> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scanning-agent/scan-internal-applications.md).
# Scan internal applications
Scan your internal applications with the Snyk API & Web Scanning Agent, a secure, clean, and straightforward solution to scan non-public applications.
## What is a Scanning Agent for?
The Snyk Scanning Agent lets you scan internal applications for vulnerabilities without exposing them to the internet or even to Snyk IP addresses. It is the ideal approach to scan any application that is only reachable from within your network, including development, staging, pre-release, and internal production applications that support your business.
You can use a single Scanning Agent to scan multiple internal targets, but you can also have different Scanning Agents, each one reaching a part of your network. There is no need for a single Scanning Agent to connect to the whole network.
## How does a Scanning Agent work?
A Scanning Agent creates an encrypted and authenticated tunnel where traffic flows securely between Snyk API & Web and your network.
To ensure Snyk meets your security expectations, Snyk follows these principles:
* All code is open source and [publicly available](https://github.com/Probely/farcaster-onprem-agent/).
* You have complete control over the Scanning Agent, including the right to change it.
* Snyk API & Web cannot access the Scanning Agent.
* The Scanning Agent runs in containers with the least required privileges.
* All traffic is encrypted end-to-end.
* The Scanning Agent does not open any network port.
## Install a Scanning Agent
To install a Scanning Agent, refer to [Install a Scanning Agent](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scanning-agent/install-scanning-agent.md) and the installation reference and source code for the installer available in the [Snyk API & Web GitHub repositories](https://github.com/Probely/farcaster-onprem-agent/).
## Scan a target with a Scanning Agent
When a Scanning Agent is configured and running, you must choose which targets use it:
1. In Snyk API & Web, navigate to the **Targets** menu.
2. Identify the target in the list for which you want to set the Scanning Agent and click the **gear icon** to open its settings.
3. Under the **Scanner** tab, navigate to the **SCANNING AGENT** section and select the Scanning Agent you want to use.
4. Click **Save**.
Click **Unlink** to remove the Scanning Agent for the target.
You can also assign or remove a Scanning Agent to or from multiple targets in the targets list. Select the targets you want to configure, and the options appear.
Targets configured to use a Scanning Agent show a cloud icon.
## Scanning Agent status
A Scanning Agent can have one of the following statuses:
| Status | Description |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connected | The scanning agent is connected. It was working in the last 180 seconds. |
| Connected with issues | The scanning agent is connected, but it can have poor network performance if it uses, for example, an HTTP proxy or a direct TCP connection to Snyk API & Web. For more information, visit the [TCP Meltdown](https://web.archive.org/web/20220103191127/http://sites.inka.de/bigred/devel/tcp-tcp.html) problem and check the documentation on [launching the agent](https://github.com/Probely/farcaster-onprem-agent?tab=readme-ov-file#launch-the-agent). |
| Disconnected | The scanning agent is disconnected, possibly due to misconfiguration. Check the scanning agent configuration or the firewall rules, for example. For more information, check the [Installation](https://github.com/Probely/farcaster-onprem-agent?tab=readme-ov-file#installation) and [Network Requirements](https://github.com/Probely/farcaster-onprem-agent?tab=readme-ov-file#network-requirements) documentation. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/start-scanning/overview-scanning-agent/scan-internal-applications.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.