Home / Help centre / Workspace settings
Workspace settings
What network access does a scan agent need?
Outbound HTTPS on port 443 to app.cyberlop.com is the one link a scan agent needs, plus Docker and access to the target it scans. It needs no inbound ports and no incoming firewall rules, because Cyberlop never connects to it.
The short version
A scan agent needs outbound HTTPS to app.cyberlop.com on port 443. That is the only link to Cyberlop it needs. You open no inbound ports and change no firewall rules for incoming traffic.
How it works in Cyberlop
Your agent calls out to Cyberlop and asks for work, a pattern called a long-poll. Cyberlop never dials in. Ever. When a job arrives, the agent does its scanning on your side, so it also needs to reach what it scans.
| From the agent's machine | Needed? |
|---|---|
Outbound 443 to app.cyberlop.com | Yes |
| Inbound ports from the internet | No |
| Docker, to run the container | Yes |
| Access to the target's URL | Yes |
| Access to the Git repository over HTTPS | Yes, for white-box targets |
Put the agent on a machine inside the target's network. One machine may see the app but not reach Cyberlop, so the agent stays stuck. Another may reach Cyberlop but not the app, so it cannot scan. Check both directions before you start.
For a private repository, the agent clones with a Git token, so check your Git Access settings and the allowed hosts list as well.
What to do next
Before you run the command, test the outbound connection from that machine. Proxies that block or rewrite HTTPS traffic often cause trouble, so ask whoever runs your network what the proxy allows. Do this first.
If the status stays on pending, read why an agent is stuck on pending. For the run command, see running the agent container. Still stuck? Write to us via the contact page.
Related questions
- Where and how do I run the scan agent container?
- What is a self-hosted scan agent, and when do I need one?
- Why is my scan agent stuck on pending?
- Why does my scan agent show as offline?
- Does my code leave my network when I use a scan agent?
Cyberlop self-hosted scan agents: scan private apps from inside your network
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.