
scan
Scans the codebase to generate project-doc.md and AGENTS.md. Use when bootstrapping a new agent-driven repo, refreshing project documentation after architectural changes, or running a delta scan to detect drift. Runs a full scan on first use and a smart delta scan on subsequent runs. Uses understand-anything + context-mode when available, falls back to native tools otherwise. Only updates AGENTS.md on detected architectural changes with human confirmation.
- Installs
- 4.7K
- Last 24h
- +28
- Trending rank
- #4547
- Security
- Warn
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/wshobson/agents --skill scan- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads scan automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Codebase Scanner
You are a technical analyst. Your job is to scan the project codebase and produce accurate, project-specific documentation used by all downstream agents.
Step 1: Check Optional Plugin Dependencies
Check whether the two optional enhancement plugins are available:
understand-anything → /plugin list | grep understand-anything
context-mode → /plugin list | grep context-mode
These plugins are optional. They improve scan quality but are not required:
- understand-anything (Lum1104/Understand-Anything) — provides deeper semantic code analysis
- context-mode (mksglu/context-mode) — routes large outputs through a sandbox to protect the context window
If both are present, use them in Steps 3–4 as described below. If either or both are missing, proceed with the native fallback approach: use find, grep, cat, and git commands directly, routing large outputs through ctx_execute / ctx_execute_file if context-mode is available, otherwise summarise inline.
Note: To install the optional plugins manually:
/plugin marketplace add Lum1104/Understand-Anything && /plugin install understand-anything /plugin marketplace add mksglu/context-mode && /plugin install context-mode@context-mode
Step 2: Determine Scan Mode
Check if .claude/pipeline/project-doc.md exists.
- Does not exist → FULL SCAN (first run)
- Exists → DELTA SCAN
Step 3A: Full Scan
Use understand-anything to analyse the entire codebase. If context-mode is available (verified in Step 1), route ALL output through its tools (ctx_batch_execute / ctx_execute_file) — never dump raw file contents into the main context window. If context-mode is not available, summarise each file's findings inline and avoid printing raw file contents.
Produce .claude/pipeline/project-doc.md using the following structure (based on the architecture-blueprint-generator pattern):
# Project Documentation
> Generated: [timestamp] | Mode: FULL
## Tech Stack
- Runtime: [e.g. Node.js 20, Python 3.11]
- Language: [e.g. TypeScript, Python]
- Framework: [e.g. Next.js 14 App Router, FastAPI]
- Database: [e.g. PostgreSQL via Prisma]
- Styling: [e.g. Tailwind CSS]
- State Management: [e.g. Zustand, Redux]
## Dependencies
[Key libraries with versions, grouped by: core / dev / testing]
## Architecture Pattern
[e.g. Feature-based, Layered MVC, Clean Architecture]
[Describe how the project is structured and why]
## Folder Structure
[Top-level directory map with purpose of each folder]
## Code Style Conventions
[Naming patterns, file naming, import ordering, export patterns]
[Inferred from actual code — not guessed]
## Modularity Practices
[How concerns are separated, shared module locations, service patterns]
## Data Architecture
[Entity relationships, data access patterns, ORM usage]
## Cross-Cutting Concerns
[Auth/authz approach, error handling patterns, logging, validation]
## Service Communication
[REST / GraphQL / event-driven — document what actually exists]
## Test Coverage
- Overall coverage: [X%]
- Testing framework: [e.g. Jest, Vitest, Pytest]
- Key untested areas: [list]
- Test patterns used: [unit / integration / e2e]
## Entry Points
[Main files, key config files, environment setup]
## Changed Files
[Only present in delta scans — list of files re-scanned]
## Last Scanned
[ISO timestamp]
After writing project-doc.md, proceed to Step 4 to generate AGENTS.md.
Step 3B: Delta Scan
- Run
git diff HEAD~1 --name-onlyto get changed files - If no changed files, report "No changes detected — project-doc.md is current" and exit
- Use
understand-anythingto re-analyse only the changed files; route output throughctx_execute_fileif context-mode is available, otherwise summarise inline - Patch only the affected sections of
.claude/pipeline/project-doc.md - Update the
Last ScannedandChanged Filesfields - Proceed to Step 4B (architectural change detection)
Step 4A: Generate AGENTS.md (First Run Only)
Write AGENTS.md to the repo root. This is NOT a copy of project-doc.md — it is rewritten as agent instructions, tailored to this specific project. Every agent reads this file first.
Before writing AGENTS.md, read and follow the complete project-specific instruction template, including its security rules and human-confirmed update requirements.
If the project is MERN stack (MongoDB + Express + React + Node.js — detected from package.json / requirements), append a ### MERN Stack Notes section to AGENTS.md covering: use Mongoose middleware over raw queries, handle async errors in Express with a central error handler, avoid storing JWT tokens in localStorage (use httpOnly cookies), and never expose Mongoose error objects directly in API responses.
Step 4B: Architectural Change Detection (Delta Runs Only)
After patching project-doc.md, compare the new version against the previous. Check for:
- New framework or major library added
- New architectural directory pattern created (e.g. new
/lib/hooks/,/services/) - Major dependency swap (e.g. axios → fetch, moment → dayjs)
- New auth or session handling pattern
If any detected, show:
⚠️ Architectural change detected in delta scan:
[List specific changes found]
AGENTS.md may need updating. Review and confirm:
[y] Update AGENTS.md — patch affected sections only
[n] Skip — this is not an architectural change
Only on [y] confirmation: patch the relevant sections of AGENTS.md. Never rewrite the full file.
Step 5: Report
Print a summary:
✅ Scan complete ([FULL/DELTA])
project-doc.md → updated
AGENTS.md → [generated / patched / unchanged]
Changed files → [N files re-scanned / N/A for full scan]
Coverage → [X%]
Update state.json field checkpoints.scan = "completed".
FAQ
What does the scan skill do?
Scans the codebase to generate project-doc.md and AGENTS.md. Use when bootstrapping a new agent-driven repo, refreshing project documentation after architectural changes, or running a delta scan to detect drift. Runs a full scan on first use and a smart delta scan on subsequent runs. Uses understand-anything + context-mode when available, falls back to native tools otherwise. Only updates AGENTS.md on detected architectural changes with human confirmation.
How do I install scan?
Run npx skills add https://github.com/wshobson/agents --skill scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/scan/ (personal) or .claude/skills/scan/ (project).
Which AI agents can use scan?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is scan safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket flagged items to review; Snyk passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains scan?
It is published by wshobson in wshobson/agents. It has 4,664 recorded installs.
More from wshobson/agents
typescript-advanced-types
wshobson/agents
Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications. Use when implementing complex type logic, creating reusable type utilities, or ensuring compile-time type safety in TypeScript projects.
tailwind-design-system
wshobson/agents
Build scalable design systems with Tailwind CSS v4, design tokens, component libraries, and responsive patterns. Use when creating component libraries, implementing design systems, or standardizing UI patterns.
nodejs-backend-patterns
wshobson/agents
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.
brand-landingpage
wshobson/agents
Brand-first landing page designer — runs a brand-identity interview (colors, typography, shape language), then generates and iterates on a polished landing page via Stitch with deployment-ready HTML. Use when the user asks to create, design, or build a landing page, homepage, or marketing page and has no established visual direction. Skip when they have a design mockup, need a dashboard or app UI, are working at component level, building a multi-page app, or restyling with known design tokens — use frontend-design instead.
python-testing-patterns
wshobson/agents
Implement comprehensive testing strategies with pytest, fixtures, mocking, and test-driven development. Use when writing Python tests, setting up test suites, or implementing testing best practices.
python-performance-optimization
wshobson/agents
Profile and optimize Python code using cProfile, memory profilers, and performance best practices. Use when debugging slow Python code, optimizing bottlenecks, or improving application performance.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.