AgentIndex icon
AgentIndex
agents-shipgate logo
agents-shipgate
★ 90
vs
tcpk logo
tcpk
★ 23

agents-shipgate vs tcpk

agents-shipgate: Agents Shipgate is an open-source CLI and GitHub Action that serves as a deterministic merge gate for AI-generated agent capability changes. It performs local-first, static Tool-Use Readiness review, scanning various agent artifacts to ensure explicit approval policies, scope coverage, and idempotency evidence before merging.; tcpk: TCPK is a portable Windows thick-client and MSIX security audit tool designed to find, verify, and report vulnerabilities in desktop applications. It offers static and dynamic analysis, a PowerShell engine, a WinForms GUI, and an optional agentic AI workbench for local triage.

01

TL;DR

agents-shipgate logo
agents-shipgateSecurity & Safety · ★ 90

Reviewing and validating new or changed agent tool definitions before merging pull requests.

Read agents-shipgate full review →
tcpk logo
tcpkSecurity & Safety · ★ 23

Security auditing of Windows desktop applications: For identifying vulnerabilities in thick clients, MSIX packages, .NET, Electron, and native executables.

Read tcpk full review →
02

Side-by-Side Comparison

Field
agents-shipgate logoagents-shipgate
tcpk logotcpk
Category
Security & Safety
Security & Safety
Stars
★ 90
★ 23
License
Apache-2.0
MIT
Install Command
pipx install agents-shipgate
git clone https://github.com/V33RU/tcpk.git && cd tcpk && .\TCPK.bat
Updated
5d ago
2d ago
Open Source
Yes
Yes
Website
↗ Visit
↗ Visit
GitHub
↗ GitHub
↗ GitHub
Tags
AI Agents, Tool-Use Readiness, Static Analysis
Thick Client Pentesting, MSIX Security, PowerShell
03

Features

agents-shipgate logoagents-shipgate
01Acts as a deterministic merge gate for AI-generated agent capability changes.
02Performs local-first, static analysis without agent execution or LLM calls.
03Scans and validates tool definitions from various sources (MCP, OpenAPI, OpenAI SDK, LangChain, CrewAI, etc.).
04Generates comprehensive Tool-Use Readiness Reports and PR comments with merge verdicts.
05Supports CI/CD integration as a GitHub Action for automated review.
tcpk logotcpk
01Evidence-based verification: Proves high-value findings with IL decompilation and taint checking, moving beyond simple regex hits.
02Real CVSS v4.0 scoring: Scores each finding with a faithful port of the FIRST.org algorithm, providing accurate context-specific CVSS scores.
03Supply-chain CVE detection: Matches shipped components against live OSV and NVD-by-CPE, embedding version-accurate vulnerabilities in a CycloneDX SBOM.
04Local-first AI triage (optional): Pipes findings through a local Ollama model for AI review, keeping decompiled IL within the local environment by default.
05Engagement-ready reports: Generates comprehensive reports in HTML, multi-sheet Excel, JSON, SARIF, CycloneDX SBOM, and `intel.html` dashboard formats.
04

Use Cases

agents-shipgate logoagents-shipgate
↳Reviewing and validating new or changed agent tool definitions before merging pull requests.
↳Enforcing approval policies, scope coverage, and idempotency for agent actions in CI/CD pipelines.
↳Providing static evidence for security and GRC reviewers without executing agent code.
↳Blocking risky capabilities, such as financial transactions, if explicit safeguards are not declared.
↳Integrating with coding agents (e.g., Claude Code, Codex, Cursor) to automate self-correction during development.
tcpk logotcpk
↳Security auditing of Windows desktop applications: For identifying vulnerabilities in thick clients, MSIX packages, .NET, Electron, and native executables.
↳Compliance and vulnerability management: Generating comprehensive reports with CVSS v4.0 scores, CWE, MITRE ATT&CK, OWASP TASVS mappings, and SBOMs for regulatory compliance.
↳Threat intelligence gathering: Utilizing the `intel.html` dashboard and detailed findings to understand application security posture.
↳Automated static and dynamic analysis in pentesting workflows: Quickly performing initial assessments of thick client applications.
FAQ

FAQ

What is the difference between agents-shipgate and tcpk?
Both agents-shipgate and tcpk are in the Security & Safety category. agents-shipgate has 90 stars, while tcpk has 23 stars.
Which is better, agents-shipgate or tcpk?
The best choice depends on your use case. Choose agents-shipgate if Reviewing and validating new or changed agent tool definitions before merging pull requests., and tcpk if Security auditing of Windows desktop applications: For identifying vulnerabilities in thick clients, MSIX packages, .NET, Electron, and native executables..
Is agents-shipgate free or open source?
Yes, agents-shipgate is open source on GitHub (Apache-2.0).
Is tcpk free or open source?
Yes, tcpk is open source on GitHub (MIT).
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit
→

Related

Alternatives to agents-shipgate →Alternatives to tcpk →agents-shipgate details →tcpk details →