Quickstart

Set up a provider

agentgg init

Pick a provider and paste a credential.

Run a scan

agentgg scan ./src -o ./out

The dedup, validate, score, and fix phases run by default.

Read the status

agentgg status ./out

Read what the scan found.

Browse the findings

agentgg view ./out

Browse the findings in a local web UI.

Scan only what changed

To scan only the files a pull request changed, see Scan a pull request.

Where the findings go

A scan writes its findings to the output directory.

out/
├── summary.md               ← human report
├── findings/
│   ├── <name>.md            ← one .md per finding (GHSA-shaped)
│   └── <name>/              ← live validation evidence for that finding
└── state/                   ← what `status` and `revalidate` read
    ├── scan.json            ← root path + timestamps
    ├── recon.json           ← the recon brief (phase 1)
    ├── plan.json            ← which agents queued / skipped + why (phase 2)
    ├── usage.json           ← tokens the model calls used
    ├── runs/<id>.json       ← one per command run on this directory
    ├── agents/<slug>.json   ← per-agent resume sidecar
    └── files/<slug>/<path>.json ← FileRecord per agent and source file

Read more about this directory on the output and state page.

Get started

Concepts

Guides

Providers

Reference

Help

Where the findings go

​Where the findings go

Where the findings go