> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

<Badge color="outline-provider" size="sm" shape="pill" icon="github">GitHub</Badge>
<Badge color="outline-provider" size="sm" shape="pill" icon="gitlab">GitLab</Badge>
<Badge color="outline-provider" size="sm" shape="pill" icon="bitbucket">Bitbucket</Badge>

<Warning>
  **Git Integration (formerly Qodo Merge)** – AI code review agents for pull requests. This documentation describes the Qodo v1 experience. For the Qodo v2 documentation, click [here.](/code-review)
</Warning>

### Overview

The `compliance` tool performs comprehensive compliance checks on PR code changes, validating them against security standards, ticket requirements, and custom organizational compliance checklists, thereby helping teams, enterprises, and agents maintain consistent code quality and security practices while ensuring that development work aligns with business requirements.

<Tabs>
  <Tab title="Fully Compliant">
    <Frame>
      <img src="https://mintcdn.com/qodo/uIkZ6kAWHm6WXqrW/images/v1/image-146.png?fit=max&auto=format&n=uIkZ6kAWHm6WXqrW&q=85&s=c58c26fe68706748cf510ae14711b975" alt="" width="728" height="1028" data-path="images/v1/image-146.png" />
    </Frame>
  </Tab>

  <Tab title="Partially Compliant">
    <Frame>
      <img src="https://mintcdn.com/qodo/uIkZ6kAWHm6WXqrW/images/v1/image-147.png?fit=max&auto=format&n=uIkZ6kAWHm6WXqrW&q=85&s=6654d000d44c23ade04b6ada2c604727" alt="" width="712" height="1204" data-path="images/v1/image-147.png" />
    </Frame>
  </Tab>
</Tabs>

## Example usage

### Manual triggering

Invoke the tool manually by commenting `/compliance` on any PR. The compliance results are presented in a comprehensive table:

To edit [configurations](/v1/tools/tools-list/compliance#configuration-options) related to the `compliance` tool, use the following template:

```bash theme={null}
/compliance --pr_compliance.some_config1=... --pr_compliance.some_config2=...
```

For example, you can enable ticket compliance labels by running:

```bash theme={null}
/compliance --pr_compliance.enable_ticket_labels=true
```

### Automatic triggering

The tool can be triggered automatically every time a new PR is opened, or in a push event to an existing PR.

To run the `compliance` tool automatically when a PR is opened, define the following in the configuration file:

```toml theme={null}
[github_app]  # for example
pr_commands = [
    "/compliance",
    ...
]
```

## Compliance categories

The compliance tool evaluates three main categories:

### 1. Security compliance

Scans for security vulnerabilities and potential exploits in the PR code changes:

* **Verified Security Concerns** 🔴: Clear security vulnerabilities that require immediate attention
* **Possible Security Risks** ⚪: Potential security issues that need human verification
* **No Security Concerns** 🟢: No security vulnerabilities detected

Examples of security issues:

* Exposure of sensitive information (API keys, passwords, secrets)
* SQL injection vulnerabilities
* Cross-site scripting (XSS) risks
* Cross-site request forgery (CSRF) vulnerabilities
* Insecure data handling patterns

### 2. Ticket compliance

<Note>
  **How to set up ticket compliance**

  [Follow the guide on how to set up ticket compliance with Qodo Git interface.](/v1/integrations/ticketing-integrations)
</Note>

<Note>
  **Auto-create ticket**

  [Follow this guide](/v1/tools/tools-list/pr-to-ticket) to learn how to enable triggering `create tickets` based on PR content.

  <Frame>
    <img src="https://mintcdn.com/qodo/uIkZ6kAWHm6WXqrW/images/v1/image-148.png?fit=max&auto=format&n=uIkZ6kAWHm6WXqrW&q=85&s=2029499fa477b94a8d5cda13554b0d76" alt="" width="770" height="688" data-path="images/v1/image-148.png" />
  </Frame>
</Note>

Validates that PR changes fulfill the requirements specified in linked tickets:

* **Fully Compliant** 🟢: All ticket requirements are satisfied
* **Partially Compliant** 🟡: Some requirements are met, others need attention
* **Not Compliant** 🔴: Clear violations of ticket requirements
* **Requires Verification** ⚪: Requirements that need human review

### 3. RAG code duplication compliance

[Analyzes code changes using RAG endpoint](/v1/features/qodo-aware-rag) to detect potential code duplication from the codebase:

* **Fully Compliant** 🟢: No code duplication found
* **Not Compliant** 🔴: Full code duplication found
* **Requires Verification** ⚪: Near code duplication

### 4. [Custom Compliance](/v1/features/custom-compliance)

validates against an organization-specific compliance checklist:

* **Fully Compliant** 🟢: All custom compliance are satisfied
* **Not Compliant** 🔴: Violations of custom compliance
* **Requires Verification** ⚪: Compliance that need human assessment