> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Running scans

> Check code against policies and run the vulnerability and IaC scanners.

MergeGuide has two kinds of run: `check`, which evaluates your code against
policies, and `scan`, which runs the specialized vulnerability and
infrastructure-as-code scanners. This page covers both.

## Check code against policies

`check` is the core command. Point it at files or directories:

```bash theme={null}
# Check a directory
mergeguide check src/

# Check specific files
mergeguide check src/app.py src/db.py
```

With no paths, `check` reads your git-staged changes (or from stdin) — which is what
the pre-commit hook uses:

```bash theme={null}
# Check only what's staged
mergeguide check --staged
```

### Choose an output format

```bash theme={null}
mergeguide check src/ --format json
mergeguide check src/ --format sarif --output results.sarif
```

`check` supports `text` (default), `json`, `sarif`, and `markdown`. See
[Output formats](/reference/output-formats).

### Scope to frameworks

Run only the rules mapped to one or more frameworks:

```bash theme={null}
mergeguide check src/ --frameworks soc2-type2,pci-dss-v4
```

See [Policies & frameworks](/configuration/policies-and-frameworks).

## Scan dependencies for vulnerabilities

`scan vuln` checks your dependency manifests against known vulnerabilities (OSV):

```bash theme={null}
# Scan the current directory's manifests
mergeguide scan vuln

# Scan a specific project, failing on critical findings
mergeguide scan vuln --path ./my-project --fail-on critical

# Scan specific manifest files
mergeguide scan vuln package.json requirements.txt
```

## Scan infrastructure-as-code

`scan iac` checks IaC files for security misconfigurations. It supports Terraform,
CloudFormation, Kubernetes, and Helm:

```bash theme={null}
# Scan an infra directory
mergeguide scan iac --path ./infra

# Scan specific files as SARIF
mergeguide scan iac main.tf variables.tf --format sarif
```

Both scanners accept `--path`, `--format` (`text` / `json` / `sarif`), and
`--fail-on` (`none` / `high` / `critical`). See the
[CLI reference](/reference/cli#mergeguide-scan).

## Generate an SBOM

To produce a Software Bill of Materials from your dependency manifests:

```bash theme={null}
mergeguide sbom generate . --format spdx-json -o sbom.json
```

See [SBOM export](/compliance/sbom-export).

## What runs where

You rarely call these commands by hand once you're set up — they run automatically
at each [enforcement layer](/operation/enforcement-layers): in your IDE, while an AI
assistant works, on commit and push, and on every pull request.

## Next steps

<CardGroup cols={2}>
  <Card title="Reading findings" icon="list-check" href="/operation/reading-findings">
    Make sense of what a run reports.
  </Card>

  <Card title="Thresholds" icon="gauge" href="/configuration/thresholds">
    Decide what severity blocks a run.
  </Card>
</CardGroup>