diff --git a/packages/cli/src/commands/scan-commands.ts b/packages/cli/src/commands/scan-commands.ts
index 2c19bcdf..0fd9b225 100644
--- a/packages/cli/src/commands/scan-commands.ts
+++ b/packages/cli/src/commands/scan-commands.ts
@@ -39,7 +39,7 @@ function parseConnectionId(value: string): string {
 
 export function registerScanCommands(program: Command, context: KtxCliCommandContext): void {
   program
-    .command('scan')
+    .command('scan', { hidden: true })
     .description('Run a standalone connection scan')
     .argument('<connectionId>', 'KTX connection id to scan', parseConnectionId)
     .option(
diff --git a/packages/cli/src/index.test.ts b/packages/cli/src/index.test.ts
index 50b4c714..d858442a 100644
--- a/packages/cli/src/index.test.ts
+++ b/packages/cli/src/index.test.ts
@@ -124,9 +124,10 @@ describe('runKtxCli', () => {
 
     expect(testIo.stdout()).toContain('Usage: ktx [options] [command]');
     expect(testIo.stdout()).toContain('KTX data agent context layer CLI');
-    for (const command of ['setup', 'connection', 'ingest', 'wiki', 'sl', 'status', 'scan']) {
+    for (const command of ['setup', 'connection', 'ingest', 'wiki', 'sl', 'status']) {
       expect(testIo.stdout()).toContain(`${command}`);
     }
+    expect(testIo.stdout()).not.toMatch(/^  scan\s/m);
     for (const removed of ['demo', 'init', 'connect', 'ask', 'knowledge', 'agent', 'completion', 'serve']) {
       expect(testIo.stdout()).not.toMatch(new RegExp(`^\\s+${removed}(?:\\s|\\[|$)`, 'm'));
     }