> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Definitions of the terms used throughout the MergeGuide documentation.

The terms the documentation uses, defined from the user's point of view. For the
narrative version, see [Core concepts](/get-started/core-concepts).

## Advisory mode

A run mode that reports findings but always exits `0`, so it never blocks. Enabled
with `--advisory`. See [Thresholds](/configuration/thresholds).

## Check

The core run that evaluates your code against policies (`mergeguide check`). See
[Running scans](/operation/running-scans).

## Control

A specific requirement within a compliance framework. Policies map to the controls
they help satisfy.

## Enforcement layer

A point in your workflow where MergeGuide applies your policies — IDE, MCP server,
git hooks, or PR gate. See [Enforcement layers](/operation/enforcement-layers).

## Evidence

The exportable record of what was checked and the result, used for audits. Exported
as NIST OSCAL or as an SBOM. See [Compliance overview](/compliance/overview).

## Finding

What MergeGuide reports when your code doesn't satisfy a policy — with file, line,
severity, and remediation guidance. See [Reading findings](/operation/reading-findings).

## Framework

A named compliance standard (such as SOC 2 or ISO 27001) made up of controls.
Activating a framework scopes the checks that run. See
[Policies & frameworks](/configuration/policies-and-frameworks).

## Git hooks

Local checks that run on commit and push, installed with `mergeguide hooks install`.
See [Install git hooks](/install/git-hooks).

## MCP server

The Model Context Protocol server (`@mergeguide/mcp-server`) that lets an AI
assistant check changes against your policies as it works. See
[Install the MCP server](/install/mcp-server).

## OSCAL

NIST Open Security Controls Assessment Language — the machine-readable evidence
format MergeGuide exports. See [OSCAL export](/compliance/oscal-export).

## Policy

A rule your code must satisfy (for example, "no hardcoded secrets"). MergeGuide
ships defaults and supports custom policies. See
[Policies & frameworks](/configuration/policies-and-frameworks).

## PolicyMerge

The feature that combines overlapping frameworks and shows where their controls
overlap, so meeting the strictest requirement satisfies the others. See
[PolicyMerge](/navigation/policymerge).

## PR gate

The enforcement layer that evaluates every pull request and holds the merge when
blocking findings exist. See [Set up the PR gate](/install/pr-gate).

## SARIF

Static Analysis Results Interchange Format — a standard output format ingested by
code-scanning dashboards. See [Output formats](/reference/output-formats).

## SBOM

Software Bill of Materials — a machine-readable inventory of your dependencies,
exported as CycloneDX or SPDX. See [SBOM export](/compliance/sbom-export).

## Severity

How serious a finding is (`critical` / `high` / `medium` / `low`), used together
with your thresholds to decide what blocks. See [Thresholds](/configuration/thresholds).

## Suppression

Accepting a finding as a known exception by disabling its policy or excluding its
path. See [Reading findings](/operation/reading-findings#suppress-a-finding).