Quickstart

Set up a provider

agentgg init

Pick a provider and paste a credential.

Run a scan

agentgg scan ./src -o ./out

The validate, score, and dedup phases run by default.

Read the status

agentgg status ./out

Read what the scan found.

Browse the findings

agentgg view ./out

Browse the findings in a local web UI.

Scan only what changed

To scan only the files a pull request changed, see Scan a pull request.

Where the findings go

A scan writes its findings to the output directory.

out/
├── summary.md            ← human report
├── findings/...          ← one .md per finding (GHSA-shaped)
└── state/                ← what `status` and `revalidate` read
    ├── scan.json         ← root path + timestamps
    ├── recon.json        ← the recon brief (phase 1)
    ├── plan.json         ← which agents queued / skipped + why (phase 2)
    ├── runs/<id>.json    ← one per scan / recon / revalidate / score / summary
    ├── agents/<slug>.json← per-agent resume sidecar
    └── files/<path>.json ← FileRecord per scanned source file

Read more about this directory on the output and state page.

Get started

Concepts

Guides

Providers

Reference

Help

Where the findings go

​Where the findings go

Where the findings go