· ReadyStack
Worked example
Real numbers from this tool, line by line.
A Rust crate author's release manifest went through this gate on 2026-09-17 and came back with 13 flagged lines - 8 of them hard refusals that stop the upload, 5 of them things that would have been frozen onto the crates.io page for good. The manifest compiled cleanly the whole time.
That is the shape of the problem. cargo build, cargo check and clippy do not care whether a Cargo.toml has a description, a licence, or a dependency pinned to the wildcard "*". Those are registry rules, not compiler rules. They surface for the first time at cargo publish, which is exactly the moment they cost the most.
The door only opens one way
crates.io does not delete versions. Once a version number is uploaded it belongs to that upload forever, and yanking it does not return the number to you - a yanked version stays in the index, visible, and the next release has to carry a different number. So a manifest that was wrong is not a build failure you retry - it is a permanent row in the release history of the crate.
What the gate reads
Cargo.toml Publish Gate applies 13 rules to the manifest text, offline, in the editor. Eight of them are refusals. [package] with no description, and [package] with neither license nor license-file, are both refused outright by crates.io. A dependency written as "*" is refused - a wildcard cannot be resolved downstream. A dependency carrying git = is refused, because the registry will not follow a git source. A dependency carrying path = but no version = stops cargo publish, since the packaged copy has no directory to walk to. And three limits bite quietly: at most five keywords, at most five categories, and no keyword longer than 20 characters.
The other five rules do not stop the upload - they describe what the upload will freeze. publish = false means cargo publish refuses this crate outright. A missing repository means the page for that version carries no source link. A missing readme means the page body stays empty. An absent or 2015 edition means that published version compiles as 2015. And version = "0.0.0" means a placeholder number has just been burned like any other.
Measured on the fixtures
The extension ships two manifests. _fixtures/clean.toml returns 0 findings. _fixtures/dirty.toml returns 13 - one per rule - and the report names each line number and the fix beside it. The gate also follows cargo's own packaging behaviour: a path dependency inside [dev-dependencies] with no version is stripped at package time, so it is not reported.
Where AI-written manifests land
An assistant asked for a Cargo.toml produces the parts it can infer from the code - the dependency list, the crate name, the edition - and leaves the parts it cannot: description, licence, repository, readme. Those four decide whether the upload happens at all. The list a generator leaves blank is almost exactly the list crates.io refuses on.
Free and paid
Free finishes one file: open any Cargo.toml, run the check, read every blocker with its line and its fix. Nothing is hidden, watermarked or counted down. The paid layer changes the scope and who owns the output - every Cargo.toml in the workspace in one pass, plus a dated report file you keep and attach to the release pull request. It is $29 once, one licence key per person or team seat.
The yardstick is simple. A contract Rust engineer on the open freelance market starts near $50 an hour, and reading the crates.io manifest rules against a release manifest by hand takes most of that hour - every release, every crate in the workspace. The gate does it before the door closes.
15 seconds — what it actually does
Questions people ask
What does Cargo.toml Publish Gate actually do?
It reads a Cargo.toml manifest and applies 13 rules that crates.io and cargo publish enforce at upload time: missing description or licence, wildcard and git dependencies, path dependencies without a version, the five-keyword and five-category limits, publish = false, a missing repository or readme, and a 2015 or absent edition. Each finding carries its line number and its fix.
Who is this for?
Rust crate authors and release engineers who publish to crates.io: maintainers cutting a release from a workspace, teams whose first upload of a new crate has to land correctly, and anyone whose Cargo.toml was partly written by an AI assistant that filled in dependencies but left description, licence and version placeholders untouched.
Why is a free tool not enough here?
cargo check, cargo build and clippy all compile fine with a wildcard dependency, no licence and no description, because those are registry rules rather than compiler rules. cargo publish is where they appear, and by then the run is live. This gate applies the registry rules offline, in the editor, before the upload.
What is free and what needs the licence key?
Free covers one file completely: open any Cargo.toml, run the check, and read every blocker with its line and its fix. Nothing is hidden, watermarked or limited by a countdown. The licence key adds scope and ownership: every Cargo.toml in the workspace in one pass, plus a dated report file you keep and attach to the release pull request.
What would this cost done by hand?
A contract Rust engineer on the open freelance market starts near $50 an hour, and re-reading the crates.io manifest rules against a release manifest takes most of that hour, once per release. The paid layer is $29 once, with one licence key per person or team seat and.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Cargo.toml Publish Gate - crates.io checks the file you open against 13 rules from a rule set dated 2026-09-17, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.