engine. For wider deployment inside an organisation, the archived site invited readers to write to hello@stacklok.com, without publishing any price.
- the ghcr.io/stacklok/codegate:latest container image under the Apache-2.0 licence
- there was no Free
- Pro or Enterprise structure
Data, GDPR & hosting
A consolidated view of how CodeGate handles your data.
GDPR overview
No GDPR reference exists anywhere in the material collected: not on the nine pages retrieved from codegate.ai and stacklok.com, not in the Platform Terms, not in the Security Center. A sweep of the full stacklok.com sitemap (236 URLs) found no privacy, cookie or DPA page at all, and CodeGate's own privacy policy, hosted at iubenda under reference 87196790, now returns 404. No Article 27 EU representative is designated, no data protection officer is named, and no privacy or DPO mailbox is published. CCPA, standard contractual clauses and Privacy Shield are equally absent. The only argument available is indirect and technical: CodeGate ran entirely on the developer's machine, so no personal data reached the vendor. For its current platform, Stacklok's Security Center states that it does not host, process, transmit, or store customer data by design.
Who owns the data?
For CodeGate itself the question barely arose: the container ran on the developer's own machine, and the README states that your code never leaves your machine, with no external data collection and no telemetry. Prompts and history were persisted in a local Docker volume, codegate_volume, under the user's sole control. The Platform Terms published on stacklok.com govern Stacklok's current commercial MCP platform, not CodeGate: there the customer retains ownership of Customer Data, Stacklok takes a limited licence to it and does not host it, but Stacklok owns all Usage Data transmitted from the customer's environment, and feedback becomes Stacklok's exclusive property. CodeGate's own privacy policy is no longer reachable.
Reuse rights
CodeGate was released under the Apache-2.0 licence, so its code may be used, modified and redistributed without asking permission, provided the licence and attribution notices are kept. The GitHub repository is archived and therefore read-only, but it can still be cloned and forked. Everything the tool produced — prompts, conversation history, detected risks — stayed in the user's local Docker volume, and nothing restricted the reuse of those outputs. The restrictions that do exist belong to a different document: Stacklok's current Platform Terms reserve all rights not expressly granted, create no implicit licence, exclude trademarks, and forbid customers from giving Stacklok access to regulated data — health information under HIPAA, payment card data under PCI, or other sensitive personal information — without express agreement.
Data retention & training
Hosting summary
CodeGate involved no vendor-side hosting. The container ran on the user's own machine and data was persisted in a local Docker volume named codegate_volume. The README states that everything stays local, with no external data collection and no calling home or telemetry, so no hosting country or region can be declared: there was no hosted service to locate. One technical detail should not be misread. The codegate.ai domain resolves to 143.204.55.65, geolocated in Zurich, Switzerland, on AS16509 (Amazon); that is a CloudFront CDN edge node serving the redirect to stacklok.com, not a place where data is stored. For Stacklok's current MCP platform, which is a different product, the Security Center describes a customer-deployed model and states that all data location, residency, encryption, retention, deletion, and access controls are governed by the customer's own infrastructure and security policies. That same page lists the subprocessors Stacklok uses for its own operations: Google Workspace, Slack, GitHub, Grafana, AWS, DevRev, HubSpot and Read AI.
Things to keep in mind
Risks and trade-offs to weigh before adopting CodeGate.
- Unmaintained software: any vulnerability found after June 2025 will never be patched
- False sense of security: imperfect secret redaction can leak the very data the user believes is protected
- Single point of passage: all assistant-to-model traffic went through one container, so its failure or compromise affected everything at once
- The API keys of several model providers ended up concentrated in a single local volume
- No privacy policy is reachable, so the original data commitments cannot be verified by anyone
- Outsourced judgement: an AI security review is a prompt for attention, not a substitute for human review
- Name confusion: several unrelated products are called CodeGate, which makes searching for reliable information error-prone
Setup & Integrations
Technical difficulty
Moderate, and strictly for developers. The nominal install was a single docker run command, but it assumed a container engine already in place and some familiarity with ports and volumes. The real work came next: reconfiguring each coding assistant to route through CodeGate rather than its provider, then entering the provider credentials. There was no consumer-grade installer or setup wizard. The task is harder today than it was in 2025, because the official documentation at docs.codegate.ai is offline; only the README and the docs/ directory of the archived repository remain.
Deployment
Integrations
Supported languages
Behind CodeGate
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Is CodeGate still maintained?
What happened to codegate.ai?
Who built CodeGate?
How much did it cost?
Did my code leave my machine?
How was it installed?
Which coding assistants were supported?
Which model providers did it work with?
What did it actually do?
Does Stacklok offer a replacement?
Should you pick CodeGate?
CodeGate's premise was sound and still uncommon: keep secrets and personal data out of the prompts that coding assistants send to language models, and do it locally, where the developer can see it. The execution was careful for so young a project — one install command, a dashboard, model muxing, per-project workspaces, and a dependency check aimed at a real weakness of code-generating models. Some 790 GitHub stars and community contributions under an Apache-2.0 licence suggest the idea landed.
The verdict for a reader today is nevertheless simple: do not adopt CodeGate. The project is discontinued. Its README calls it an experimental project that is no longer maintained, the repository is archived, the last commit dates from June 2025, and codegate.ai redirects to a site that no longer mentions the product. Its life was short: repository created in November 2024, first website snapshot in December 2024, development stopped seven months later.
Two further signals argue for caution. The product's privacy policy has been withdrawn and returns 404, so its original commitments can no longer be verified, and no GDPR statement of any kind appears in the vendor's published material. Stacklok names no functional successor either: the company has moved to ToolHive and an enterprise MCP platform, which address a different problem.
What remains has a different kind of value: a readable, permissively licensed reference implementation of a local prompt gateway. Teams facing the same problem can study it, borrow from it or fork it, and should expect to maintain whatever they take. As a tool to install in front of a live assistant, it should be treated as closed.
- Choosing a selection results in a full page refresh.
- Opens in a new window.