Skip to Content
CLI Run and ExportScan arguments

Scan arguments

Everything after scan is either the positional scan root or options (flags). Options can appear in any order before or after the path, as supported by the CLI parser.

Positional

  • <path> — Project directory to scan. Resolved relative to the shell’s current working directory. The resolved directory is the scan root: ingest walks from here, and dataparade.config.json is loaded from this folder when present.

Flags

  • -o, --output <file> — Write the dataflow.json wrapper to this path. Default: ./dataflow.json relative to the process current working directory (where you run the command), not necessarily <path>.

  • --exclude <pattern...> — One or more glob patterns to skip during ingest (for example dist or **/vendor/**). Repeatable; you can pass multiple patterns in one --exclude or use --exclude multiple times, depending on your shell and how you quote arguments. These merge with built-in excludes (tests, Storybook, .env / .env.*, etc.); see Environment variables.

  • --minimum-confidence <number> — Minimum detection confidence in the inclusive range 0–1. Findings below this threshold are dropped.

  • --language <language...> — Restrict analysis to specific languages. Supported values include typescript, javascript, python, and terraform. Each value is matched case-insensitively. Unknown names are ignored; if none remain valid, there is no language filter. Example: scan only a Kubernetes Terraform folder — --language terraform.

  • --terraform-json <path> — Merge resource addresses from a saved terraform show -json file (path relative to the scan root, or absolute only if the resolved file stays under the scan root). Paths outside the scan root are rejected with a warning. Supplements static .tf parsing.

  • --terraform-plan <path> — Run terraform show -json <path> from the scan root and merge addresses from a plan file (requires the terraform CLI on PATH). The plan path must resolve under the scan root (same containment rule as --terraform-json); paths outside the root are rejected with a warning.

  • --terraform-stack-section-path-depth <n> — Optional override for Terraform stack section depth (fixed segment count from scan root). Normally you do not need this: the CLI infers depth from .tf layout by default.

  • --no-terraform-stack-section-auto — Disable default Terraform stack sectioning (no Terraform-only sections).

  • --monorepo-package-section-path-depth <n> — Workspace package section depth for primary packages and finding rollup (POSIX segments from scan root). Defaults to 2 when unset in config; overrides the default (e.g. 3 for packages/twenty-apps/hello as a primary package). Omit depth and set autoInferMonorepoPackageSectionPathDepth: false in config to infer from layout only.

  • --no-monorepo-package-section-auto — Do not infer monorepoPackageSectionPathDepth from package.json layout when depth is unset.

  • --project-name <name> — Override the inferred name used for the main application asset in the output graph.

  • --deep-analysis — Boolean flag (no value). Enables deeper, potentially slower structural analysis where the pipeline supports it.

  • --ai-inference / --no-ai-inference — Boolean flags. Inference is on by default. Use --no-ai-inference (or SCAN_AI_INFERENCE=false) for structural-only scans. See AI inference.

  • --ai-provider <provider> — Model provider when AI inference is enabled: openai, anthropic, gemini, openrouter, local (Ollama-compatible), or mock (no real network calls).

  • --ai-model <model> — Model identifier passed to the provider (for example gpt-4o-mini).

  • --ai-endpoint <url> — Override the HTTP endpoint for the selected provider (shared override; see the CLI README for default URLs per provider).

  • --ai-temperature <number> — Sampling temperature for provider calls.

  • --ai-max-tokens <number> — Cap on output tokens requested per inference call.

  • --ai-max-calls <number> — Maximum provider calls allowed for the scan’s inference queues.

  • --ai-budget-tokens <number> — Estimated token budget for inference; used to stop scheduling further provider calls when the budget is exhausted.

  • --ai-max-candidates-per-agent <number> — Maximum inference queue items per agent; 0 means no cap (built-in default in config is often 25 unless overridden).

  • --ai-inference-scope <scope> — default — full enrichment scope. third_party_only — run AI enrichment only on third-party nodes (also accepted with underscores/hyphens normalized by the CLI).

  • --ai-verbose — Boolean flag. Prints per-proposal AI details (applied vs rejected, evidence references, property changes when applied) and extra token usage totals after the summary line.

  • --workspace-api-key <key> — DataParade workspace API key for upload/auto-upload, quota preflight, platform LLM proxy, and usage reporting (DATAPARADE_WORKSPACE_API_KEY). Platform-paid LLM runs when inference is enabled (default). See Workspace scan quota and Upload to dashboard.

  • --skip-auto-upload — Boolean flag. Do not upload dataflow.json to the dashboard after a successful scan (DATAPARADE_SKIP_AUTO_UPLOAD).

  • --byok-provider, --byok-model — Your own LLM provider when not using platform AI (SCAN_BYOK_* env vars).

Config-only AI fields (no CLI flags yet): aiToolLoopMaxRounds, aiToolLoopMaxFiles, aiToolLoopMaxSearches, aiThirdPartyDataFlowEnabled, and aiProviderConcurrency — see AI inference and Environment variables.

The same scan settings can be supplied through dataparade.config.json at the scan root and environment variables; flags win over env, and env wins over the config file. Invalid merged configuration (for example non-numeric --ai-temperature) fails before the scan runs with exit code 2 and a list of validation errors.

Terraform stack sections are enabled by default (depth inferred from .tf files); use terraformStackSectionPathDepth in config only to override. Monorepo package sections are also on by default: multiple package.json files trigger workspace depth inference (typically packages/*), name-based labels, and rollup of nested packages to that depth. Override with monorepoPackageSectionPathDepth or disable with autoInferMonorepoPackageSectionPathDepth: false. The full dataparade.config.json field reference is in dataparade.config.json.

Workspace scan quota

Structural-only CLI scans (the default) never use quota. Hosted scans from the DataParade app (GitHub, GitLab, or zip upload) and CLI scans with platform AI share your active workspace quota:

  • 3 completed scans by default (lifetime, overridable per workspace)
  • 1,000,000 platform AI tokens by default when AI runs on DataParade infrastructure

The dashboard shows remaining scans and tokens before you start a scan.

CLI scans with a DataParade workspace API key (--workspace-api-key or DATAPARADE_WORKSPACE_API_KEY) call the live API for quota preflight, platform LLM inference (POST /api/scans/cli/ai/infer), and completion reporting when AI inference is enabled (default; disable with --no-ai-inference / SCAN_AI_INFERENCE=false). If you use your own provider credentials (SCAN_BYOK_PROVIDER, SCAN_BYOK_MODEL, SCAN_BYOK_API_KEY), quota checks are skipped.

If a workspace API key is present but AI inference is off (structural-only scan), the CLI runs locally and does not call quota preflight/complete. The same key can still auto-upload dataflow.json after the scan (Upload to dashboard); upload does not use quota.

When quota blocks a CLI preflight, the CLI prints [scan] workspace quota: … (for example No scan slots remaining in this workspace.) instead of starting the scan. Failed CLI runs that used preflight do not consume a scan slot.

See Workspace scan quotas for limits, deductions, and Activity/Usage.

Legacy names (--api-key, DATAPARADE_API_KEY, DATAPARADE_AI_*) still work for one release with deprecation warnings.

Security defaults

  • .env files — .env and .env.* are excluded from default ingest and are never embedded in provider prompts when AI runs. Scanning a single .env file path is also skipped with a security warning.
  • AI default on — Inference runs by default. Opt out with --no-ai-inference, SCAN_AI_INFERENCE=false, or "enableAiInference": false in config.
  • Custom endpoints — --ai-endpoint / SCAN_AI_ENDPOINT may target any URL; prompts include bounded excerpts from scanned files—use only on code you would send to that endpoint.
  • Terraform paths — --terraform-plan and --terraform-json must stay under the scan root; treat plan/state files as sensitive.
  • dataparade config [path] — Prints effective settings for the project at [path] (default: shell cwd); aiApiKey / SCAN_BYOK_API_KEY appear as <redacted> in JSON output.
  • Provider HTTP — Default timeout 120s; override with SCAN_AI_HTTP_TIMEOUT_MS (Environment variables).
  • Evidence paths — Provider proposals must reference exact repo-relative paths from the scan (no fuzzy path matching).

For the YAML rules that drive what the scan detects and classifies, see Scan patterns. For what the scan writes to disk, see Output and results.

Last updated on
Scan patternsdataparade.config.json