> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentgg.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Limit what gets scanned

> Narrow a scan to specific files, drop folders you don't own, and cap cost with per-agent and per-scan limits.

A scan can spend time and tokens on files you do not need reviewed. Four layers narrow it down: file filters, a built-in exclude set, an automatic exclude pass, and hard caps.

## File filters

| Flag                   | Default | Effect                                                                               |
| ---------------------- | ------- | ------------------------------------------------------------------------------------ |
| `--only <pattern>`     | None    | Restricts the scan to files that match at least one glob. Repeat it to add more.     |
| `--exclude <pattern>`  | None    | Drops a path or glob. Repeat it to add more. An excluded file is treated as deleted. |
| `--max-file-size <kb>` | 500     | Skips files larger than this size. `--no-max-file-size` removes the cap.             |

```bash theme={null}
agentgg scan . --only "src/**" --exclude "src/**/*.test.ts" --max-file-size 250 -o ./out
```

## The built-in exclude set

Every scan drops `node_modules`, `.git`, build directories, lockfiles, and binary files before it reads anything. Pass `--no-default-excludes` to turn this off and scan the whole tree except your own `--exclude` paths.

## Auto-exclude

Before recon runs, the model reads the directory layout and picks folders that are not worth a security review, for example tests, fixtures, or vendored code. Those folders are dropped exactly like a typed `--exclude` path.

`--auto-exclude` is on by default. The chosen folders print to the console every run, and `--verbose` prints the reason for each one. A later scan against the same `--output` directory reuses the same folders instead of a second pass. Pass `--re-recon` to force a fresh pass, or `--no-auto-exclude` to turn it off.

## Caps

<Warning>
  `--max-files-per-agent` drops files. The scan picks the same N files every run, in a fixed order, so a re-run does not recover the dropped files. `--max-batches` is different: a dropped batch runs on the next scan against the same `--output` directory.
</Warning>

| Flag                        | Default | Caps                                                                                  |
| --------------------------- | ------- | ------------------------------------------------------------------------------------- |
| `--max-files-per-agent <n>` | 300     | Candidate files one agent reviews in this run. Extra files are dropped, not deferred. |
| `--max-batches <n>`         | 250     | Total agent batches for the whole scan. Extra batches run on the next scan.           |

Both accept a `--no-max-files-per-agent` or `--no-max-batches` form to remove the cap entirely.

For the batch-shape knobs, `--max-files-per-batch` and `--max-anchors-per-batch`, see [How a scan runs](/cli/how-a-scan-runs).

Full flag list: [Scan flags](/cli/reference/scan-flags).