dataparade.config.json

Optional project config at the scan root (the directory you pass to scan <path>). The CLI loads it when present and merges it with environment variables and scan flags.

Precedence

1. CLI flags override env and config.
2. Environment variables override the config file for overlapping fields.
3. Config file overrides built-in defaults.

Unknown or invalid fields cause a clear error when you run scan.

Minimal example

{
  "projectName": "my-service",
  "excludePaths": ["node_modules", "dist", ".git"],
  "minimumConfidence": 0.6,
  "enableAPIDetection": true,
  "enableDatabaseDetection": true,
  "enableDataFlowDetection": true
}

dataparade config command

Prints the effective scan configuration as JSON. Optional project path: dataparade config [path] (default: current working directory). When [path] is a file, config loads from that file’s parent directory (same as scan). When SCAN_BYOK_API_KEY or config aiApiKey is set, the printed value is <redacted> so keys do not leak into logs.

Default excludes

In addition to directory skips (node_modules, .git, test trees, etc.), these file globs are excluded unless you deliberately narrow excludes (they are prepended to excludePaths):

• **/.env, **/.env.*, .env, .env.* — secret-bearing env files are not scanned and are never embedded in AI provider prompts.
• Common test/story spec patterns (*.spec.ts, *.test.ts, *.stories.*, Playwright config, etc.) — see cli/src/patterns/scan-exclusions.ts in the repository.

You can add more patterns with excludePaths in config or --exclude on the command line.

Field reference

Scan and detection

• projectName (string, optional) — Override inferred application/project label. Same as --project-name.
• excludePaths (string[], optional) — Glob-like excludes. Merged with built-in defaults.
• minimumConfidence (number, optional) — Confidence threshold in [0, 1]. Same as --minimum-confidence.
• enableAPIDetection (boolean, optional) — Include API-route/auth detections.
• enableDatabaseDetection (boolean, optional) — Include DB detections.
• enableDataFlowDetection (boolean, optional) — Run flow detection and rewiring.
• languages (("typescript" | "javascript" | "json" | "yaml" | "env" | "python" | "terraform")[], optional) — Language allow-list. Note: .env files are excluded from default ingest even when env is listed; use process.env.* patterns in source files instead.
• deepAnalysis (boolean, optional) — Enable deeper analyzer heuristics. Same as --deep-analysis.

Terraform

• terraformJsonPath (string, optional) — Same as --terraform-json (merge saved terraform show -json output; path must resolve under the scan root).
• terraformPlanPath (string, optional) — Same as --terraform-plan (run terraform show -json on the given plan file from scan root; path must resolve under the scan root).
• Terraform stack sections (on by default) — When the scan root contains HCL *.tf files and terraformStackSectionPathDepth is unset, the CLI infers path depth N from main.tf layout and registers matching directories as service sections (Terraform findings are tagged there instead of root). No config or flags required for typical monorepos.
• terraformStackSectionPathDepth (number, optional) — Override inferred depth with a fixed N (exactly N POSIX path segments from scan root). Example: terraform/deployments/my-service → 3; or scan from terraform/deployments with 1 for one section per child stack.
• autoInferTerraformStackSectionPathDepth (boolean, optional, default true) — Set false in config or pass --no-terraform-stack-section-auto to disable Terraform-only sections entirely.

Monorepo sections

• Monorepo package sections (on by default) — Default workspace depth is 2 (packages/twenty-server, packages/twenty-apps, …). Override with monorepoPackageSectionPathDepth or --monorepo-package-section-path-depth (e.g. 3 for one hub per packages/twenty-apps/<app>). Set autoInferMonorepoPackageSectionPathDepth: false and omit depth to infer from layout only.
• monorepoPackageSectionPathDepth (number, optional) — Workspace package section depth for primary packages and finding rollup.
• autoInferMonorepoPackageSectionPathDepth (boolean, optional) — When false and depth is unset, infer from package.json layout only.

AI inference

See AI inference for behavior. Config keys mirror flags and env vars:

• enableAiInference (boolean, optional) — Enable post-scan AI inference. Default: on. Set false (or use --no-ai-inference / SCAN_AI_INFERENCE=false) for structural-only scans.
• aiProvider ("openai" | "anthropic" | "gemini" | "openrouter" | "local" | "mock", optional) — Model provider preset.
• aiModel (string, optional) — Model identifier sent to provider.
• aiApiKey (string, optional) — BYOK API key (prefer SCAN_BYOK_API_KEY in env for secrets).
• aiEndpoint (string, optional) — Override provider endpoint URL.
• aiTemperature (number, optional) — Temperature in [0, 2].
• aiMaxTokens (number, optional) — Max output tokens requested per call.
• aiMaxModelCalls (number, optional) — Max provider calls per planned queue.
• aiBudgetTokens (number, optional) — Estimated token budget per planned queue.
• aiMaxCandidatesPerAgent (number, optional) — Per-agent queue cap (0 means unlimited).
• aiProviderConcurrency (number, optional) — Max in-flight provider calls for batched enrichment queues (default 4). Platform-billed scans (DATAPARADE_WORKSPACE_API_KEY) always use 1 because the hosted API HTTP gateway times out at 30s per request.
• aiInferenceScope ("default" | "third_party_only", optional) — Constrain inference scope.
• aiVerbose (boolean, optional) — Print per-proposal AI details (same as --ai-verbose).
• aiToolLoopMaxRounds, aiToolLoopMaxFiles, aiToolLoopMaxSearches — Tool-loop tuning (see AI inference).
• aiThirdPartyDataFlowEnabled (boolean, optional) — Emit metadata.aiInference.thirdPartyDataFlow when AI runs.

For the full env var list, see Environment variables.