Sage Gate validates environment variables, secrets, and runtime config at process start. One 1.2MB binary, zero runtime deps, 14ms cold start. If something is missing, your CLI tells you exactly what and where — before it breaks production.
Sage Gate sits between your shell and your application. It reads a YAML schema, resolves every variable from your environment, vault, or .env files, and halts execution with a precise error if anything is wrong.
Declare types, ranges, regex patterns, and required fields in one YAML file. The gate engine parses it in under 4ms and produces a typed report.
Values marked as secret are never logged, traced, or echoed. The gate engine masks them in output and strips them from error reports automatically.
Variables resolve from .env files, OS environment, HashiCorp Vault, and AWS SSM in a deterministic order. Every source is logged in the trace output.
Non-zero exit on any failed gate. Structured JSON output via --format json for CI integration. Works with make, just, npm scripts, and shell pipes.
The entire schema lives in a single YAML file at your project root. Commit it, diff it, review it — your config gates are now version-controlled infrastructure.
# sage-gate.yml — production config gates
version: 2
namespace: api-server
gates:
- key: DATABASE_URL
type: string
required: true
regex: ^postgres://
hint: "Set in vault://prod/db"
- key: PORT
type: int
range: [1, 65535]
default: 3000
- key: JWT_SECRET
type: string
min_length: 32
secret: true
- key: SENTRY_DSN
type: string
required: false
when: NODE_ENV == "production"
resolution:
order: [env, dotenv, vault, ssm]
timeout_ms: 5000The CLI is free forever for single projects. Team and enterprise tiers add shared schemas, audit trails, and priority resolution backends.
Single project, local .env resolution, community support.
Unlimited projects, vault + SSM resolution, audit trail.
SSO, on-prem resolution backend, SLA, custom gate types.
We replaced 200 lines of bash env-checks with a 40-line sage-gate.yml. The gate engine caught a missing STRIPE_SECRET_KEY in staging that would have shipped to production on a Friday. That alone paid for the license.
Write a schema, run the check, ship with confidence. No signup required for the Starter tier — just download the binary.