Home / Help centre / Workspace settings
Workspace settings
What is a self-hosted scan agent, and when do I need one?
A self-hosted scan agent is a container you run inside your own network. It scans internal apps and private repositories that the Cyberlop cloud cannot reach, and it talks to Cyberlop over outbound HTTPS only. Choose one when your target is closed to the internet.
The short version
A scan agent is a small container you run inside your own network. It lets Cyberlop test apps and read repositories that the Cyberlop cloud cannot reach. Only a private target calls for one.
How it works in Cyberlop
By default a scan runs in the Cyberlop cloud. The cloud clones the repository and visits the live URL from Cyberlop's own systems. That fails for an internal pre-production app, a repository behind a VPN, or any environment closed to the internet.
With an agent, the work moves to your side. The agent asks Cyberlop for queued jobs over outbound HTTPS, clones the repository and reaches the target locally, then runs the same five-phase pipeline as a cloud scan. Results stream back, so the scan looks identical in the app. Cyberlop never connects inward, and your code stays on your network.
| Your target | Scan location |
|---|---|
| Public URL, public or private repo with a Git token | Cyberlop cloud (default) |
| Internal URL or repo that the cloud cannot reach | A scan agent |
Agents belong to Settings → Scan Agents. Your plan must include internal scan agents, which the Plan & usage tab lists as a feature.
What to do next
Add an agent, run the command it gives you on a machine inside the network, and wait for the status to read online. Then open the scan profile and set Scan location to that agent.
Start with how to add a scan agent and how to run the container. For the privacy side, read whether your code leaves your network. See also private scanning.
Related questions
- How do I add a self-hosted scan agent?
- Where and how do I run the scan agent container?
- What network access does a scan agent need?
- Does my code leave my network when I use a scan agent?
- My app is only reachable inside our network, so cloud scans can't reach it. What do I do?
Cyberlop self-hosted scan agents: scan private apps from inside your network
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.