> ## Documentation Index > Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Finding categories > Every finding category, severity level, confidence value, and layer label that CodeGate emits, plus a full reference for the Finding type fields. Every finding CodeGate emits belongs to one category, one severity level, one confidence level, and one layer. This page documents all defined values and the full `Finding` type. ## Severity levels | Severity | Meaning | | ---------- | --------------------------------------------------------------------------------------------------------------------------------------- | | `CRITICAL` | Actively exploitable or confirmed-dangerous configuration. Triggers exit code `2` when at or above the configured `severity_threshold`. | | `HIGH` | High-confidence, high-impact risk that should be reviewed before trusting a tool. Default `severity_threshold`. | | `MEDIUM` | Notable risk pattern that warrants inspection, especially in sensitive contexts. | | `LOW` | Low-impact or low-confidence signal. Useful for auditor-persona scans. | | `INFO` | Informational observation with no direct risk implication. | ## Confidence values | Confidence | Meaning | | ---------- | ---------------------------------------------------------------- | | `HIGH` | Pattern match is unambiguous; false-positive rate is low. | | `MEDIUM` | Heuristic or partial match; review is recommended. | | `LOW` | Weak signal; context-dependent; may require manual verification. | ## Layers | Layer | Value | Source | | ------- | ----- | --------------------------------------------------------------- | | Layer 1 | `L1` | Discovery phase (file walker, config parser, tool detector) | | Layer 2 | `L2` | Static analysis phase (rule engine, detectors) | | Layer 3 | `L3` | Deep scan phase (meta-agent analysis, remote resource fetching) | ## Finding categories Triggered when a configuration file sets or overrides environment variables in a way that could redirect API traffic, exfiltrate credentials, or suppress safety controls. Common sources include MCP server env blocks and AI tool workspace settings that inject `OPENAI_API_BASE`, `ANTHROPIC_BASE_URL`, or similar variables pointing to attacker-controlled endpoints. Triggered when a configuration defines an executable command that CodeGate cannot verify as safe. Covers MCP server `command` fields that invoke shells (`bash`, `sh`), network tools (`curl`, `wget`, `nc`), or interpreters (`python`, `node`) that are on the `blocked_commands` list. Also covers hook scripts and formatter entries that reference unexpected binaries. Triggered when configuration attempts to suppress, disable, or pre-answer tool consent dialogs and trust prompts. Relates to known CVEs such as CVE-2025-59536 (MCP consent bypass). Includes settings that set `allow_all`, disable trust prompts, or configure auto-approval for tool calls without user interaction. Triggered when instruction files (`CLAUDE.md`, `AGENTS.md`, `CODEX.md`, `.cursorrules`, custom rule files) contain patterns that attempt to override the agent's safety policy, hijack tool selection, suppress output, redirect the agent to attacker instructions, or exfiltrate context. Detected by rule-file heuristics including unicode analysis when `unicode_analysis` is enabled. Triggered when workspace or user-level IDE settings files (`.vscode/settings.json`, `.cursor/settings`, etc.) contain configurations that could alter agent behavior or execution environment in a security-relevant way. Controlled by the `check_ide_settings` config key; can be disabled with `check_ide_settings: false`. Triggered when a symbolic link inside the scanned project tree resolves to a target outside the project root. Symlink escapes can be used to make an agent read or write files outside the intended workspace boundary. Detected during the Layer 1 file walk. Triggered when a `.git/hooks/` script is present and not on the `known_safe_hooks` allow-list. Git hooks execute automatically on git operations and are a common persistence and lateral-movement vector in repository-level attacks. `known_safe_hooks` entries are matched against hook paths relative to the repository root (for example `.git/hooks/pre-commit`). Triggered by rule-pack matches when the matched category cannot be resolved to a more specific category. Also used as the fallback category for rule-pack rules that specify an unrecognized `category` value. Indicates that a known-risky configuration construct is present and deserves review. Triggered when a resource or instruction file cannot be parsed, fetched, or interpreted during Layer 3 deep scan. Includes consent-skipped outcomes, timeout, auth failure, network failure, and response schema mismatches. These findings allow operators to audit why deep scan did not fully complete for a given resource. Triggered when an MCP server's configuration hash differs from the baseline recorded in `scan-state.json`. Indicates that a server's definition changed between scans, which may signal a rug-pull or unexpected update. Baseline is stored at `~/.codegate/scan-state.json` (or the path set by `scan_state_path`). Triggered when an MCP server identifier appears in the scan that has not been seen in prior scans recorded in the baseline state. First-seen server detection helps surface newly introduced servers that have not been reviewed. Triggered by Layer 3 meta-agent analysis when a data-flow path from an external or untrusted input reaches a sensitive sink (for example: a tool call that writes files, executes commands, or exfiltrates data). Requires `--deep` to produce. Sources and sinks are recorded in the finding's `metadata.sources` and `metadata.sinks` fields. Triggered by workflow audit detectors for GitHub Actions supply-chain risks. Covers unpinned action references (`uses: owner/repo@tag` instead of a full commit SHA), archived action references, stale action refs, floating action versions, and known-vulnerable action references (online mode only). Triggered when a GitHub Actions workflow uses a high-risk trigger event. Currently detects `pull_request_target` and `workflow_run` triggers, which allow workflows triggered by untrusted forks to run with repository write permissions if not carefully guarded. Triggered when a GitHub Actions workflow grants overly broad permissions. Covers `write-all` permission grants, explicit write grants on sensitive scopes, undocumented permissions, overprovisioned secrets, secrets passed via inheritance (`secrets: inherit`), and secrets used outside environment blocks. Triggered when a GitHub Actions `run:` step or known sink input uses a `${{ }}` template expression that interpolates untrusted context values (for example `github.event.pull_request.title` or `github.head_ref`) directly into shell commands. Template injection in run steps is a common code execution path in compromised workflows. Triggered when a workflow references a GitHub Action that appears in the known-vulnerable action registry. Requires `--runtime-mode online` to perform the live advisory lookup. In offline mode this check is skipped. ## Finding type reference The `Finding` interface is defined in `src/types/finding.ts`. The fields are: | Field | Type | Description | | --------------------- | --------------------- | ----------------------------------------------------------------------------------------------- | | `rule_id` | `string` | Identifier of the rule or detector that produced this finding. | | `finding_id` | `string` | Unique identifier for this specific finding instance. | | `fingerprint` | `string \| undefined` | Stable hash of the finding's key attributes, used for suppression matching. | | `severity` | `Severity` | One of `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFO`. | | `category` | `FindingCategory` | One of the 17 categories listed above. | | `layer` | `FindingLayer` | `L1`, `L2`, or `L3`. | | `file_path` | `string` | Path to the file that contains the finding. | | `description` | `string` | Human-readable description of the risk. | | `affected_tools` | `string[]` | AI coding tools affected by this finding. | | `cve` | `string \| null` | Associated CVE identifier, if known. | | `owasp` | `string[]` | Associated OWASP category references. Omitted from output when `owasp_mapping: false`. | | `cwe` | `string` | Associated CWE identifier. | | `confidence` | `FindingConfidence` | `HIGH`, `MEDIUM`, or `LOW`. | | `fixable` | `boolean` | Whether CodeGate can apply an automated fix via `--remediate` or `--fix-safe`. | | `remediation_actions` | `string[]` | List of remediation action identifiers applicable to this finding. | | `suppressed` | `boolean` | Whether this finding has been suppressed by a `suppress_findings` or `suppression_rules` entry. |