# Recon history scanning

Turn supported Claude Code and Cursor history into reviewable policy recommendations.

Updated: 2026-09-22

Canonical: https://docs.kastra.ai/policies/recon

## Supported history

Recon turns Claude Code and Cursor history into policy recommendations you can review and test. Codex history scanning is coming soon. Keep Edge up to date and review the consent prompt for the history sources included in your installation.

## What Recon reads

Recon scans supported local Claude Code and Cursor history. It finds candidate actions, redacts on the device, and uploads redacted summaries for server-side analysis. It is not a scan of every application or every action on the machine.

## Run a scan

After an Edge login:

```sh
kastra-edge scan
```

Read and complete the scan consent prompt. The consent version changes when new history locations are introduced. A one-shot scan reads the current supported backlog; incremental scan watermarks are scoped to the workspace.

For ongoing collection:

```sh
kastra-edge scan --watch --interval 30m
```

Use watch mode only after understanding the collection scope. The console can also request a scan from a participating desktop daemon; that depends on the device's remote-scan configuration and availability.

## Review recommendations

Open Recommendations in the console. Inspect the source, masked example, proposed rule, and test results. Choose the target environment and review the policy before installation. Recon does not silently activate recommendations.

## Interpret empty and partial results

“No new activity” is not the same as a clean full-history scan. A previous desktop scan may already have advanced the workspace watermark. Unreadable surfaces and candidate limits can leave gaps. A remote scan job can finish as `completed_degraded` with `unread_surfaces`; this means some data was uploaded while at least one surface went unread. Inspect warnings and coverage rather than converting missing data into zero risk.

## Privacy boundary

On-device redaction reduces what is uploaded; it does not mean all analysis runs locally or that every sensitive format is detected. Read [data handling](https://docs.kastra.ai/evidence/data-handling) before enabling fleet scans.