Validate findings and set scope

Detection agents over-report. After the agents finish, a scan checks the findings in this order:

--dedup groups findings that share a root cause.
--validate re-reads the source for each group and gives it a verdict. --scope tells the validator which findings do not count.
--live-validate tests each finding against your running application. This step is optional.
--score rates each finding that the verdict does not reject.

All steps except live validation are on by default.

De-duplicate

--dedup runs right after detection. It compares the findings in each file, across all agents, and groups the findings that share a root cause under one primary finding. Every other finding in the group is marked as a duplicate. The validator and the score phase then work on the primary findings only. The validator sees the other reports in the group, and its verdict applies to the whole group. A duplicate shows its primary’s verdict and CVSS score in the report and in the viewer. When the validator rejects the primary, the group does not disappear:

If the verdict is false-positive or out-of-scope, a duplicate that the validator did not see is validated alone. The first one it does not reject becomes the new primary.
If the validator confirms the bug but the primary’s own claim does not hold, the group moves to the member whose claim holds.

--delete-duplicates deletes the duplicates. Without it, agentgg only marks them. The deletion happens after validation, so a duplicate that became the primary is kept. --no-dedup turns the phase off. Every finding is then validated and scored alone.

Verdicts

Verdict	Definition
`confirmed`	The validator traced a working exploit path from a reachable entry point, the reported flow matches the code, and the proof of concept works as written.
`false-positive`	The code is not vulnerable as described. A guard that lets only trusted values reach the sink also makes a finding a false positive.
`out-of-scope`	The finding is real, but the scope excludes it. A value that only a trusted actor, such as an administrator, can supply is out of scope under the trust-boundary rules.
`uncertain`	A real issue that untrusted input can reach is plausible, but the validator cannot confirm it as written. A finding whose proof of concept needs a correction also gets this verdict. The validator then gives the corrected payload in its reasoning.

Validate

agentgg scan . --validate -o ./out

--validate is on by default. --no-validate turns it off and findings ship with no verdict.

Confirmed impact

A report can claim more impact than the code allows. For a confirmed finding, the validator says which part of the claimed impact it confirmed. The finding file shows both parts under ### Validation:

**Confirmed impact:** An attacker reads any user's order history.
**Claimed, not confirmed:** An attacker changes other users' orders.

The score phase rates the confirmed impact, not the claim.

Agent-supplied validation rules

The validator applies one set of default rules to every finding. Those rules ask for a traced exploit path from an attacker-reachable entry point. Use your own rules when your bug class cannot show such a path. An agent can carry its own rules in a validationPrompt frontmatter field. The validator uses them instead of its defaults for findings that agent reported. This applies to --validate and to agentgg revalidate. Your text replaces the judgement rules only. The validator still supplies the finding, its source code, and the scope rules, so do not restate them.

---
slug: llm-output-to-sink
name: LLM Output Reaches a Dangerous Sink
validationPrompt: |
  Treat the model completion as attacker-controlled. Do not ask for proof
  that a named attacker can steer it.

  Return 'confirmed' when a value that originates from a model completion
  reaches a sink that executes it, and no step in between narrows it to a
  closed set of safe values.

  Return 'false-positive' when the completion is parsed into a schema and
  every field that reaches the sink is an enum or another closed set.
---

Write the confirm and dismiss rules for one bug class. Name the verdicts. A rule that matches no verdict leaves the model to improvise, so cover the cases you expect. Each run reports how many findings used an agent’s own rules:

Validating 5 finding(s) with scope at concurrency 5
  5 use their agent's own validation prompt

Scope

A bundled scope document defines common trust boundaries: authentication, privilege, tenant isolation, network exposure, and the process boundary. It applies with --validate by default.

Flag	Effect
`--scope <path>`	Uses your own scope file with `--validate`. Without `--validate`, it runs a cheap, source-free check that only ever marks findings `out-of-scope`.
`--no-scope`	Turns off the bundled scope. No trust-boundary rules apply during validation. A finding that only a trusted actor can reach is then `uncertain`, not `out-of-scope`.

A finding needs --validate to receive confirmed or false-positive. --scope alone, without --validate, can only add out-of-scope.

agentgg scan . --validate --scope ./SECURITY.md -o ./out

Live validation

The validator judges a finding from the source code. Live validation adds proof from a running copy of your application: a browser runs the attack of each finding and records what happens.

agentgg scan . --live-validate --target-url http://localhost:3000 -o ./out

Live validation is off by default and needs Docker. See Test findings against a running app.

Score

--score runs after validation and live validation. It rates each primary finding with a CVSS (Common Vulnerability Scoring System) 3.1 base score. It skips duplicates, and findings whose verdict is false-positive or out-of-scope. --score is on by default; --no-score turns it off.

Score	Severity
9.0 to 10.0	CRITICAL
7.0 to 8.9	HIGH
4.0 to 6.9	MEDIUM
0.1 to 3.9	LOW
0.0	INFO

To score rejected findings too, run agentgg score <dir> --include-disqualified.

Fix

After the score phase, a scan writes a suggested fix for each confirmed primary finding. See Suggested fixes. Full flag list: Scan flags.

Get started

Concepts

Guides

Providers

Reference

Help

Validate findings and set scope

De-duplicate

Verdicts

Validate

Confirmed impact

Agent-supplied validation rules

Scope

Live validation

Score

Fix

​De-duplicate

​Verdicts

​Validate

​Confirmed impact

​Agent-supplied validation rules

​Scope

​Live validation

​Score

​Fix

De-duplicate

Verdicts

Validate

Confirmed impact

Agent-supplied validation rules

Scope

Live validation

Score

Fix