Moatgator documentation
Moatgator protects mobile apps at runtime and from your CI: you add it with a pull request, describe your policy in a moatgator.yml file, and every release build is registered, scanned and (when the protection engine is available) protected, with no SDK to integrate.
Current state (October 2026)
Read this before you plan around Moatgator. We keep it here, in one place, so the rest of the docs can stay clean.
| Piece | State |
|---|---|
| Public API v1, build registry, static Scan (APK, AAB, IPA) | Built and tested. Not deployed to a public domain yet. |
moatgator CLI, GitHub Action, GitHub App | Built and tested against local test servers. Not published to npm, the Marketplace or GitHub yet. |
| Protection engine (Shield, Runtime checks, Attest, Pulse) | Preview. protect registers the build and uploads the package, but no protected package is produced yet. The API answers engine: preview, and --require-protected fails your job on purpose until that changes. |
This page, and the limits and guarantees page, are updated when any row changes.
How it fits together
moatgator.ymllives in your repository. It names your app and says how each detection should respond:monitor,warn,blockorterminate. A new detection never blocks anything unless you ask. Reference- Your CI calls the CLI or the GitHub Action after the build. In GitHub Actions the job authenticates with OIDC, so there is no long-lived key in your secrets. CI guides
- The GitHub App (optional) detects your platform, opens one pull request with a starter
moatgator.ymlin monitor mode, and adds a check to pull requests that change it. - The console shows builds, scan grades and the policy history.
Start here
- I have an Android, iOS, React Native, Expo or Flutter app: Quickstart by platform.
- I know which CI I use: Quickstart by CI.
- I want to scan a build right now, with no account:
npx moatgator scan app-release.aab(see the CLI reference). - I want to know what the protection does not do: Limits and guarantees.