How does GauntletCI compare to SonarQube?

SonarQube analyzes the entire codebase on a schedule and requires a server, account, and network access. GauntletCI analyzes only the lines that changed in the current diff, runs entirely on the developer's machine in under one second, requires no account or cloud connection, and installs as a pre-commit hook. SonarQube is a full codebase quality platform; GauntletCI is a focused change-risk detector that runs before a commit is ever created.

How does GauntletCI compare to Semgrep?

Semgrep is a pattern-matching engine that scans files or the full codebase. GauntletCI scopes every rule to the changed diff, meaning it only flags risks introduced by the current change, not pre-existing issues in unchanged files. GauntletCI also includes incident correlation, local LLM enrichment, and baseline delta mode, which Semgrep does not offer. GauntletCI's free tier includes all rules with no account required.

How does GauntletCI compare to Snyk?

Snyk is primarily a dependency and container vulnerability scanner that requires cloud connectivity and a Snyk account. GauntletCI detects behavioral, structural, and security risks in first-party code changes, not dependency vulnerabilities, and runs 100% locally with no data transmitted. GauntletCI is suitable for air-gapped environments and organizations with strict data residency requirements; Snyk is not.

How does GauntletCI compare to CodeQL / GitHub Advanced Security?

CodeQL performs deep semantic analysis of the full codebase and requires compilation and significant compute time, typically minutes per run. GauntletCI analyzes only the changed diff in under one second with no compilation step, making it suitable as a pre-commit hook in the developer's local workflow. CodeQL is better for periodic deep security audits; GauntletCI is better for fast, continuous feedback on every commit.

How does GauntletCI compare to Code Climate?

Code Climate is a SaaS platform that analyzes full repositories for maintainability and test coverage trends over time. It requires uploading code to a cloud service. GauntletCI is fully local, diff-scoped, and focused on change risk rather than codebase health metrics. GauntletCI does not require a cloud account, never transmits code, and produces results in under one second, making it a complement to, not a replacement for, Code Climate's longitudinal reporting.

Does GauntletCI work in air-gapped or offline environments?

Yes. GauntletCI runs entirely on the local machine. No diff, finding, file path, or telemetry is transmitted. The optional local LLM enrichment feature (--with-llm) uses a locally hosted Ollama model, with no network call. This makes GauntletCI suitable for classified, regulated, or air-gapped environments where cloud-based analysis tools are prohibited.

What is baseline delta mode and do other tools offer it?

Baseline delta mode (gauntletci baseline capture) snapshots all current findings and suppresses them from future runs. Only net-new findings (risks introduced after the baseline) are reported. This eliminates alert fatigue from pre-existing issues in legacy codebases. SonarQube offers a similar 'new code' concept but requires server setup. Semgrep, Snyk, CodeQL, and Code Climate do not offer equivalent pre-commit baseline suppression.

How do I install the GauntletCI VS Code extension?

Open VS Code, press Ctrl+Shift+X to open the Extensions panel, search for GauntletCI, and click Install. The extension activates automatically when you open a workspace that contains a .csproj or .sln file.

Does the VS Code extension require the GauntletCI CLI to be installed?

Yes. The extension shells out to the gauntletci executable. Install it first with: dotnet tool install -g GauntletCI. The executable must be on your PATH or configured via the gauntletci.executable setting.

How do I trigger analysis in VS Code?

Open the Command Palette (Ctrl+Shift+P), type GauntletCI, and select 'GauntletCI: Analyze Current Commit'. To run analysis automatically on every file save, set gauntletci.analyzeOnSave to true in VS Code settings.

What does the GauntletCI status bar item show?

The status bar item shows the current analysis state: idle, running, or a count like '2 block / 1 warn' after analysis completes. Clicking it opens the GauntletCI output channel.

Extensions - VS Code

VS Code Extension

The GauntletCI VS Code extension surfaces change risk findings as inline diagnostic squiggles - the same red/yellow underlines you already rely on for compiler errors and linter warnings - without leaving your editor.

Prerequisites

+VS Code 1.85.0 or later
+.NET 8 SDK
+GauntletCI CLI on your PATH (see below)

# Install the CLI first

$ dotnet tool install -g GauntletCI

Install the extension

Two ways to install - both take under a minute.

Option 1 - Extensions panel

1.Open VS Code
2.Press Ctrl+Shift+X (Cmd+Shift+X on macOS) to open the Extensions panel
3.Search for "GauntletCI"
4.Click Install on the EricCogen.gauntletci extension

Option 2 - Command line

$ code --install-extension EricCogen.gauntletci

The extension activates automatically when you open a workspace containing a .csproj or .sln file. No further setup is required if gauntletci is on your PATH.

Run your first analysis

Open a .NET project, stage or commit a change, then run analysis from the Command Palette.

1.Press Ctrl+Shift+P (Cmd+Shift+P on macOS) to open the Command Palette
2.Type "GauntletCI" to filter commands
3.Select "GauntletCI: Analyze Current Commit"
4.Findings appear as inline squiggles in the affected files

OrderService.cs - GauntletCI Diagnostics

42public async Task<Result> ProcessOrder(int orderId)

43{

44 await _repository.SaveAsync(order);

errorGCI0001: Behavior change without test coverage - SaveAsync modified, no test updated. [GauntletCI]

45 return Result.Ok(order.Id);

warningGCI0004: Return value semantics changed - callers may not expect nullable. [GauntletCI]

Block findings show as red underlines (errors). Warn findings show as yellow underlines (warnings). Hover any underline for the full finding detail.

Status bar

The GauntletCI status bar item sits in the bottom bar and shows the current state at a glance.

main$(shield)GauntletCI: 2 block / 1 warnLn 44, Col 5

State	Display
Idle (no findings)	$(shield) GauntletCI
Running	$(shield) GauntletCI: analyzing...
Findings present	$(shield) GauntletCI: 2 block / 1 warn
Error	$(shield) GauntletCI: error

Commands

Command	Description
GauntletCI: Analyze Current Commit	Run analysis on HEAD and display findings as inline diagnostics.
GauntletCI: Clear Findings	Remove all GauntletCI diagnostics from the editor and reset the status bar.

Settings

Configure via settings.json or the Settings UI (search "GauntletCI").

{
  // Path to the gauntletci CLI (default: "gauntletci" on PATH)
  "gauntletci.executable": "gauntletci",

  // strict | balanced | permissive
  "gauntletci.sensitivity": "balanced",

  // Run analysis automatically when any file is saved
  "gauntletci.analyzeOnSave": false,

  // Disable LLM enrichment (recommended for fast local analysis)
  "gauntletci.noLlm": true
}

Setting	Default	Description
gauntletci.executable	"gauntletci"	Path to the CLI. Useful if gauntletci is not on the system PATH.
gauntletci.sensitivity	"balanced"	strict \| balanced \| permissive. Controls which confidence levels surface findings.
gauntletci.analyzeOnSave	false	Automatically run analysis every time a file is saved in the workspace.
gauntletci.noLlm	true	Disable LLM enrichment. Keep enabled for fast, fully offline analysis.

Analyze on save

Set gauntletci.analyzeOnSave to true to run analysis automatically whenever you save any file in the workspace. This gives you a continuous feedback loop as you code.

Note: analyze-on-save runs gauntletci analyze --staged which only sees staged changes. Unstaged edits are not included. This is by design - analysis reflects what would be committed.

Output channel

Full structured output from each analysis run is written to the GauntletCI output channel. Open it from View > Output and select GauntletCI from the dropdown. The channel shows every finding with evidence, suggested action, and the raw exit code.

Troubleshooting

Extension not activating

The extension only activates for workspaces containing a .csproj or .sln file. Open a .NET project folder, not a loose file.

"gauntletci: command not found"

Install the CLI with dotnet tool install -g GauntletCI, then ensure $HOME/.dotnet/tools is on your PATH. Restart VS Code after adding it to PATH.

No findings appear after analysis

Check the GauntletCI output channel for errors. Confirm you have staged or committed changes in the workspace - analyzing an unmodified HEAD will produce no findings.