Do you know what's running, where it's deployed, and what data it can access? GatekeeperAI gives your team a safe place to build and deploy internal AI tools — and gives security the visibility and control to say yes with confidence.
The problem today
Employees build AI tools on personal accounts, unknown APIs, and unreviewed code. Security has no visibility. One incident away from a breach.
With GatekeeperAI
Every AI app lives on your servers, goes through an automatic risk check, and needs security sign-off before it runs. Innovation stays — chaos doesn't.
Build your app with any AI assistant
Load GKAPP.md into any AI assistant and it will generate an app that works inside GatekeeperAI out of the box — no auth code, no Dockerfile, no server config. Describe your problem. Get a zip. Submit it.
Build, check, approve, deploy, log. Your team keeps moving — nothing unsafe gets through.
It doesn't matter if they're an engineer or not. They compress their app into a ZIP file and upload it directly in the browser — no technical setup required.
Before anyone sees it, the app is automatically scanned for exposed passwords, sensitive data, insecure packages, and AI-specific risks. The report surfaces what automation can catch — so your reviewer spends their time on judgment, not grep.
The risk report lands in a simple review queue. One click to approve or send back with feedback. Approved apps deploy automatically — rejected ones don't run.
Once approved, the app is deployed automatically inside your network — as a Docker container on a single server, or as a Kubernetes Deployment on EKS at enterprise scale. No manual setup, no IT ticket. The owner controls who can access it — by individual email or by SSO group, directly from the dashboard.
Every approval, deployment, and security event is recorded with a full audit trail. Forward logs automatically to Splunk, Datadog, AWS CloudWatch, or Grafana Loki.
Upload snake.zip, watch it scan and deploy, then play the game.
Drop snake.zip here, or use our sample
A simple interface for every role — developer, reviewer, and admin.
Developer view
Submit an app, track scan progress, and see exactly what was flagged.
Approver queue
Review risk reports, apply decisions, and meet SLA deadlines.
Admin & deployment logs
Monitor all deployments and audit every platform event.
Stop choosing between speed and security. GatekeeperAI gives you both.
Every app lives on your own servers. No third-party cloud, no data sharing, no vendor access. Your team's work stays inside your walls.
Every app goes through a review before it runs. Your security team sees exactly what was built, approves it or sends it back — with a clear paper trail.
Low-risk apps move quickly through the review queue. Developers keep shipping — Gatekeeper raises the floor so reviewers can focus where it counts.
The moment an app is submitted, Gatekeeper checks it for leaked passwords, exposed customer data, insecure dependencies, and more — automatically.
Every submission, review, and deployment is logged. Forward security events to Splunk, Datadog, AWS CloudWatch, or Grafana Loki automatically — or keep everything on-prem.
Developers just zip their app folder and upload it in the browser. No SSH keys, no terminal, no configuration — anyone who can build an app can submit one.
Instead of AI tools scattered across personal laptops and random cloud accounts, your team has one secure home for everything they build.
Developers can ship a new version of a running app at any time. The new container starts before the old one stops — users never see an outage, and the URL never changes.
Every deployed app is private to its creator by default. Grant access to specific teammates by email, or map your existing SSO groups — any team in your identity provider can be given access in one click.
Connect Okta, Azure AD, Google Workspace, Keycloak, or any OIDC-compliant provider. Your existing groups map to Gatekeeper roles automatically. Accounts are provisioned on first login — no separate directory to manage.
Touch ID, Face ID, and Windows Hello are first-class sign-in methods. Passkeys are phishing-proof and faster than any password. Password and SSO sign-in are available alongside passkeys.
Use Claude, ChatGPT, Gemini, Grok, or Copilot to generate your app. Load GKAPP.md as context and your AI assistant knows exactly what GatekeeperAI handles — no auth code, no Dockerfiles, no server config. Just describe your problem and submit the zip.
Run on a single server with Docker Compose for simple on-premises installs. Scale to Kubernetes/EKS with the included Helm chart and Terraform module — HPA, autoscaling workers, NetworkPolicy app isolation, and RDS/ElastiCache managed services.
Three different people. One platform that works for all of them.
The problem
Wants to ship AI tools fast without filing IT tickets or waiting weeks for approval.
With GatekeeperAI
Submit a ZIP, get a scan result in seconds. Clean apps deploy automatically — no engineering overhead, no command line.
The problem
Can't see what AI tools are running, what data they touch, or who built them.
With GatekeeperAI
Every app goes through an automatic risk scan before it runs. Full audit trail, approval queue, and SIEM forwarding — without slowing anyone down.
The problem
Tired of being handed random Python scripts and asked to 'just make it run somewhere.'
With GatekeeperAI
Docker Compose deploy on any server, or Kubernetes/EKS for enterprise scale. Included Helm chart and Terraform module, pre-built images, no surprise dependencies. Runs and stays running.
Barely. If someone on your team can copy-paste four commands and edit a .env file, you're done. Most setups are complete in under an hour.
No. Once an app is deployed it runs in its own container — GatekeeperAI going offline doesn't affect running apps at all.
Only the code in the submitted app is sent to the AI scanner at scan time. Nothing else — no user data, no secrets, no runtime traffic. Scanning happens once at submission, not continuously.
Yes — that's the point. Developers interact entirely through the browser. No SSH access, no terminal, no infrastructure knowledge required.
No — that's the point. GatekeeperAI uses passkeys as the default sign-in method. Employees sign in with the fingerprint sensor or face scan already on their laptop or phone. No password to create, forget, or reuse. Password sign-in is still available as a fallback, and SSO lets you connect your existing identity provider so employees never need a GatekeeperAI account at all.
Yes. GatekeeperAI supports any OIDC-compliant provider. Admins configure it once in the admin panel. After that, employees sign in with their existing company credentials — accounts are provisioned on first login automatically. Your IdP groups map directly to Gatekeeper roles (IC, Approver, Admin) and can gate access to individual deployed apps, so you don't have to manage a separate directory.
Yes. GatekeeperAI ships a Helm chart and Terraform module for EKS deployment alongside the standard Docker Compose install. The Kubernetes path adds Kaniko-based image builds, per-app Deployments in an isolated namespace, nginx-ingress routing, and autoscaling (HPA for the API, KEDA for Celery workers). Both paths share the same codebase — switch between them with a single DEPLOY_BACKEND environment variable.
GatekeeperAI runs on any server in your building or private cloud. Pre-built images pull straight from GitHub - no data leaves your network.
$ git clone https://github.com/jacobthomasmichael/GatekeeperAI.git
$ cd GatekeeperAI && cp .env.example .env
$ docker compose -f infra/docker-compose.yml pull
$ docker compose -f infra/docker-compose.yml up -d
→ Open http://your-server:3000 to complete setupRuns on any Linux server, Mac, or Windows machine with Docker installed. Full setup guide →