> ## Documentation Index > Fetch the complete documentation index at: https://docs.agentgg.dev/llms.txt > Use this file to discover all available pages before exploring further. # How a scan runs > The phases in order, how batches form, and how `--concurrency` bounds every phase from one pool. A scan runs through a fixed set of phases. Each phase finishes before the next one starts. Every phase records what it did under `state/`, so a killed scan can pick up close to where it stopped. See [Output and state](/cli/output-and-state) for that layout. ## The phases | Phase | What happens | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Recon | Runs once. Reads the project and writes a brief on its languages, frameworks, and integrations. Every later phase uses this brief. | | Preconditions | Checks each selected agent against the recon brief and the file tree, then decides which agents to queue. Writes every decision before any agent starts. | | Agents | Each queued agent reads its file set in batches and reports findings. This is the only phase where several agents run at once. | | Validate | Re-reads the source for each finding and marks it confirmed, false positive, out of scope, or uncertain. | | Score | Rates each finding the validator did not reject with a CVSS (Common Vulnerability Scoring System) 3.1 base score. | | De-duplicate | Groups findings in one file that share a root cause under a single primary finding. | | Report | Writes `summary.md` and one file per finding. Makes no calls to the model. | Report is optional. The Agents phase is not. Turn off Validate, Score, De-duplicate, or Report with `--no-validate`, `--no-score`, `--no-dedup`, or `--no-summary`. `--no-recon` turns off Recon and Preconditions together and queues every named agent with no check. Full flag list: [Scan flags](/cli/reference/scan-flags). What makes a phase skip work it already did is a separate topic. See [Resume and reports](/cli/resume-and-reports). ## Default scan `agentgg scan .` runs a complete scan with no configuration. This is what it does. | Default | Override with | | -------------------------------------------------------------------------- | ----------------------------------------------------------- | | Every agent category runs except `deep/` | `-t ` to pick your own | | Recon and Preconditions run | `--no-recon` | | Validate, Score, De-duplicate, and Report all run | `--no-validate`, `--no-score`, `--no-dedup`, `--no-summary` | | Duplicates are marked, not deleted | `--delete-duplicates` to remove them | | A bundled trust-boundary scope applies during Validate | `--no-scope`, or `--scope ` for your own | | The model picks non-runtime folders to skip | `--no-auto-exclude` | | A shared exclude set skips `node_modules`, `.git`, lockfiles, and binaries | `--no-default-excludes` | | A re-run into the same output directory resumes | `--rescan` to re-analyze every file | | Results are written to `./scan-results/` | `-o ` | The bundled scope covers the trust boundaries most projects share. It stops the validator from reporting code that no boundary makes reachable, which cuts false positives. Pass `--scope ` to apply rules of your own. See [Validate findings and set scope](/cli/guides/validation-and-scope). The limits below control what a scan costs. Each one caps how much work the scan sends to the model, so a large repository stays predictable. Raise any of them, or turn it off, when you want more coverage. | Limit | Default | | ------------------------- | ------- | | `--max-file-size` | 500 KB | | `--max-files-per-batch` | 5 | | `--max-anchors-per-batch` | 150 | | `--max-files-per-agent` | 300 | | `--max-batches` | 250 | `--concurrency` defaults to 5. It sets how many calls run at once, so it changes how long a scan takes, not what it costs. See below. ## How the scan groups files into batches The Agents phase does not send one call per file. Four rules decide the batches: * Each agent resolves to a candidate file list from its own file filter and the scan's excludes. * Files past `--max-files-per-agent` (default 300) get dropped from this run. The scan keeps the first 300 in scan order. * A file with more matches than `--max-anchors-per-batch` (default 150) splits into more than one batch. One match-heavy file then cannot fill an entire prompt by itself. * The files that are left pack into batches of at most `--max-files-per-batch` (default 5). Every batch from every queued agent lands in one shared queue, not a separate queue per agent. `--max-batches` (default 250) caps the total across the whole scan. Any batch past the cap runs on the next scan instead. ## `--concurrency` bounds every phase from one pool `--concurrency` (default 5) sets how many calls to the model can run at once, for the whole scan. It is one pool, not one pool per phase. Recon makes a single call on its own. Preconditions, Agents, Validate, Score, and De-duplicate all draw from the same pool instead, so a higher `--concurrency` never stacks across phases. It caps how many calls are in flight at any one moment. Because the pool is shared across agents, batches from different agents interleave in it. A slow agent's batches do not delay a fast agent's batches. A higher `--concurrency` speeds up a scan, because more calls run at once. It does not change how many calls a scan makes in total. It only trades wall-clock time for peak load on the model provider, not for cost.