> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentgg.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate findings and set scope

> Re-check each finding against the source, apply trust-boundary rules, then score and de-duplicate what survives.

Detection agents over-report. `--validate` re-reads the source for each finding and gives it a verdict. `--scope` tells the validator which findings do not count.

## Verdicts

| Verdict          | Definition                                                                 |
| ---------------- | -------------------------------------------------------------------------- |
| `confirmed`      | The validator traced a working exploit path and stands behind the finding. |
| `false-positive` | The code is not vulnerable as described.                                   |
| `out-of-scope`   | The finding is real, but the scope document excludes it.                   |
| `uncertain`      | A real issue is plausible, but the validator cannot confirm it as written. |

## Validate

```bash theme={null}
agentgg scan . --validate -o ./out
```

`--validate` is on by default. `--no-validate` turns it off and findings ship with no verdict.

## Scope

A bundled scope document defines common trust boundaries: authentication, privilege, tenant isolation, network exposure, and the process boundary. It applies with `--validate` by default.

| Flag             | Effect                                                                                                                                             |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--scope <path>` | Uses your own scope file with `--validate`. Without `--validate`, it runs a cheap, source-free check that only ever marks findings `out-of-scope`. |
| `--no-scope`     | Turns off the bundled scope. No trust-boundary rules apply during validation.                                                                      |

<Warning>
  A finding needs `--validate` to receive `confirmed` or `false-positive`. `--scope` alone, without `--validate`, can only add `out-of-scope`.
</Warning>

```bash theme={null}
agentgg scan . --validate --scope ./SECURITY.md -o ./out
```

## Score

`--score` runs after validation. It rates each finding that survives with a CVSS (Common Vulnerability Scoring System) 3.1 base score. `false-positive` and `out-of-scope` findings are skipped. `--score` is on by default; `--no-score` turns it off.

| Score       | Severity |
| ----------- | -------- |
| 9.0 to 10.0 | CRITICAL |
| 7.0 to 8.9  | HIGH     |
| 4.0 to 6.9  | MEDIUM   |
| 0.1 to 3.9  | LOW      |
| 0.0         | INFO     |

## De-duplicate

`--dedup` groups findings in the same file that share a root cause under one primary finding, and marks every other one as a duplicate. It runs last, after validation and score, since it needs every finding for a file at once. `--dedup` is on by default. `--delete-duplicates` deletes the duplicates. Without it, agentgg only marks them.

Full flag list: [Scan flags](/cli/reference/scan-flags).