Where and how do I run the scan agent container?

Steps

You get the command when you click Add agent. Read how to add a scan agent if you have not done that yet.

STEPS

What the agent does

The agent asks Cyberlop for queued jobs over an outbound long-poll. When it gets one, it clones the repository and reaches the target from inside your network. It boots a local single-node engine and runs the same five-phase pipeline a cloud scan runs. Live logs, cost and findings stream back, so the scan looks the same in the app.

Good to know

Only outbound 443 to app.cyberlop.com is required. You make no firewall changes and open no inbound ports. Cyberlop never connects inward, and your code and target never leave your network.

On first start, the agent swaps the one-time token for a durable agent key and caches it locally. Keep that cache if you restart the container, so it can carry on without a new token.

An agent that stops sending heartbeats shows as offline. Start the container again and check the status. For more on states, read what pending, online and offline mean.

Ask your network team for a stable host. A laptop that sleeps makes a poor agent. Need a hand? Use the contact page.

Think about who owns the host. A container that scans your internal staging app will hold a copy of the source during a scan, so place it where your normal controls apply, such as logging, patching and access limits. Treat it like any other build machine. It is yours to run.

Related questions

• How do I add a self-hosted scan agent?
• What network access does a scan agent need?
• How do I see whether my scan agent is online?
• What is a self-hosted scan agent, and when do I need one?
• I lost the agent enrollment token. Can I get it again?

Full tutorial

Cyberlop self-hosted scan agents: scan private apps from inside your network

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre