# Glossary

Short meanings of the words used in the zn-gate docs, with a link to the page that explains each one.

Source: https://usezn.com/docs/glossary/

Short meanings of the words used in the zn-gate docs. Where a page explains a word in more detail, the word links to it. Not sure where to begin? Start with [Install](https://usezn.com/docs/install/).

## Your setup

- **Coding agent**: a program such as Claude Code, Codex CLI, Cursor or OpenCode that reads your files and runs commands for you. See [Install](https://usezn.com/docs/install/).
- **Terminal**: the window where you type commands. Run zn-gate's setup commands in your own terminal, not through an agent.
- **Node.js**: the program that runs zn-gate's npm commands. `npx` comes with it. You can get it at [nodejs.org](https://nodejs.org/).
- **MCP server**: a tool your agent can call. MCP is the standard way agents connect to tools. zn-gate can also run as one. See [MCP clients and tools](https://usezn.com/docs/mcp/).
- **Plugin**: the zn-gate add-on for Claude Code. It sets up zn-gate's hooks and its MCP servers in one step. See [Claude Code](https://usezn.com/docs/install/claude-code/).
- **Keychain**: the password store of your operating system. zn-gate can keep an optional API key there. See [Connect](https://usezn.com/docs/zn-gate/connect/).

## Secrets

- **Secret**: a value that gives access to something, such as an API key, a token or a password.
- **`.env` file**: a file in a project that holds secrets and other settings for your app.
- **Vault**: an encrypted store on your machine where zn-gate keeps the real values of your secrets. See [Scrubber and secrets vault](https://usezn.com/docs/zn-gate/scrubber/).
- **Marker**: a stand-in for a secret, such as `__ZN_STRIPE_KEY__`. Your agent sees the marker. The real value stays in the vault. See [Scrubber and secrets vault](https://usezn.com/docs/zn-gate/scrubber/).
- **Redact**: replace a secret in some text with a marker or a label, so nobody who reads the text sees the value. See [Secret redaction](https://usezn.com/docs/zn-gate/redaction/).
- **Shadow** (`env shadow`): move the secret values of a `.env` file into the vault and leave markers in their place. See [Scrubber and secrets vault](https://usezn.com/docs/zn-gate/scrubber/).
- **Scrubber**: the part of zn-gate that replaces secrets with markers in what your agent reads, runs and sends. Values stay in the vault. See [Scrubber and secrets vault](https://usezn.com/docs/zn-gate/scrubber/).

## Checks and protection

- **Hook**: a small check that your agent runs before or after it reads a file, runs a command or gets your prompt. zn-gate uses hooks to block or redact. See [How zn-gate works](https://usezn.com/docs/concepts/).
- **Proxy** (`shield`): a layer that sits between your agent and an MCP server and checks what passes through. See [Protect MCP servers](https://usezn.com/docs/zn-gate/shield/).
- **Shadow mode** (`--shadow`): a way to roll zn-gate out in which decisions are logged but nothing is blocked or changed. Not the same as `env shadow` above. See [How zn-gate works](https://usezn.com/docs/concepts/).
- **Prompt injection**: text that tries to make an agent ignore your instructions, for example hidden inside a file or a web page. See [Threat model](https://usezn.com/docs/threat-model/).
- **Classifier**: a model that sorts text into groups, such as safe or an injection attempt.
- **Galvanize**: zn's prompt-injection checks. They run locally as rules, and the open Galvanize 2 classifier is available as an optional second opinion. See [Galvanize 2](https://usezn.com/docs/galvanize/).
- **Cloud check**: an optional second check, by the Galvanize 2 classifier at usezn.com, of the text sent to zn-gate's `analyze_prompt` tool. It is off until you turn it on. See [What leaves your machine](https://usezn.com/docs/what-leaves-your-machine/).

## Commands and records

- **Self-test** (`zn-gate test`): runs zn-gate's built-in examples.
- **Reach** (`zn-gate reach`): a read-only report of what your coding agents can reach on this machine. It shows names, never values. See [Reach](https://usezn.com/docs/zn-gate/reach/).
- **Audit** (`zn-gate audit`): reads the agent configuration files of a repository, without running anything, and reports what would run. See [Audit](https://usezn.com/docs/zn-gate/audit/).
- **Scan** (`zn-gate scan`): looks through the prompts, Markdown, skills and config files of a folder for leaked secrets and prompt-injection traps. See [Scan](https://usezn.com/docs/zn-gate/scan/).
- **Evidence** (the local audit log): a record of each shield decision on your machine. Each entry is chained to the one before it, so changes can be detected. See [Local audit log](https://usezn.com/docs/zn-gate/evidence/).