Scan Modes

LLM Armor has three scan modes that control what is flagged and what is shown.

Normal mode (default)

llmarmor scan ./src

Focuses on high-confidence findings only. Minimises false positives so every result is actionable.

Strict mode

llmarmor scan ./src --strict

Flags everything that could be a risk, including borderline patterns. Recommended for pre-release security audits and compliance reviews.

Additional findings in strict mode:

Pattern	Severity	Rationale
Tainted variable as system role content	MEDIUM	User controls the entire system instruction
Tainted variable as user role content	LOW	Consider input validation and content filtering
Hardcoded system prompt in source code	MEDIUM	May leak proprietary instructions
json.loads() with LLM-named variable	MEDIUM	Deserialising unvalidated LLM output is risky
Broad agent tool descriptions	MEDIUM	May indicate missing explicit allowlist

Verbose mode

llmarmor scan ./src --verbose

Shows all findings including INFO and LOW severity. Useful for getting a complete picture during security audits.

Combining modes

# Maximum coverage and visibility
llmarmor scan ./src --strict --verbose