> ## Documentation Index > Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt > Use this file to discover all available pages before exploring further. # Merge Risk > Understand the Merge Risk rating in CodeRabbit's summary comment: what each level means, which commit it covers, and when it is unavailable. All Platforms (This feature is available on all supported platforms: GitHub, GitLab, Azure DevOps, and Bitbucket.) | Essentials Plan (This feature is available on Essentials (formerly Pro), Team (formerly Pro+), Advanced, and Enterprise. Please refer to our pricing page for more information about our plans and features.) Merge Risk is CodeRabbit's rating of how risky it is to merge a pull request as it stands. CodeRabbit assigns it at the end of each review, from the findings that remain and the context of the whole change, and shows it in the summary comment with a short explanation. ## What Merge Risk measures Merge Risk counts concrete risk that the pull request introduces or makes worse: in correctness, data integrity, security, availability, runtime and deployment behavior, permissions, and how hard the change is to roll back. Parts of the change that the review could not cover also count. It does not count how important the touched code is, general uncertainty about rolling out a change, design debt that existed before the pull request, tradeoffs the change makes on purpose, or the mere possibility of undiscovered bugs. The rating covers the whole pull request, not only the latest push. A risk that an earlier commit introduced keeps counting until a later commit resolves it. ## Risk levels | Level | Meaning | | - | - | | Minimal | No risk remains after the review. | | Low | Mergeable, with limited risk that the owner should know about or follow up on. | | Moderate | A material issue or uncertainty should be resolved before merging, unless the team accepts it. | | High | Concrete evidence points to a likely serious failure if the pull request is merged. | | Critical | Concrete evidence points to severe impact, such as serious security exposure, data loss, or a broad outage. | Any remaining risk raises Merge Risk to at least Low. ## Where you see it CodeRabbit shows Merge Risk in its summary comment. The **Merge Risk** line gives the level and the first five characters of the commit SHA that the rating covers, followed by a paragraph that explains the risk. On Git providers that support collapsible sections, it appears as a collapsed **Merge Risk** section. ## Which commit it covers Each completed review produces a new rating for the commit it reviewed. After you push, the rating still describes the earlier commit until CodeRabbit reviews the new one, and approval waits until the new commit has its own rating. [Approval risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md) use only a rating of the current commit. ## When Merge Risk is unavailable CodeRabbit produces no rating for a commit in cases such as these: * The review did not complete, for example because some files failed to review or were too large to review. * The new commit has nothing for CodeRabbit to review, for example because path filters exclude every changed file. * CodeRabbit could not finish the final assessment of the review. * CodeRabbit could not load the pull request's earlier risk history, or a dependency security scan did not finish. * On Azure DevOps, files were excluded for size or their diffs were unavailable. In these cases, a [merge risk limit](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#set-a-merge-risk-limit) treats the risk as unknown and CodeRabbit withholds its approval. A rating that CodeRabbit still shows from an earlier commit does not count. ## What you can change You cannot define or adjust how CodeRabbit scores Merge Risk. The rating follows from the risk the review finds. To lower it, address the risk that the explanation describes, then let CodeRabbit review the new commit. You choose how CodeRabbit acts on the rating. A [merge risk limit](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md) sets the highest level at which CodeRabbit may approve the pull request. ## Related assessments Merge Risk is not the same as these other assessments: * **Security architecture risk** rates the security impact of architecture-level changes. It comes from a [Security Architecture Review](https://docs.coderabbit.ai/security/architecture-review.md) and has its own approval limit. * **Risk** in [Triage rules](https://docs.coderabbit.ai/triage/rules.md) and your [Triage view](https://docs.coderabbit.ai/triage/your-triage-view.md) is a Low, Medium, or High score that Triage calculates from other review signals. It does not use Merge Risk, so the two can differ for the same pull request. * **Merge readiness** in [Change Stack](https://docs.coderabbit.ai/change-stack/findings.md#merge-readiness) is a separate score that Change Stack places in the bands Ready, Caution, Risky, or Blocked. ## What's next > **[Approval risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md)** > > Set the highest Merge Risk at which CodeRabbit may approve a pull request. > **[PR Walkthroughs](https://docs.coderabbit.ai/pr-reviews/walkthroughs.md)** > > See what else CodeRabbit's summary comment contains. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.