Skip to main content
A scan runs through a fixed set of phases. Each phase finishes before the next one starts. Every phase records what it did under state/, so a killed scan can pick up close to where it stopped. See Output and state for that layout.

​
The phases

Report is optional. The Agents phase is not. Turn off Validate, Score, De-duplicate, or Report with --no-validate, --no-score, --no-dedup, or --no-summary. --no-recon turns off Recon and Preconditions together and queues every named agent with no check. Full flag list: Scan flags. What makes a phase skip work it already did is a separate topic. See Resume and reports.

​
Default scan

agentgg scan . runs a complete scan with no configuration. This is what it does.
The bundled scope covers the trust boundaries most projects share. It stops the validator from reporting code that no boundary makes reachable, which cuts false positives. Pass --scope <path> to apply rules of your own. See Validate findings and set scope.
The limits below control what a scan costs. Each one caps how much work the scan sends to the model, so a large repository stays predictable. Raise any of them, or turn it off, when you want more coverage. --concurrency defaults to 5. It sets how many calls run at once, so it changes how long a scan takes, not what it costs. See below.

​
How the scan groups files into batches

The Agents phase does not send one call per file. Four rules decide the batches:
  • Each agent resolves to a candidate file list from its own file filter and the scan’s excludes.
  • Files past --max-files-per-agent (default 300) get dropped from this run. The scan keeps the first 300 in scan order.
  • A file with more matches than --max-anchors-per-batch (default 150) splits into more than one batch. One match-heavy file then cannot fill an entire prompt by itself.
  • The files that are left pack into batches of at most --max-files-per-batch (default 5).
Every batch from every queued agent lands in one shared queue, not a separate queue per agent. --max-batches (default 250) caps the total across the whole scan. Any batch past the cap runs on the next scan instead.

​
--concurrency bounds every phase from one pool

--concurrency (default 5) sets how many calls to the model can run at once, for the whole scan. It is one pool, not one pool per phase. Recon makes a single call on its own. Preconditions, Agents, Validate, Score, and De-duplicate all draw from the same pool instead, so a higher --concurrency never stacks across phases. It caps how many calls are in flight at any one moment. Because the pool is shared across agents, batches from different agents interleave in it. A slow agent’s batches do not delay a fast agent’s batches. A higher --concurrency speeds up a scan, because more calls run at once. It does not change how many calls a scan makes in total. It only trades wall-clock time for peak load on the model provider, not for cost.