> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Suppression and rule policy

> Suppress specific findings, define structured suppression rules, and control which rules are active using rule packs and per-rule policy.

CodeGate provides several mechanisms for tuning which findings are reported. All suppression settings can be placed in `~/.codegate/config.json` (global) or `<scan-target>/.codegate.json` (project override). List-type suppression keys are merged across both files.

<AccordionGroup>
  <Accordion title="suppress_findings — suppress by finding ID or fingerprint">
    `suppress_findings` is an array of finding IDs or fingerprints. Any finding whose `finding_id` matches an entry in this list is marked as suppressed and excluded from exit code calculation.

    ```json theme={null}
    {
      "suppress_findings": [
        "ENV_OVERRIDE:abc123",
        "fp:sha256:deadbeef"
      ]
    }
    ```

    Finding IDs and fingerprints appear in JSON and SARIF output. Use `codegate scan . --format json` to retrieve them.

    Entries from the global config and project config are merged and de-duplicated.
  </Accordion>

  <Accordion title="suppression_rules — structured suppression by criteria">
    `suppression_rules` is an array of rule match objects. A finding is suppressed when it matches **all** specified fields in a rule. Fields that are omitted are not evaluated (AND semantics with ignored omissions).

    ### Fields

    | Field         | Type   | Description                                                          |
    | ------------- | ------ | -------------------------------------------------------------------- |
    | `rule_id`     | string | Exact rule ID to match (e.g., `ENV_OVERRIDE`)                        |
    | `file_path`   | string | Glob pattern matched against the finding's file path                 |
    | `location`    | string | File path with optional line and column: `path/to/file:line:column`  |
    | `severity`    | string | Exact severity to match: `critical`, `high`, `medium`, `low`, `info` |
    | `category`    | string | Exact category string to match                                       |
    | `cwe`         | string | Exact CWE identifier to match (e.g., `CWE-78`)                       |
    | `fingerprint` | string | Exact fingerprint to match                                           |

    `file_path` supports glob patterns with `*` (single path segment) and `**` (any number of segments).

    `location` matches the finding's file path exactly (no glob). Line and column are optional — if provided, they must match the finding's reported location.

    ### Examples

    Suppress all findings for a specific rule in a specific file:

    ```json theme={null}
    {
      "suppression_rules": [
        {
          "rule_id": "ENV_OVERRIDE",
          "file_path": ".cursor/mcp.json"
        }
      ]
    }
    ```

    Suppress a finding at an exact file and line:

    ```json theme={null}
    {
      "suppression_rules": [
        {
          "rule_id": "COMMAND_EXEC",
          "location": ".claude/settings.json:12"
        }
      ]
    }
    ```

    Suppress all high-severity findings across any MCP config file in any subdirectory:

    ```json theme={null}
    {
      "suppression_rules": [
        {
          "severity": "high",
          "file_path": "**/.mcp.json"
        }
      ]
    }
    ```

    Suppress by CWE across the whole project:

    ```json theme={null}
    {
      "suppression_rules": [
        {
          "cwe": "CWE-78"
        }
      ]
    }
    ```

    Entries from global and project configs are concatenated (not de-duplicated by content).
  </Accordion>

  <Accordion title="rules — per-rule policy (disable, ignore, config)">
    The `rules` object lets you configure policy for individual rules by rule ID. Each entry supports three fields:

    | Field     | Type      | Description                                                  |
    | --------- | --------- | ------------------------------------------------------------ |
    | `disable` | boolean   | When `true`, all findings from this rule are suppressed      |
    | `ignore`  | string\[] | List of `file:line:column` locations to ignore for this rule |
    | `config`  | object    | Rule-specific configuration values                           |

    `ignore` entries use the same `file:line:column` format as `suppression_rules.location`. Line and column are optional.

    ### Example

    Disable a rule globally and ignore specific locations for another:

    ```json theme={null}
    {
      "rules": {
        "RULE_INJECTION": {
          "disable": true
        },
        "GIT_HOOK": {
          "ignore": [
            ".git/hooks/pre-commit",
            ".git/hooks/commit-msg:5"
          ]
        },
        "COMMAND_EXEC": {
          "config": {
            "allow_package_manager_scripts": true
          }
        }
      }
    }
    ```

    `rules` entries from the global config and project config are merged. For each rule ID, scalar fields (`disable`) take the project value over the global value. `ignore` arrays are merged and de-duplicated. `config` objects are shallow-merged with project values overriding global values.
  </Accordion>

  <Accordion title="rule_pack_paths — load extra rule packs">
    `rule_pack_paths` is an array of paths to additional JSON rule pack files or directories containing JSON rule pack files. CodeGate loads these after the built-in rules.

    ```json theme={null}
    {
      "rule_pack_paths": [
        "~/.codegate/my-rules.json",
        "/opt/security/codegate-packs/"
      ]
    }
    ```

    Paths are resolved before loading. Entries from global and project configs are merged and de-duplicated.

    <Tip>
      Use `rule_pack_paths` to distribute custom detection rules across a team by pointing everyone's global config at a shared path.
    </Tip>
  </Accordion>

  <Accordion title="allowed_rules — keep only specific rule IDs">
    `allowed_rules` is an array of rule IDs. After all rule packs are loaded, only rules whose IDs appear in this list remain active. An empty array (the default) means all loaded rules are active.

    ```json theme={null}
    {
      "allowed_rules": [
        "ENV_OVERRIDE",
        "COMMAND_EXEC",
        "CONSENT_BYPASS"
      ]
    }
    ```

    Entries from global and project configs are merged and de-duplicated. `allowed_rules` is evaluated before `skip_rules`.
  </Accordion>

  <Accordion title="skip_rules — drop specific rule IDs">
    `skip_rules` is an array of rule IDs to drop after all rule packs are loaded. Applied after `allowed_rules`.

    ```json theme={null}
    {
      "skip_rules": [
        "IDE_SETTINGS"
      ]
    }
    ```

    Entries from global and project configs are merged and de-duplicated.

    <Note>
      `skip_rules` is a permanent drop for the lifetime of the scan. Use `suppression_rules` or `rules.disable` instead if you want to suppress specific findings rather than removing the rule entirely.
    </Note>
  </Accordion>
</AccordionGroup>

## Order of evaluation

When a scan completes, CodeGate applies suppression in the following order:

1. `rules[rule_id].disable` — rule fully disabled, all its findings suppressed.
2. `rules[rule_id].ignore` — specific file/line locations suppressed for that rule.
3. `suppression_rules` — structured criteria matching (AND semantics).
4. `suppress_findings` — finding ID or fingerprint exact match.

A finding is suppressed if any of the above conditions match. Suppressed findings are excluded from exit code calculation and from blocking `codegate run` launches.