> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps Server Setup for Local Code Scanning

> Use the CybeDefend CLI to integrate local scans into an on-prem Azure DevOps Server pipeline.

Run **CybeDefend** scans in your on-prem **Azure DevOps Server** pipeline, maintaining code on your own infrastructure while benefiting from automated security checks.

## Prerequisites

* **Personal Access Token (PAT)**: [Create one](/latest/code-scanning/local-code-scanning/introduction-api-key) in your CybeDefend profile and store it as `CYBEDEFEND_PAT` in Azure DevOps.
* **Agent Permissions**: Ensure your self-hosted agent can install or run the CybeDefend CLI.
* **Azure DevOps Access**: Sufficient rights to modify your pipeline definition.

<Note>
  Make sure the agent’s OS matches one of our supported CLI binaries (Windows, Linux, or macOS).
</Note>

***

## Example azure-pipelines.yml

```yaml theme={null}
trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self
  - script: |
      curl -L https://github.com/CybeDefend/cybedefend-cli/releases/download/v1.0.0/cybedefend-linux-amd64 -o cybedefend
      chmod +x cybedefend
      sudo mv cybedefend /usr/local/bin/
    displayName: 'Install CybeDefend CLI'

  - script: |
      cybedefend scan --dir . \
        --ci \
        --project-id $(CYBEDEFEND_PROJECT_ID)
    displayName: 'Run CybeDefend Scan'
    env:
      CYBEDEFEND_PAT: $(CYBEDEFEND_PAT)
```

### Explanation

1. **checkout: self**\
   Ensures your code is present on the build agent.
2. **Download & Install**\
   Grabs the CLI binary, grants permissions, and moves it to `/usr/local/bin`.
3. **Run the Scan**\
   The `--ci` flag keeps the output minimal. We rely on environment variables for the API key and project ID.

***

## Viewing Scan Results

1. **CLI Output**\
   The console output shows a summary of detected issues.
2. **CLI “results”**\
   If you want more detail in the pipeline logs, add a step:
   ```yaml theme={null}
   - script: |
       cybedefend results --project-id $(CYBEDEFEND_PROJECT_ID) --all --output sarif
     displayName: 'Fetch Results in SARIF'
   ```
3. **CybeDefend Dashboard**\
   Login to your CybeDefend account to see a full vulnerability breakdown.

<Warning>
  Large repos can take extra time to upload. Ensure your pipeline has enough timeout for the scan process.
</Warning>

<Tip>
  For advanced gating, fail the job if a certain severity is found. Combine <strong>--ci</strong> with parsing the CLI exit codes or vulnerability count from the JSON output.
</Tip>