How does GauntletCI compare to SonarQube?

SonarQube analyzes the entire codebase on a schedule and requires a server, account, and network access. GauntletCI analyzes only the lines that changed in the current diff, runs entirely on the developer's machine in under one second, requires no account or cloud connection, and installs as a pre-commit hook. SonarQube is a full codebase quality platform; GauntletCI is a focused change-risk detector that runs before a commit is ever created.

How does GauntletCI compare to Semgrep?

Semgrep is a pattern-matching engine that scans files or the full codebase. GauntletCI scopes every rule to the changed diff, meaning it only flags risks introduced by the current change, not pre-existing issues in unchanged files. GauntletCI also includes incident correlation, local LLM enrichment, and baseline delta mode, which Semgrep does not offer. GauntletCI's free tier includes all rules with no account required.

How does GauntletCI compare to Snyk?

Snyk is primarily a dependency and container vulnerability scanner that requires cloud connectivity and a Snyk account. GauntletCI detects behavioral, structural, and security risks in first-party code changes, not dependency vulnerabilities, and runs 100% locally with no data transmitted. GauntletCI is suitable for air-gapped environments and organizations with strict data residency requirements; Snyk is not.

How does GauntletCI compare to CodeQL / GitHub Advanced Security?

CodeQL performs deep semantic analysis of the full codebase and requires compilation and significant compute time, typically minutes per run. GauntletCI analyzes only the changed diff in under one second with no compilation step, making it suitable as a pre-commit hook in the developer's local workflow. CodeQL is better for periodic deep security audits; GauntletCI is better for fast, continuous feedback on every commit.

How does GauntletCI compare to Code Climate?

Code Climate is a SaaS platform that analyzes full repositories for maintainability and test coverage trends over time. It requires uploading code to a cloud service. GauntletCI is fully local, diff-scoped, and focused on change risk rather than codebase health metrics. GauntletCI does not require a cloud account, never transmits code, and produces results in under one second, making it a complement to, not a replacement for, Code Climate's longitudinal reporting.

Does GauntletCI work in air-gapped or offline environments?

Yes. GauntletCI runs entirely on the local machine. No diff, finding, file path, or telemetry is transmitted. The optional local LLM enrichment feature (--with-llm) uses a locally hosted Ollama model, with no network call. This makes GauntletCI suitable for classified, regulated, or air-gapped environments where cloud-based analysis tools are prohibited.

What is baseline delta mode and do other tools offer it?

Baseline delta mode (gauntletci baseline capture) snapshots all current findings and suppresses them from future runs. Only net-new findings (risks introduced after the baseline) are reported. This eliminates alert fatigue from pre-existing issues in legacy codebases. SonarQube offers a similar 'new code' concept but requires server setup. Semgrep, Snyk, CodeQL, and Code Climate do not offer equivalent pre-commit baseline suppression.

How do I install the GauntletCI Visual Studio extension?

Open Visual Studio, go to Extensions > Manage Extensions, search for GauntletCI, and click Download. Restart Visual Studio to activate it. Alternatively, download the .vsix from GitHub Releases and double-click to install.

Does the Visual Studio extension require the CLI to be installed?

Yes. The extension shells out to the gauntletci executable. Install it with: dotnet tool install -g GauntletCI. The executable must be on your PATH or configured via Tools > Options > GauntletCI > Executable.

Where do findings appear in Visual Studio?

Findings appear in the Error List (Block severity as errors, Warn as warnings) and in the Output window under the GauntletCI pane with full detail including rule ID, file, line, and message.

Which versions of Visual Studio are supported?

Visual Studio 2022 version 17.0 and later. The extension requires the .NET 8 SDK to be installed on the machine.

Extensions

Visual Studio Extension

The GauntletCI extension for Visual Studio 2022 runs behavioral change risk detection on your commits and surfaces findings directly in the Error List and Output window - no terminal required.

Requirements

Visual Studio 2022 (17.0 or later)
GauntletCI CLI: dotnet tool install -g GauntletCI

Install

Via the VS Marketplace

Open Visual Studio 2022.
Go to Extensions > Manage Extensions.
Search for GauntletCI in the Online tab.
Click Download, then close and restart Visual Studio.

Via .vsix (manual)

Download the latest .vsix from GitHub Releases.
Double-click the file to open the VSIX installer.
Click Install, then restart Visual Studio.

How to use

Open a .NET solution. After making changes, run the analysis from the menu:

Tools > GauntletCI > Analyze Current Commit

Error List output mockup

Error List2 Errors1 Warning

Code	Description	File	Line
GCI0001	Logic change without test coverage	OrderService.cs	42
GCI0003	Public API breaking change: method removed	IOrderService.cs	18
GCI0012	Exception swallowed without logging	PaymentHandler.cs	87

Double-clicking an Error List entry navigates to the affected line. Each entry in the Output window includes the rule ID, which links to the full rule description at gauntletci.com/docs/rules.

Settings

Configure via Tools > Options > GauntletCI > General.

Option	Default	Description
Executable	gauntletci	Full path to the CLI if not on PATH.
Sensitivity	balanced	`strict`, `balanced`, or `permissive`.
Disable LLM	true	Skip LLM enrichment for faster local analysis.

Troubleshooting

"gauntletci" is not recognized

The CLI is not on your PATH. Either run dotnet tool install -g GauntletCI and restart Visual Studio, or set the full path in Options > GauntletCI > Executable.

No findings after analysis

Analysis runs against the most recent commit, not staged changes. If you have uncommitted edits, commit them first. You can also run gauntletci analyze --staged directly in the terminal from VS View > Terminal.

Extension does not appear in the Tools menu

Confirm the extension installed successfully under Extensions > Manage Extensions > Installed. If it is listed but the menu item is missing, try Tools > Customize... to reset the menu.

Source and releases

Source code and releases are at EricCogen/GauntletCI-VisualStudio.