> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Remediation and undo

> Apply guided or automatic fixes to scan findings, preview changes before writing, and restore previous file state with codegate undo.

CodeGate's Layer 4 remediation system lets you fix dangerous findings immediately after a scan. All changes are backed up before any file is modified, and `codegate undo` can restore the previous state at any time.

## Remediation flags

<ParamField path="--remediate" type="boolean" default="false">
  Enter guided remediation mode after the scan completes. CodeGate lists fixable findings and asks for confirmation before making changes. Use `--force` to skip the confirmation prompt.
</ParamField>

<ParamField path="--fix-safe" type="boolean" default="false">
  Automatically apply fixes for unambiguous critical findings without interactive prompts. Combine with `--dry-run` to preview what would be changed before committing.
</ParamField>

<ParamField path="--dry-run" type="boolean" default="false">
  Show proposed remediation changes without writing anything to disk. No backup session is created in dry-run mode.
</ParamField>

<ParamField path="--patch" type="boolean" default="false">
  Write the proposed changes as patch-style diff output instead of modifying files directly. Use this flag to review or share changes in a standard diff format.
</ParamField>

## Remediation workflow

<Steps>
  <Step title="Run a scan">
    Scan the target directory to identify findings.

    ```bash theme={null}
    codegate scan .
    ```
  </Step>

  <Step title="Review findings">
    Inspect the output. Findings marked as fixable are candidates for remediation.
  </Step>

  <Step title="Preview changes (optional)">
    Use `--dry-run` and `--patch` to see what remediation would do without writing anything.

    ```bash theme={null}
    codegate scan . --remediate --dry-run --patch
    ```
  </Step>

  <Step title="Apply fixes">
    Run with `--remediate` to apply guided fixes, or `--fix-safe` to auto-apply unambiguous critical fixes.

    ```bash theme={null}
    # Guided remediation — prompts before writing
    codegate scan . --remediate

    # Auto-fix critical findings without prompts
    codegate scan . --fix-safe
    ```

    Before any file is modified, CodeGate writes a backup session to `.codegate-backup/` in the scan target directory.
  </Step>

  <Step title="Undo if needed">
    If you want to revert the changes, run `codegate undo` from the same directory.

    ```bash theme={null}
    codegate undo
    ```
  </Step>
</Steps>

## Backup sessions

Every remediation run that modifies files creates a timestamped backup session under `.codegate-backup/` in the scan target directory. Each session captures the original content of every file that was modified.

`codegate undo [dir]` restores the **most recent** backup session. If no `[dir]` argument is given, it defaults to the current directory (`.`).

```bash theme={null}
# Undo the most recent remediation in the current directory
codegate undo

# Undo the most recent remediation in a specific directory
codegate undo ./path/to/project
```

<Note>
  `codegate undo` restores only the latest session. To restore an earlier session, inspect the `.codegate-backup/` directory manually and copy the files you need.
</Note>

## Scan-state baseline and `--reset-state`

CodeGate maintains a persistent baseline of MCP server identifiers and config hashes to support rug-pull detection across scans.

**Default state file location:**

```
~/.codegate/scan-state.json
```

You can override the path with `scan_state_path` in your config file. Paths beginning with `~` resolve to the current user's home directory.

**What state tracks:**

| Entry           | Meaning                                                          |
| --------------- | ---------------------------------------------------------------- |
| `NEW_SERVER`    | An MCP server identifier seen for the first time in this scan.   |
| `CONFIG_CHANGE` | An MCP server whose config hash changed since the previous scan. |

Both findings appear in scan results when baseline state changes are detected, giving you visibility into additions or modifications to your MCP server surface between scans.

**Resetting state:**

```bash theme={null}
codegate scan . --reset-state
```

`--reset-state` clears the baseline file and exits immediately. No scan is performed. Use this when you want to start tracking MCP servers from a clean baseline — for example, after deliberately adding new servers that you have reviewed.