Suppression and rule policy

Suppress specific findings, define structured suppression rules, and control which rules are active using rule packs and per-rule policy.

CodeGate provides several mechanisms for tuning which findings are reported. All suppression settings can be placed in ~/.codegate/config.json (global) or <scan-target>/.codegate.json (project override). List-type suppression keys are merged across both files.

suppress_findings — suppress by finding ID or fingerprint

suppress_findings is an array of finding IDs or fingerprints. Any finding whose finding_id matches an entry in this list is marked as suppressed and excluded from exit code calculation.

{
  "suppress_findings": [
    "ENV_OVERRIDE:abc123",
    "fp:sha256:deadbeef"
  ]
}

Finding IDs and fingerprints appear in JSON and SARIF output. Use codegate scan . --format json to retrieve them.

Entries from the global config and project config are merged and de-duplicated.

suppression_rules — structured suppression by criteria

suppression_rules is an array of rule match objects. A finding is suppressed when it matches all specified fields in a rule. Fields that are omitted are not evaluated (AND semantics with ignored omissions).

Fields

Field	Type	Description
rule_id	string	Exact rule ID to match (e.g., ENV_OVERRIDE)
file_path	string	Glob pattern matched against the finding’s file path
location	string	File path with optional line and column: path/to/file:line:column
severity	string	Exact severity to match: critical, high, medium, low, info
category	string	Exact category string to match
cwe	string	Exact CWE identifier to match (e.g., CWE-78)
fingerprint	string	Exact fingerprint to match

file_path supports glob patterns with * (single path segment) and ** (any number of segments).

location matches the finding’s file path exactly (no glob). Line and column are optional — if provided, they must match the finding’s reported location.

Examples

Suppress all findings for a specific rule in a specific file:

{
  "suppression_rules": [
    {
      "rule_id": "ENV_OVERRIDE",
      "file_path": ".cursor/mcp.json"
    }
  ]
}

Suppress a finding at an exact file and line:

{
  "suppression_rules": [
    {
      "rule_id": "COMMAND_EXEC",
      "location": ".claude/settings.json:12"
    }
  ]
}

Suppress all high-severity findings across any MCP config file in any subdirectory:

{
  "suppression_rules": [
    {
      "severity": "high",
      "file_path": "**/.mcp.json"
    }
  ]
}

Suppress by CWE across the whole project:

{
  "suppression_rules": [
    {
      "cwe": "CWE-78"
    }
  ]
}

Entries from global and project configs are concatenated (not de-duplicated by content).

rules — per-rule policy (disable, ignore, config)

The rules object lets you configure policy for individual rules by rule ID. Each entry supports three fields:

Field	Type	Description
disable	boolean	When true, all findings from this rule are suppressed
ignore	string[]	List of file:line:column locations to ignore for this rule
config	object	Rule-specific configuration values

ignore entries use the same file:line:column format as suppression_rules.location. Line and column are optional.

Example

Disable a rule globally and ignore specific locations for another:

{
  "rules": {
    "RULE_INJECTION": {
      "disable": true
    },
    "GIT_HOOK": {
      "ignore": [
        ".git/hooks/pre-commit",
        ".git/hooks/commit-msg:5"
      ]
    },
    "COMMAND_EXEC": {
      "config": {
        "allow_package_manager_scripts": true
      }
    }
  }
}

rules entries from the global config and project config are merged. For each rule ID, scalar fields (disable) take the project value over the global value. ignore arrays are merged and de-duplicated. config objects are shallow-merged with project values overriding global values.

rule_pack_paths — load extra rule packs

rule_pack_paths is an array of paths to additional JSON rule pack files or directories containing JSON rule pack files. CodeGate loads these after the built-in rules.

{
  "rule_pack_paths": [
    "~/.codegate/my-rules.json",
    "/opt/security/codegate-packs/"
  ]
}

Paths are resolved before loading. Entries from global and project configs are merged and de-duplicated.

Use rule_pack_paths to distribute custom detection rules across a team by pointing everyone’s global config at a shared path.

allowed_rules — keep only specific rule IDs

allowed_rules is an array of rule IDs. After all rule packs are loaded, only rules whose IDs appear in this list remain active. An empty array (the default) means all loaded rules are active.

{
  "allowed_rules": [
    "ENV_OVERRIDE",
    "COMMAND_EXEC",
    "CONSENT_BYPASS"
  ]
}

Entries from global and project configs are merged and de-duplicated. allowed_rules is evaluated before skip_rules.

skip_rules — drop specific rule IDs

skip_rules is an array of rule IDs to drop after all rule packs are loaded. Applied after allowed_rules.

{
  "skip_rules": [
    "IDE_SETTINGS"
  ]
}

Entries from global and project configs are merged and de-duplicated.

skip_rules is a permanent drop for the lifetime of the scan. Use suppression_rules or rules.disable instead if you want to suppress specific findings rather than removing the rule entirely.

Order of evaluation

When a scan completes, CodeGate applies suppression in the following order:

1. rules[rule_id].disable — rule fully disabled, all its findings suppressed.
2. rules[rule_id].ignore — specific file/line locations suppressed for that rule.
3. suppression_rules — structured criteria matching (AND semantics).
4. suppress_findings — finding ID or fingerprint exact match.

A finding is suppressed if any of the above conditions match. Suppressed findings are excluded from exit code calculation and from blocking codegate run launches.