How does GauntletCI compare to SonarQube?

SonarQube analyzes the entire codebase on a schedule and requires a server, account, and network access. GauntletCI analyzes only the lines that changed in the current diff, runs entirely on the developer's machine in under one second, requires no account or cloud connection, and installs as a pre-commit hook. SonarQube is a full codebase quality platform; GauntletCI is a focused change-risk detector that runs before a commit is ever created.

How does GauntletCI compare to Semgrep?

Semgrep is a pattern-matching engine that scans files or the full codebase. GauntletCI scopes every rule to the changed diff, meaning it only flags risks introduced by the current change, not pre-existing issues in unchanged files. GauntletCI also includes incident correlation, local LLM enrichment, and baseline delta mode, which Semgrep does not offer. GauntletCI's free tier includes all rules with no account required.

How does GauntletCI compare to Snyk?

Snyk is primarily a dependency and container vulnerability scanner that requires cloud connectivity and a Snyk account. GauntletCI detects behavioral, structural, and security risks in first-party code changes, not dependency vulnerabilities, and runs 100% locally with no data transmitted. GauntletCI is suitable for air-gapped environments and organizations with strict data residency requirements; Snyk is not.

How does GauntletCI compare to CodeQL / GitHub Advanced Security?

CodeQL performs deep semantic analysis of the full codebase and requires compilation and significant compute time, typically minutes per run. GauntletCI analyzes only the changed diff in under one second with no compilation step, making it suitable as a pre-commit hook in the developer's local workflow. CodeQL is better for periodic deep security audits; GauntletCI is better for fast, continuous feedback on every commit.

How does GauntletCI compare to Code Climate?

Code Climate is a SaaS platform that analyzes full repositories for maintainability and test coverage trends over time. It requires uploading code to a cloud service. GauntletCI is fully local, diff-scoped, and focused on change risk rather than codebase health metrics. GauntletCI does not require a cloud account, never transmits code, and produces results in under one second, making it a complement to, not a replacement for, Code Climate's longitudinal reporting.

Does GauntletCI work in air-gapped or offline environments?

Yes. GauntletCI runs entirely on the local machine. No diff, finding, file path, or telemetry is transmitted. The optional local LLM enrichment feature (--with-llm) uses a locally hosted Ollama model, with no network call. This makes GauntletCI suitable for classified, regulated, or air-gapped environments where cloud-based analysis tools are prohibited.

What is baseline delta mode and do other tools offer it?

Baseline delta mode (gauntletci baseline capture) snapshots all current findings and suppresses them from future runs. Only net-new findings (risks introduced after the baseline) are reported. This eliminates alert fatigue from pre-existing issues in legacy codebases. SonarQube offers a similar 'new code' concept but requires server setup. Semgrep, Snyk, CodeQL, and Code Climate do not offer equivalent pre-commit baseline suppression.

How do I install the GauntletCI Rider plugin?

Open Rider, go to Settings > Plugins, search for GauntletCI in the Marketplace tab, and click Install. Restart Rider when prompted.

Does the Rider plugin require the CLI to be installed?

Yes. Install the CLI first with: dotnet tool install -g GauntletCI. The plugin shells out to the gauntletci executable, which must be on your PATH.

How do findings appear in Rider?

Findings appear as inline editor annotations: red squiggles for Block severity, yellow squiggles for Warn, and grey weak-warning underlines for Advisory. Each annotation tooltip shows the rule ID and links to the rule documentation.

Which versions of Rider are supported?

Rider 2024.2 and later. Requires the GauntletCI CLI and .NET 8 SDK.

Extensions

JetBrains Rider Plugin

The GauntletCI plugin for JetBrains Rider surfaces behavioral change risk findings as inline editor annotations - red and yellow squiggles with tooltip links to the full rule documentation.

Requirements

JetBrains Rider 2024.2 or later
GauntletCI CLI: dotnet tool install -g GauntletCI

Install

Via the JetBrains Marketplace

Open Rider and go to Settings > Plugins.
Select the Marketplace tab.
Search for GauntletCI and click Install.
Restart Rider when prompted.

Via .zip (manual)

Download the latest plugin .zip from GitHub Releases.
Go to Settings > Plugins > gear icon > Install Plugin from Disk.
Select the downloaded .zip and restart Rider.

How to use

With a .NET project open, run the analysis from the menu:

Tools > GauntletCI > Analyze Current Commit

Inline annotation mockup

OrderService.cs

40public decimal CalculateTotal(Order order)

41{

return order.Lines.Sum(l => l.Price * l.Qty);

GCI0001: Logic change without test coverage - GauntletCI

43}

Hovering over an annotated line shows the finding message and a link to the rule documentation on gauntletci.com. Block findings render as red squiggles, Warn as yellow squiggles, and Advisory as grey weak-warning underlines.

Annotation severity mapping

GauntletCI severity	Rider annotation	Color
Block	Error	Red squiggle
Warn	Warning	Yellow squiggle
Advisory	Weak Warning	Grey underline

Troubleshooting

No annotations appear after analysis

Analysis runs against the latest commit. Ensure you have committed your changes. Check the Event Log in Rider for any errors from the GauntletCI process.

CLI not found

Verify gauntletci is on your PATH by running it in a terminal. On macOS, Rider may not inherit the full user PATH - use the full path in plugin settings or add it to ~/.zshrc and restart Rider.

Source and releases

Source code and releases are at EricCogen/GauntletCI-Rider.