Triage

Not every finding is worth acting on, and the ones that aren't shouldn't cost you anything twice. Triage records the verdict — true positive, false positive, or needs review — on the finding itself, so the decision survives the next scan and drives what a fix run is allowed to touch.

xgrep scan .                            # find
xgrep fix --triage-only --agent claude  # decide what's real, change nothing
xgrep fix apply --confirmed             # fix only what was confirmed

Recording a verdict

Three ways, all writing to the same place:

• In the review session — t, f, s on the selected finding.
• With an agent — xgrep fix --triage-only (below).
• By hand or from a script — xgrep triage set <fingerprint> <true-positive|false-positive|needs-review> [--rationale "…"].

The verdict lands in extra.triage on the finding in .xgrep/findings.json, keyed by fingerprint so it re-attaches after a re-scan:

"triage": {
  "reviewed": true,
  "status": "true-positive",
  "rationale": "uid flows unsanitized into execute()",
  "reviewed_by": "alice",
  "reviewed_at": "2026-07-01T10:30:00Z"
}

A scan never writes a verdict. Only a reviewer, an agent, or xgrep triage set does — and xgrep triage set is the only writer of the file, so an agent can record a hundred verdicts without ever holding the pen.

Headless review with an agent

--triage-only hands every un-reviewed finding to your coding agent in one read-only session and records what it decides. It applies nothing and never touches source — it is the false-positive review you'd otherwise do by hand before a build gate.

# Triage a scan report and emit the annotated result for the gate.
xgrep scan . --json | xgrep fix --triage-only --agent claude --json > triaged.json

# Or triage the cache in place, so a later fix run can read the verdicts.
xgrep scan .
xgrep fix --triage-only --agent claude

False positives drop out of the emitted report by default. A false-positive verdict is a suppression — the triage equivalent of an inline nosemgrep — so whatever gates or uploads downstream sees only findings the review kept. The cache still keeps the full set, false positives included with the agent's rationale, as the audit record. Pass --include-false-positives to keep them in the emitted report too.

Findings that already carry a verdict are skipped, so re-running costs nothing.

Fixing only what review confirmed

Verdicts change what a fix run does:

• By default, a finding marked false-positive is never auto-fixed. fix will not undo a call a reviewer made.
• With --confirmed, only findings marked true-positive are fixed. Un-reviewed and needs-review findings come back out-of-scope rather than being quietly touched.

xgrep fix apply --confirmed < triaged-findings.json

That pairs with the previous section into a two-step CI gate: --triage-only produces the verdicts, fix --confirmed acts only on the confirmed ones.