Hi @WBradney035779 (Community Member)​,

Your API ID and key can be found within the API Credentials section as you suggested, however a different set of credentials (an activation token) are required by the Software Composition Analysis (SCA) agent.

You can acquire an activation token by following these steps:

1. In the Veracode Platform navigate to "Scans & Analysis" -> "Software Composition Analysis" -> "Agent-Based Scan".
2. Select a workspace from the list or alternatively create a new workspace ("Actions" -> "Create Workspace").
3. Under "Manage Workspace" select "Agents".
4. You may need to select "Actions" -> "Create" if you do not already have any agents configured.
5. You should now see three blue boxes, one for each of the Operating Systems supported by the Agent. Clicking on the relevant Operating System will give you step-by-step instructions on how to install the agent, as well as presenting the activation token to use.

Thanks,

Anthony Fielding

OK so I'm now revisiting this because we need to apply some policies to ignore certain vulnerabilities identified in our agent-based srcclr command line scans. I can successfully ignore the vulnerability online and it's removed from the scan report. But when our local agent scans again it still shows up as a vulnerability and fails our pipelines.

It seems that we need a local agent.yml file that presumably contains the policies we create online, but it looks like that file only get created when we run srcclr activate with an agent activation token, which is not the same as the authentication key token we generated before for the workspace.

I tried to recreate the agent to get this token (we use Powershell), but I see no "activation token", only what seems to be an authentication token.

I do see an activation token on the chocolatey page for creating a windows agent using chocolatey, but not for Powershell.

Please advise.

Out of interest, I tried simply using the token from the chocolately page even though I didn't install srcclr that way, and I now see a new "Cli" agent, and a local agent.yml file was created after I used the token for srcclr activate.

I don't see any ignore policies in that file, and new local scans - using the auth key regenerated for the new agent - still shows the vulnerability. We're simply looking at the scan report generated locally by srcclr, in order to determine if our pipeline should proceed after seeing vulnerabilities at a certain threshold level.

So at this point I'm wondering if the local scan will simply always show all vulnerabilities, ignored or not, and only the online report (provided as a link in the local report) will honor our ignore policies.

Is there another way for our local pipeline to make a pass/fail decision based on the scan report, taking into account ignore policies applied online?

Hi @WBradney035779 (Community Member)​ 

Great question, and glad you were able to work around the activation token issue using the Chocolatey page token.

To answer your core question: yes, by design, the local srcclr CLI scan report will always list all vulnerabilities regardless of any ignore rules you've configured in the online workspace. The ignore/policy rules are enforced server-side and are reflected only in the online scan report (accessible via the link generated in your local scan output), not in the raw local report.

The recommended approach for making a pipeline pass/fail decision that respects your workspace policies is to use the Veracode SCA agent policy evaluation. Specifically:

• In your workspace, navigate to Manage Workspace > Policies and configure the rules (e.g., severity thresholds, allowed licenses). When a local scan runs and uploads results, the exit code of the srcclr scan command will reflect whether the policy was violated — a non-zero exit code indicates a policy failure, which your pipeline can use as a fail signal.
• - The key is that the exit code is determined by the server-side policy evaluation, not the raw local report. So your pipeline should check the exit code of the srcclr scan command rather than parsing the local report directly.

For more details, see the Veracode SCA agent-based scanning documentation on policy configuration and exit codes: https://docs.veracode.com/r/Agent_Based_Scans

Hope that helps!