Skip to main content
A scan can spend time and tokens on files you do not need reviewed. Four layers narrow it down: file filters, a built-in exclude set, an automatic exclude pass, and hard caps.

​
File filters

​
The built-in exclude set

Every scan drops node_modules, .git, build directories, lockfiles, and binary files before it reads anything. Pass --no-default-excludes to turn this off and scan the whole tree except your own --exclude paths.

​
Auto-exclude

Before recon runs, the model reads the directory layout and picks folders that are not worth a security review, for example tests, fixtures, or vendored code. Those folders are dropped exactly like a typed --exclude path. --auto-exclude is on by default. The chosen folders print to the console every run, and --verbose prints the reason for each one. A later scan against the same --output directory reuses the same folders instead of a second pass. Pass --re-recon to force a fresh pass, or --no-auto-exclude to turn it off.

​
Caps

--max-files-per-agent drops files. The scan picks the same N files every run, in a fixed order, so a re-run does not recover the dropped files. --max-batches is different: a dropped batch runs on the next scan against the same --output directory.
Both accept a --no-max-files-per-agent or --no-max-batches form to remove the cap entirely. For the batch-shape knobs, --max-files-per-batch and --max-anchors-per-batch, see How a scan runs. Full flag list: Scan flags.