I also would not scan the whole classpath, but limit ourselves to the packages of the classes we process. This does not require us to depend on anything passed to us either. We basically just "check" the package of all the classes we process.