agentgg init | Runs the one-time setup wizard. Pick a provider and add credentials. Run it again to merge in another provider. |
agentgg recon <path> | Runs only the recon survey and precondition plan for <path>. Writes recon.json and plan.json to --output. Runs no detection. |
agentgg scan <path> | Finds, de-duplicates, validates, scores, and reports vulnerabilities in <path>, and writes a suggested fix for each confirmed finding. Supports --diff to scan only one commit’s changes. |
agentgg status [output-dir] | Prints a summary for [output-dir]: file counts, finding counts, duplicates, validation verdicts, and recent runs. A run that is still in progress shows its stage. Pass --json for machine-readable output. |
agentgg revalidate [output-dir] | Runs the validation phase again on findings already on disk. Skips detection. Use it to validate with a different model or scope. It writes no suggested fixes, so run agentgg fix after it. |
agentgg live-validate [output-dir] | Tests findings already on disk against a running application. Needs --target-url and Docker. Skips a finding that already has a live result, unless you pass --force. |
agentgg score [output-dir] | Runs a standalone CVSS 3.1 score pass on persisted findings. The agent picks 8 base metrics. A fixed formula sets the score and severity. Pass --include-disqualified to also score findings the verdict rejects. |
agentgg fix [output-dir] | Writes a suggested fix for each confirmed finding on disk that has none. Pass --force to write every fix again. |
agentgg dedup [output-dir] | Finds duplicate findings on disk and groups them under one primary finding. If validation rejected a primary, a surviving duplicate takes its place. Pass --delete-duplicates to remove the duplicates instead of a marker. |
agentgg create | Turns a past security report into a reusable agent file for the same codebase. Takes -c, -r, and -o. Install with agentgg agents add. |
agentgg summary [output-dir] | Writes summary.md and the finding files from persisted findings. No LLM call runs. Use it after a scan run with --no-summary. |
agentgg view [output-dir] [port] | Starts a local web UI on [output-dir]. The default port is 3737. |
agentgg agents list | Lists installed agents from the catalog and the custom folder. Pass --json for machine-readable output. |
agentgg agents info <slug> | Prints one agent’s full metadata and prompt text. |
agentgg agents add <file-or-dir> | Installs an agent file, or every .md file in a directory, into ~/.agentgg/agents/custom/. |
agentgg agents remove <slug> | Removes one custom agent by its slug. |
agentgg agents update | Downloads the latest official agent catalog into ~/.agentgg/agentgg-agents/. |
agentgg agents install <ref> | Installs the official agent catalog at one exact version: a version number, a release tag, a commit SHA, or a branch name. |
agentgg agents lint [path] | Checks an agent tree for unique slugs, correct filenames, a valid schema, and regex patterns that compile. |
agentgg config | Prints the saved config, with secrets masked. Pass --provider and --model to change the default provider or model. Pass --openrouter-routing to save the default OpenRouter routing. |
