Detection agents over-report. --validate re-reads the source for each finding and gives it a verdict. --scope tells the validator which findings do not count.
Verdicts
Validate
--validate is on by default. --no-validate turns it off and findings ship with no verdict.
Scope
A bundled scope document defines common trust boundaries: authentication, privilege, tenant isolation, network exposure, and the process boundary. It applies with --validate by default.
A finding needs --validate to receive confirmed or false-positive. --scope alone, without --validate, can only add out-of-scope.
Score
--score runs after validation. It rates each finding that survives with a CVSS (Common Vulnerability Scoring System) 3.1 base score. false-positive and out-of-scope findings are skipped. --score is on by default; --no-score turns it off.
De-duplicate
--dedup groups findings in the same file that share a root cause under one primary finding, and marks every other one as a duplicate. It runs last, after validation and score, since it needs every finding for a file at once. --dedup is on by default. --delete-duplicates deletes the duplicates. Without it, agentgg only marks them.
Full flag list: Scan flags. 
