{
  "markdown": "# @sunaiva/gate\n\n**Stop documenting rules your agents ignore. Start enforcing them.**\n\n`@sunaiva/gate` is an MCP server that intercepts AI agent actions before they\nexecute and blocks the ones that violate your rules. It runs locally, in\nprocess, with zero external dependencies on the Free tier — the rules are baked\ninto the package and enforced by a deterministic engine.\n\n```bash\nnpx @sunaiva/gate\n```\n\n> **Status**: `2.0.5` \"THUNDERSTRIKE P0-A + version coherence\" — see [`CHANGELOG.md`](./CHANGELOG.md) for full history.\n\n---\n\n## 60-second quickstart\n\n```bash\n# 1. Install (no signup, no API key, no DNS records)\nnpx @sunaiva/gate\n\n# 2. Verify it loaded\nnpx @sunaiva/gate --smoke-test\n# → ✓ Gate loaded — 104 rules\n# → ✓ Constitutional rules — 35 local (27 constitutional + 8 recommended-default)\n# → ✓ Premium rules — 69 (require backend service)\n# → Status: HEALTHY\n# → Version: 2.0.5\n\n# 3. Add to your MCP client (Claude Code, Cursor, Windsurf, Cline)\n#    settings — see \"MCP configuration\" below.\n```\n\nThat is the entire onboarding. The 35 local rules are active on first\nboot; no other configuration is required.\n\n---\n\n## What's free, forever\n\nThe 2.0.5 Free tier (BUSL-1.1) ships with everything below baked into the npm\npackage. No backend, no telemetry, no API key required. (Keyed installs emit one\nanonymous version ping on first use — opt out via `SUNAIVA_GATE_TELEMETRY=0`.)\n\n- **35 local rules (27 constitutional + 8 recommended-default) enforced locally** across five categories —\n  financial-safety, data-protection, action-governance, security, and\n  communication-safety. Detection patterns ship intact inside the package at\n  `dist/rules/rules.json`.\n- **Severity ladder**: `block` / `warn-then-block` / `warn`.\n- **Approval-token workflow** — drop a JSON token at\n  `data/deploy_queue/APPROVAL_TOKENS/<artifact>.json` and the gate honours it\n  once, within a 1-hour TTL. This is the free-tier escape valve for one-shot\n  manual unblocks.\n- **Local audit log** at `~/.sunaiva/audit/audit.jsonl` (lifetime, no rotation\n  cap). Every entry records `tier`, `audit_status`, `evidence`, and\n  `event_type` for queryable history.\n- **Kill-switch** — `DISABLE_SUNAIVA_GATE=1` short-circuits every\n  `validate_action` to `allowed: true` with unconditional stderr disclosure.\n- **Dry-run mode** — `SUNAIVA_GATE_DRY_RUN=1` evaluates rules normally and\n  records `would_have_blocked: [...]` without ever blocking.\n- **Constitutional immutability** — the 35 local rules cannot be disabled via\n  `update_rules` and cannot be bypassed via `log_bypass`, even if\n  `~/.sunaiva/gate-config.json` is hand-edited (the loader re-merges on every\n  read).\n- **Fail-CLOSED by default** — uncaught exceptions exit 3, malformed input\n  exits 4. Both write a structured audit entry. Opt-in legacy fail-open via\n  `SUNAIVA_GATE_FAIL_OPEN_ON_ERROR=1`.\n- **MCP integration** — Claude Code, Cursor, Copilot, Windsurf, Cline via the\n  standard `mcpServers` config.\n\nThe Free tier is BUSL-1.1 licensed and converts to **Apache-2.0** on\n**2030-07-19**. You can fork it, modify it, embed it in internal CI, and ship\nit in non-production workflows today — no contract, no signup, no credit card.\n\n---\n\n## Pricing\n\n| Plan       | Price                | Rules              | Agents      | Seats             | Webhook | Support              |\n|------------|-----------------------|-------------------|------------|-------------------|---------|----------------------|\n| Open       | $0/mo                 | 35 local rules     | —           | 1                 | —       | Community            |\n| Dev        | $0/mo (account)       | 35 local rules     | —           | 1                 | —       | Email (2 business days) |\n| Pro        | $49/mo ($490/yr)      | 104 rules (69 hosted) | 5        | 1                 | ✓       | Email support (48h SLA)  |\n| Team       | $199/mo ($1,990/yr)   | 104 rules (69 hosted) | Larger team | 5 incl. (need more? contact us) | ✓       | Priority support (24h SLA) |\n| Enterprise | from $999/mo (custom) | Custom rule sets   | Unlimited   | Unlimited         | ✓ + SSO | Dedicated + MSA SLA  |\n\nSee [sunaivacore.io/pricing](https://sunaivacore.io/pricing) for the live price.\n\n> **Team seat ceiling:** 5 seats is what you are billed for today — that is the live\n> Stripe SKU. The backend's org fleet-management enforcement ceiling\n> (`SEAT_LIMIT` in `routes/fleet.ts`) is currently set to 10, a known\n> billing/backend mismatch tracked internally as a P1 cross-lane defect. Do\n> not read \"10\" anywhere as a sold entitlement — seats beyond 5 require\n> contacting support until the mismatch is resolved.\n\nAll paid plans include: offline-capable on-device enforcement, model routing (bring your own\ninference provider API key — BYOK only in v1, see Known limitations below), fail-safe\n(fail-closed) enforcement, multi-target policy compilation (Pro+), and `@sunaiva/gate` npm\npackage (BUSL-1.1).\n\n**Open (no account):** `npm i @sunaiva/gate` — 35 local rules, no network call required, zero\ntelemetry. One immutable policy constitution, compiled to Claude Code, MCP clients, and future\nagent platforms.\n\n**Dev (free account)** (get a free API key: `POST https://mcp.sunaivacore.io/v1/signup` with `{\"email\":\"you@example.com\"}` — returns an `sgk_dev_` key instantly, no credit card required; dashboard at [dashboard.sunaivacore.io](https://dashboard.sunaivacore.io)):\nyour own live dashboard showing enforcement activity, blocked actions, and rule coverage — your\nvalue made visible. Premium rules and features are shown visible-but-locked until you upgrade.\n\nCurrent pricing at **https://sunaivacore.io/pricing** (canonical source of truth).\nManage your account and audit dashboard at **https://dashboard.sunaivacore.io**.\n\nFull tier matrix: [`TIER_DEFINITIONS.md`](./TIER_DEFINITIONS.md).\n\n---\n\n> **Need adversarial multi-gate output verification with cryptographic proof anchors?**\n> → [Sunaiva Validation](https://sunaiva.ai) — a separate product for verifying AI outputs,\n> documents, and claims. Enterprise pricing, sales-led.\n\n---\n\n## Architecture\n\n```\n┌────────────────────────────────────────────────────────────────┐\n│  Your project (Claude Code / Cursor / Windsurf / Cline)        │\n│                                                                │\n│   ┌──────────────────────────────────────────────────────┐    │\n│   │  MCP client invokes a tool                            │    │\n│   │     e.g. Bash(\"git push origin main\")                 │    │\n│   └────────────────────────┬─────────────────────────────┘    │\n└────────────────────────────┼───────────────────────────────────┘\n                             ▼\n┌────────────────────────────────────────────────────────────────┐\n│  @sunaiva/gate  (MCP server, stdio transport)                  │\n│                                                                │\n│   ┌──────────────────────────────────────────────────────┐    │\n│   │  validate_action                                      │    │\n│   │     │                                                  │    │\n│   │     ├─►  Local rules (35) — pattern matched  │    │\n│   │     │     LOCALLY against dist/rules/rules.json       │    │\n│   │     │     ─────────────────────────────► block/warn   │    │\n│   │     │                                                  │    │\n│   │     └─►  Premium rules (69) — only if backend set      │    │\n│   │            POST https://mcp.sunaivacore.io/v1/gatehooks   │    │\n│   │            (JWT auth via SUNAIVA_GATE_API_KEY)          │    │\n│   │            ─────────────────────────────► block/warn   │    │\n│   │            (fail-OPEN per-rule on backend error)       │    │\n│   └──────────────────────────────────────────────────────┘    │\n│                                                                │\n│   audit log ─►  ~/.sunaiva/audit/audit.jsonl                  │\n└────────────────────────────────────────────────────────────────┘\n```\n\nThe Free tier path (constitutional rules) has zero network dependencies. The\nPro path is opt-in — set `SUNAIVA_GATE_BACKEND_URL` and the engine starts\nPOSTing actions to the backend for the premium-rule subset; without it, those\nrules are skipped (recorded as `skipped_premium` in the audit, surfaced once\nper session as a stderr notice).\n\n---\n\n## Installation\n\nWire `@sunaiva/gate` into every AI agent environment detected on this machine with a single command:\n\n```sh\nnpx @sunaiva/gate install\n```\n\nOr using the long form:\n\n```sh\nnpx @sunaiva/gate --install\n```\n\n### What it does\n\n`install` scans for known AI agent environments (Claude Code, Cursor, Codex, Aider, Continue, Cline, Gemini), writes the appropriate MCP configuration for each one it finds, and reports results. All writes are idempotent — re-running on an already-configured system is safe.\n\n### Flags\n\n| Flag | Description |\n|------|-------------|\n| `--dry-run` | Print what would be written without making any changes. Exit 0 even if some agents would fail. |\n| `--detected-only` | Only configure agents that are already installed/active on this machine. Skip undetected ones. |\n| `--agents <csv>` | Comma-separated list of specific agents to target (e.g. `claude-code,cursor`). Overrides detection. |\n| `--mcp-endpoint <url>` | Custom MCP server URL. Defaults to `https://gate.sunaivacore.io/mcp`. |\n\n### Examples\n\n```sh\n# Dry-run: preview all changes without writing\nnpx @sunaiva/gate install --dry-run\n\n# Install only for Claude Code\nnpx @sunaiva/gate install --agents claude-code\n\n# Install for detected agents with a custom endpoint\nnpx @sunaiva/gate install --detected-only --mcp-endpoint https://my-gate.example.com/mcp\n\n# Install for multiple specific agents\nnpx @sunaiva/gate install --agents claude-code,cursor,codex\n```\n\n### Install exit codes\n\n| Code | Meaning |\n|------|---------|\n| `0`  | All targeted agents configured successfully. |\n| `1`  | One or more per-agent failures (see output for details). Agents that succeeded are still configured. |\n| `2`  | Internal unhandled exception — no changes made. |\n\n---\n\n## MCP configuration\n\nAdd to your client's MCP settings:\n\n```json\n{\n  \"mcpServers\": {\n    \"sunaiva-gate\": {\n      \"command\": \"npx\",\n      \"args\": [\"@sunaiva/gate\"]\n    }\n  }\n}\n```\n\nRestart your MCP client. The first tool call will trigger the gate.\n\n---\n\n## MCP tool reference\n\n| Tool | What it does |\n|------|--------------|\n| `validate_action` | Check a proposed action against all active rules. Returns `{allowed, violations[], warnings[], skipped_premium[], dry_run?, would_have_blocked?, stamp}`. The workhorse — every PreToolUse hook calls this. |\n| `log_bypass` | Record an intentional rule bypass for the audit log. **Rejects constitutional rules** with a structured `CONSTITUTIONAL_RULE_CANNOT_BE_BYPASSED` error. |\n| `get_rules` | List active rules; supports filtering by `category` or `preset`. |\n| `update_rules` | Enable / disable rules. **Rejects disable attempts against constitutional rules** with a structured `CONSTITUTIONAL_RULE_IMMUTABLE` error. |\n| `get_audit_log` | Return recent gate decisions from `~/.sunaiva/audit/audit.jsonl` with `tier`, `audit_status`, `evidence`, `event_type` fields. |\n| `ship_confidence_check` | **Paid-tier production-deploy gate.** Accepts a signed verdict path or artifact ID; verifies HMAC-SHA256 against `SHIP_CONFIDENCE_SIGNING_KEY`; returns `{allowed, tier: \"paid\"\\|\"free\", reason, evidence}`. Tagged in the audit ledger so you can measure the free-→paid upgrade funnel. |\n| `audit_verify` | Verify the forward-linked cryptographic hash chain of the audit log (Patent Claim 19). Reports chain integrity, tamper evidence, and ed25519 signature validity per entry. |\n| `set_rule_mode` | Set enforcement mode (`shadow`/`advisory`/`enforce`) for a specific rule. Requires API key (Pro+). |\n| `get_rule_modes` | List all enforcement-mode overrides configured for the authenticated customer. Requires API key (Pro+). |\n| `reset_rule_mode` | Remove a mode override for a rule, reverting it to its default enforcement mode. Requires API key (Pro+). |\n| `add_custom_rule` | Create a custom detection rule in the backend. Requires API key (Pro+). |\n| `update_custom_rule` | Update an existing custom rule. Requires API key (Pro+). |\n| `delete_custom_rule` | Delete a custom rule. Requires API key (Pro+). |\n| `list_custom_rules` | List all custom rules for the authenticated customer. Requires API key (Pro+). |\n| `list_presets` | List available rule preset bundles. Requires API key (Dev+). |\n| `apply_preset` | Apply a preset bundle, activating all its included rules. Requires API key (Pro+). |\n\nTotal: **16 MCP tools**. The `ship_confidence_check` tool is the ported\nTypeScript implementation of `.claude/hooks/ship_confidence_gate.py` v1.2.0,\nbyte-compatible with the Python skill's canonical-JSON HMAC format.\n\n---\n\n## Environment variables\n\n| Variable | Default | Purpose |\n|----------|---------|---------|\n| `DISABLE_SUNAIVA_GATE` | unset | Set to `1` to short-circuit every `validate_action` to `allowed: true`. Unconditionally logs to stderr. |\n| `SUNAIVA_GATE_DRY_RUN` | unset | Set to `1` to evaluate rules normally but never block. Response includes `dry_run: true` and `would_have_blocked: [...]`. |\n| `SUNAIVA_GATE_BACKEND_URL` | unset | Premium backend endpoint. Default for Pro customers: `https://mcp.sunaivacore.io/v1/gatehooks`. When unset, premium rules are skipped (recorded as `skipped_premium`). |\n| `SUNAIVA_GATE_API_KEY` | unset | Bearer token (JWT) for the premium backend. Required when `SUNAIVA_GATE_BACKEND_URL` is set. (`SUNAIVA_GATE_API_TOKEN` is accepted as a deprecated alias.) |\n| `SUNAIVA_GATE_BACKEND_TIMEOUT_MS` | `3000` | Backend request timeout. Backend errors fail-OPEN per-rule (logged as `skipped_premium_backend_error`). |\n| `SUNAIVA_GATE_FAIL_OPEN_ON_ERROR` | unset | Set to `1` to restore the 1.0.x fail-open behaviour on uncaught exceptions and malformed input. Default is fail-CLOSED. |\n| `SHIP_CONFIDENCE_SIGNING_KEY` | unset | HMAC-SHA256 key for verifying signed `sunaiva-ship-confidence` verdicts. Required by the `ship_confidence_check` tool. |\n| `SUNAIVA_GATE_AUDIT_PATH` | `~/.sunaiva/audit/audit.jsonl` | Override the audit log path. |\n\n---\n\n## Exit codes\n\n| Code | Meaning |\n|------|---------|\n| `0`  | Allow / success / smoke-test HEALTHY |\n| `1`  | Generic test failure (legacy `--test` flag, smoke-test DEGRADED) |\n| `2`  | Block (Claude Code convention) |\n| `3`  | Fail-CLOSED internal error (uncaught exception). Opt-in fail-open via `SUNAIVA_GATE_FAIL_OPEN_ON_ERROR=1`. |\n| `4`  | Fail-CLOSED invalid input (malformed JSON, empty stdin). Same opt-in escape hatch. |\n| `5`  | Smoke-test DEGRADED with missing required files (e.g. `dist/rules/rules.json` absent). |\n\n---\n\n## Killing the gate (and why we tell you how)\n\n`@sunaiva/gate` discloses its kill-switch in every block and warn message:\n\n```\n[sunaiva-gate v2.0.5] BLOCK — rule: dat-001 (recursive root deletion)\nEscape: export DISABLE_SUNAIVA_GATE=1\nAudit: ~/.sunaiva/audit/audit.jsonl\n```\n\nThe escape hint is a deliberate security-disclosure design. An enforcement\nproduct that hides its own bypass is one that gets routed around in production\nwithout anyone knowing. The kill-switch invocation is itself logged to the\naudit ledger as `decision: 'bypass_kill_switch'`, so disabling the gate is\nvisible to anyone who reads the audit.\n\n```bash\nexport DISABLE_SUNAIVA_GATE=1   # All actions allowed (logged)\nunset DISABLE_SUNAIVA_GATE      # Back to normal enforcement\n```\n\nUse dry-run instead of the kill-switch when you want to *measure* what the\ngate would block without actually blocking anything:\n\n```bash\nexport SUNAIVA_GATE_DRY_RUN=1\n# → response.dry_run: true\n# → response.would_have_blocked: [{rule_id, name, severity}, ...]\n```\n\n---\n\n## Decision model — warn-then-block escalation\n\nConstitutional rules block on the first match. Standard rules (the\nnon-constitutional subset) implement a session-state escalation:\n\n- **First match in a session** → `warn` (action allowed, message printed).\n- **Subsequent matches in the same session** → `block`.\n\nThis avoids one-time false-positive noise while still catching repeated\nviolations. The session counter is reset when the MCP server process restarts.\nConfidence is derived from keyword-count thresholds: `≥3` keywords matched →\n`high`, `1-2` → `medium`, `0` → `low` (low confidence is filtered out before\nthe response).\n\n---\n\n## Smoke test\n\n```bash\n$ npx @sunaiva/gate --smoke-test\n✓ Gate loaded — 104 rules\n✓ Constitutional rules — 35 local (27 constitutional + 8 recommended-default, cannot be disabled)\n✓ Premium rules — 69 (require backend service)\n✓ Immutability guard — ACTIVE — 27 constitutional rule IDs locked\n✓ Presets file — 5 presets available\n✓ Live eval (git push origin main) — HARD block via gov-001,cnst-gov-deploy\n✓ Live eval (ls -la) — ALLOW\n✓ Live eval (rm -rf /) — HARD block via gov-002\n✓ Live eval (stripe.charges.create) — HARD block via fin-001,cnst-fin-debit\n✓ MCP server — ready (not started in smoke test)\nStatus: HEALTHY\nVersion: 2.0.5\nSupport: support@sunaiva.ai\n```\n\nExit codes: `0` = HEALTHY, `1` = DEGRADED, `5` = missing required files.\n\n**Runtime note (WSL / 9p mounts):** `scripts/smoke.sh` makes two Node.js invocations\n(`--version` then `--smoke-test`). On WSL with a 9p-mounted working directory, each\nstartup takes ~10-60 s of real time because Node.js ESM resolution performs many\nmetadata stat calls across the network filesystem. On a native Linux or macOS host\nthe script finishes in 1-3 s. The script caches the `--version` result to avoid a\nthird invocation, but the two remaining calls are irreducible without bundling.\n\n---\n\n## Presets\n\n`get_rules` accepts a `preset` argument that filters the active set:\n\n| Preset | Rules | Use case |\n|--------|-------|----------|\n| `minimal` | 5 | Absolute non-negotiables only |\n| `essential` | 15 | Recommended starting point |\n| `developer-safety` | 25 | AI coding agents (Cursor / Windsurf / Cline / Aider) |\n| `financial-protection` | 24 | All financial + resource rules |\n| `full-suite` | 104 | Everything — Free constitutional set + Pro premium set |\n\nPresets read from `dist/rules/presets.json`. Premium presets require\n`SUNAIVA_GATE_BACKEND_URL` to be set; without it the premium rules are skipped\nwith a `skipped_premium` audit entry.\n\n---\n\n## Ship Confidence Gate (paid tier)\n\nThe `ship_confidence_check` MCP tool is the deploy-time gate for high-blast-\nradius commands (`npm publish`, `wrangler deploy`, `gh repo create --public`,\n`netlify deploy --prod`). It checks for authorization in two tiers:\n\n### Paid path — signed verdict\n1. The `sunaiva-ship-confidence` Python skill runs three verification layers\n   against your product (spec verification, property-based testing,\n   adversarial audit).\n2. It emits a signed verdict at\n   `data/ship_confidence_verdicts/<artifact>.signed.json`.\n3. The `ship_confidence_check` tool verifies:\n   - HMAC-SHA256 signature is valid (constant-time compare, byte-compatible\n     with the Python skill's canonical-JSON encoding).\n   - `level == \"GREEN\"` (YELLOW and RED hard-block).\n   - Signed within the last 60 minutes\n     (configurable via `VERDICT_MAX_AGE_MINUTES`).\n4. On all-pass: returns `{allowed: true, tier: \"paid\", ...}` and writes an\n   audit entry tagged `tier: \"paid\"` with the verdict ID and evidence.\n\n### Free fallback — approval token\nIf no signed verdict is found (or `SHIP_CONFIDENCE_SIGNING_KEY` is not set),\nthe tool falls back to a one-time approval token at\n`data/deploy_queue/APPROVAL_TOKENS/<artifact>.json` written within the last\nhour. Tagged `tier: \"free\"` in the audit ledger with an upgrade hint pointing\nat the paid skill.\n\n```bash\n# CLI form for use in CI:\nnpx @sunaiva/gate --ship-confidence @sunaiva/gate@2.0.5\n# Exit 0 = allow, 2 = block, 3 = internal error (fail-OPEN logged)\n```\n\n---\n\n## Constitutional rules cannot be disabled or bypassed\n\nThis is the package's hard guarantee. The 35 local rules (27 constitutional + 8 recommended-default) are\nre-merged into `active_rules` on every config load — even if\n`~/.sunaiva/gate-config.json` is hand-edited to remove them — and:\n\n- `update_rules({disable: ['fin-001']})` returns\n  `{error: \"CONSTITUTIONAL_RULE_IMMUTABLE\", rule_ids: [...]}`. No state\n  change.\n- `log_bypass({rule_id: 'fin-001'})` returns\n  `{error: \"CONSTITUTIONAL_RULE_CANNOT_BE_BYPASSED\", rule_id: ...}`. Nothing\n  written to the bypass log.\n\nThe kill-switch (`DISABLE_SUNAIVA_GATE=1`) is the only way to disable\nconstitutional enforcement, and it is loud — stderr disclosure on every\nblock, audit-ledger entry on every short-circuit. There are no quiet\nbypasses.\n\n---\n\n## Known limitations — what 2.0.5 does NOT have\n\nWe shipped `1.0.1` with seven CRITICAL gaps flagged by our own signed\nShip-Confidence verdict on our own commit (`01KRDBCEYF2CAB21G6Y3E9VVH5`, RED).\n1.1.0 closed all seven. What is honestly **not** in 2.0.5 yet:\n\n- **Sunaiva-Managed inference** — no flat-fee tier that includes LLM calls.\n  BYOK only in v1. Revisit at 50+ Pro customers.\n- **UI verification layer** (Playwright walkthroughs / computer-use) —\n  designed in\n  `data/ship_confidence_skill_upgrade_2026_05_11.md`, not yet shipped.\n  Folded into Pro at no extra cost when it lands.\n- **Deeper multi-tenant dashboard analytics** — the self-serve Team tier\n  ($199/mo or $1,990/yr, 5 seats incl.; need more? contact us) is live today\n  with shared custom rules and a shared audit dashboard (see Pricing above);\n  expanded cross-seat analytics views beyond the audit log are still in\n  progress.\n- **On-prem / VPC deployment** — Enterprise-only roadmap item. Helm chart\n  and Terraform module designs exist; not yet packaged.\n- **Per-call / metered pricing** — abandoned. Subscription wins.\n- **On-chain attestation (ERC-8004)** — aspirational. Deferred to v2.x.\n\nFull deferred-feature list: see `STRATEGIC_PRIORITIES.md` Phase 3\n(in-repo, not shipped in the tarball — internal-facing roadmap).\n\n---\n\n## Cross-platform\n\n- **Linux** — native.\n- **WSL** — native.\n- **macOS** — native.\n- **Windows** — native Node, plus a Python shim for clients that invoke the\n  legacy `hooks/sunaiva_gate_hook.py` PreToolUse path.\n\n---\n\n## Privacy & Telemetry\n\nYour data stays where you choose. The Free tier makes **zero** external network\ncalls for rule evaluation — constitutional rules are evaluated locally against\npatterns shipped inside the package. The Pro path is opt-in: when you set\n`SUNAIVA_GATE_BACKEND_URL`, the engine POSTs only the proposed action text and\nrule IDs to the backend; we never see your code, your secrets, or your\nfilesystem. BYOK means your inference provider API keys go\ndirect from your machine to those providers — they do not transit Sunaiva.\n\n**Install telemetry (keyed installs only).** Keyless / free-tier installs make\n**zero outbound network calls**. If you set `SUNAIVA_GATE_API_KEY`, on first use\n`@sunaiva/gate` emits **one** anonymous install event so we can count real\nadoption. The event contains:\n\n- gate version, OS platform, OS release;\n- a timestamp.\n\nIt does **not** contain: any fingerprint, email, IP address (not logged), code,\nprompts, agent traces, or any identifying information.\n\nTo opt out (keyed installs), set `SUNAIVA_GATE_TELEMETRY=0` in your\nenvironment. The gate respects this immediately. The marker is written to\n`~/.sunaiva-gate/first-run-<version>` so subsequent runs do not re-emit.\n\nSource: `src/identity/first-run.ts`. Receiver: `https://api.sunaiva.ai/api/telemetry/first-run`.\nWe do not sell, share, or correlate this data.\n\n---\n\n## License\n\n[BUSL-1.1](./BUSINESS_LICENSE.md) — free for evaluation, internal development,\nhobby and academic use. Commercial license required if you embed the Gate in\nthe critical path of a third-party paying-customer product before the\n**Change Date of 2030-07-19**, after which the wrapper converts to\n**Apache-2.0** automatically. The premium backend stays proprietary regardless\nof the Change Date.\n\n- Licensor: Sunaiva Digital\n- Change Date: **2030-07-19**\n- Change License: **Apache License, Version 2.0**\n\n---\n\n## Support\n\n| Need | Where |\n|------|-------|\n| Bug or crash | Email `support@sunaiva.ai` with `--smoke-test` output + `node --version` |\n| Feature request | Email `support@sunaiva.ai` with subject `[feature-request]` |\n| Security vulnerability | Email `support@sunaiva.ai` (do not file publicly) |\n| Licensing | `support@sunaiva.ai` |\n| Commercial / paid tier | `support@sunaiva.ai` |\n| Product page | `https://sunaivacore.io/pricing` |\n| Dashboard | `https://dashboard.sunaivacore.io` |\n\nWhen reporting bugs, include the output of `npx @sunaiva/gate --smoke-test`\nand `node --version`.\n\n---\n\n## Contributing\n\nPull requests welcome. For substantial changes, please open an issue first to\ndiscuss the proposal. Constitutional rule additions require a corresponding\ntest fixture in `tests/bundle.test.ts` and a passing dogfood Ship-Confidence\nverdict on the change.\n\n---\n\n*Built by a team whose own hooks killed their development for nine hours.\nWe fixed it. Then we shipped the fix. Then we signed the proof.*",
  "bytes": 25022,
  "sha": "f23b389ae4fb1f1984c4eb20912db8a96a9c705475042187895dd5afd3da8d4c",
  "repo_slug": "",
  "fonte": "npm",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_sunaivacore_gate_9e8edffb/readme"
}