TECHDEV · Flagship · Open-source tool
diffgate
The 2-second pre-merge gate for AI-assisted diffs. AI writes code faster than humans can review it: tests pass without catching bugs, complexity silently grows, and eyeball review doesn't scale. diffgate gates the diff itself in CI — this PR's new complexity, this PR's duplication, this PR's reviewability — pass or fail, with reasons. Local, deterministic, no model, no account, no network.
TypeScript · CLI · MIT · Node 20+ · Zero runtime dependencies · npm: diffgate-cli. Local and deterministic: your code never leaves the machine.
The problem it answers
AI coding assistants generate large diffs in seconds, and the review bottleneck moves from writing to reading. Tests can pass while complexity creeps up and duplication spreads, because tests check behavior, not structure. Human reviewers skim 400-line diffs and approve on vibes. diffgate answers a narrower, honest question before merge: is this diff reviewable? It checks only the changed code — pre-existing tech debt is context, never a failure — and fails the check when a touched function is too complex, gains too much complexity at once, repeats a normalized code block, or when a single file grows past reviewable size.
The four gates (all on the diff, v1)
| Gate | Default | What it checks |
|---|---|---|
complexity | max 10 | a touched function above the max complexity fails |
delta | max +15 | a touched function gaining more than this at once fails |
dupe | 50 tokens | a normalized token block repeated in the diff fails |
growth | +500 lines | a single file growing past this fails ("split this PR") |
Thresholds are configurable per flag (--max-complexity N, --max-delta N, …) or in a diffgate.json at the repo root (see diffgate.example.json). Languages in v1: JavaScript/TypeScript, Python, Go. A 500-file diff checks in ~0.7s on a laptop.
Four commands
| Command | What it does |
|---|---|
diffgate check | Gates the current diff. Base auto-detected: merge-base with main, else HEAD~1. Exits 0 on pass, 1 on fail. |
diffgate check --base origin/main --format github | Gates against an explicit base and emits GitHub Actions annotations. |
diffgate measure | Numbers only, no verdict — the "measure first" mode. |
diffgate check --json diffgate-report.json | Saves a JSON manifest for tooling. |
Commands copied exactly from the diffgate README (2026-10-31 release). Output formats: human (default table), json (manifest with result: pass|fail), github (::error file=…,line=…:: annotations). Drop it straight into CI:
# Requires Node 20+, zero runtime dependencies
npm install -g diffgate-cli
diffgate check
# or run without installing
npx -y diffgate-cli check --base ${{ github.event.pull_request.base.sha }} --format githubMethod — stated honestly
Complexity is a token-based cyclomatic approximation: it counts branch keywords and operators (if, for, while, &&, ||, ??, ternaries, elif, except, …) per function. Same class as lizard: fast and deterministic, not compiler-grade. Duplication detection normalizes identifiers to id and literals to str/num, then finds repeated token windows with a rolling hash — so copy-paste with renamed variables still matches.
What this is NOT — and where rivals beat us
- It does not prove correctness. Structural gates don't prove semantics.
- It does not detect AI-generated code and makes no authorship claims. There is no snake-oil "AI detector" inside.
- Complexity numbers are heuristic-class, not universal truths. Thresholds are team-tunable via flags or
diffgate.json. - It gates the diff, not the repo. Pre-existing tech debt is context, never a failure.
- Honest comparison (checked 2026-10-31): unclebob/ub-mode wins on process depth — it guides the whole agent workflow, while diffgate is a 2-second CI check (complementary, not competing). SonarQube / SonarCloud wins on history: trend dashboards, leak-period tracking, 30+ languages; diffgate sees one diff, three languages, no server. lizard wins on language breadth (20+ languages) and editor integrations; it reports numbers, diffgate adds verdicts, PR gating, and annotations. Semgrep wins on custom rules; diffgate ships fixed gates with sane defaults — no rule authoring, no rule maintenance.
Source + README on GitHub → · Report an issue → · ask@techdev.fun
Roadmap
- New-lines-without-coverage when an lcov/cobertura file is supplied
- Mutation-lite on changed lines
- More languages (Java, C#, Rust)
Development: npm install, npm run build (tsc, strict), npm test — 38 tests, all green at release. examples/sample-diff/ is a synthetic base/pr/fixed repo exercising every gate: run examples/sample-diff/run.sh to see the red-to-green flow.
License
MIT. See LICENSE in the repository.
Related tools
More open-source tools from TECHDEV: sessguard, runverdict, gheist-guard, vetgate, context-diet, ci-failure-detective, agent-seatbelt, devsecops-os, env-doctor, skill-audit, logtrim, testguard, breakcheck, keymap, memgraph, ggufit, leaseguard, factfence, jsonfold
Have a say
Vote for this tool, suggest a feature, or discuss it with other operators on the community board.