GatekeeperAI

GatekeeperAI is an on-premises platform designed to empower enterprise teams to safely integrate both third-party and internal AI applications. This comprehensive solution ensures that every application undergoes rigorous automated security scanning, human oversight, and sandboxed deployment before it is accessible to users.

How It Works

1. Submit — Developers push their application code to the GatekeeperAI Git server.
2. Scan — The platform automatically executes a suite of five distinct scanners, which include secrets detection, dependency vulnerability audits, egress network analysis, PII exposure checks, and an LLM-powered code review via Claude AI.
3. Review — A designated approver evaluates the scan results, making decisions to approve or reject the app while having SLAs tracked automatically.
4. Deploy — Once approved, applications are packaged into secure Docker containers and launched within an isolated environment, accessible through a public URL.
5. Manage — Runtime secrets such as API keys and credentials are securely injected as environment variables during deployment, ensuring they are never stored in the codebase.

Key Features

• Automated multi-scanner pipeline — Conducts simultaneous analysis for secrets, vulnerability reports, egress rules, PII, and LLM code review with every push.
• Risk tiering — Automatically assesses and assigns risk tiers (low/medium/high/critical) to applications, influencing review prioritization.
• SLA enforcement — Flags overdue approvals and notifies escalators via email to maintain productivity.
• Encrypted secret injection — Utilizes AES-256 encryption for per-app secrets, injected securely at container startup.
• Audit log — Maintains a complete record of all actions (approvals, deployments, secret changes) along with the corresponding actor, IP address, and timestamp.
• Admin panel — Facilitates user management (create, disable, change roles), audit log viewing, and platform-wide metrics monitoring.
• Setup wizard — Streamlined configuration for first-time users, requiring no manual edits to configuration files.
• Secure by default — Implements JWT with refresh token rotation, limits rates on all endpoints, and includes robust security headers (CSP, HSTS, etc.) alongside non-root containers.

Tech Stack

Project Structure

backend/        FastAPI application, scanners, Celery workers, Alembic migrations
frontend/       Next.js web application
infra/          Docker Compose configuration
worker/         Celery task definitions (deploy, SLA checks)

User Roles

New users are created by administrators; there is no public self-registration available.