# Install ScanSuite Teams > Run the installer, create the first team, and bring the platform up. Source: https://scansuite.eu/documentation/installation/install-scansuite-server Last reviewed: 2026-10-19 Install ScanSuite Teams on a Linux server, create the first account and connect an AI provider. One script does the installation into `/opt/scansuite`; most of its time goes into downloading images. > **Agent prompt: Let Claude Code install it** > > ```text > Install ScanSuite Teams on this server by following https://scansuite.eu/documentation/installation/install-scansuite-server. Do the work yourself: check the prerequisites, ask me where the licence file is and copy it into place, and start the installer in a terminal I can type into, so that I only type the registry password when the installer asks for it. Never ask me to paste a secret into the chat. > ``` With an AI agent that has a shell on the server, you do three things on this page: say where the licence file is, type the registry password when the installer asks for it, and create the first account in your browser. The agent does the rest, including copying the licence file and starting the installer. ## Before you start | Prerequisite | Check | |---|---| | The server meets the requirements | The checks in [Technical Requirements](https://scansuite.eu/documentation/installation/technical-requirements) show the expected results. | | You are signed in as an ordinary account with sudo, not root | id -u prints a number other than 0, and sudo -n true succeeds or says a password is required (then the person types it when the installer asks). | | You know where the licence file sent with your order is | Step 1. | | The person with the registry access token is at hand, at a terminal they can type into | Steps 2 and 3. | The values this page uses: | Placeholder | Where it comes from | |---|---| | | Your licence code: the six characters after the last underscore of the licence file name, _.lic. | | | The licence file sent with your order. | | | The ordinary account with sudo that installs and runs ScanSuite. | | | The registry user name. The installer prints it in Signing in to the image registry as ; it is also sent with your order. | | | The server's DNS name or IP address, as your browser reaches it. | ## 1. Put the licence file on the server The installer reads the licence from the folder it is started in. Put the licence file sent with your order into an empty folder of the installing account: ```bash mkdir -p ~/scansuite-licence cp ~/scansuite-licence/ ``` If the file is on your computer instead, copy it over with `scp @:~/scansuite-licence/`. Use the ScanSuite Teams licence: a licence for the other edition does not install Teams, even when the file name looks the same. > **A person does this step:** Tell the agent where the licence file is: a path on the server, or on a computer it can copy from. The agent copies it into the folder itself; you do not move the file. Check, in that folder: ```bash ls *.lic ``` Expected: exactly one file, `_.lic`. The installer uses the first `.lic` it finds, so remove any other. ## 2. Run the installer The installer asks once for the registry password (step 3), so it runs in a terminal a person can type into. In the folder with the licence file: ```bash cd ~/scansuite-licence bash -c "$(curl -sSL https://scansuite.eu/install-teams)" ``` It installs git if it is missing, creates `/opt/scansuite` (with sudo, then hands it to your account), fetches the installation files into it, copies the licence into `/opt/scansuite/key/`, installs Docker if needed, checks the host, downloads the images and starts everything. Running it again is safe: it repairs an installation rather than duplicating it. An AI agent starts the installer in a terminal you can see and type into: the terminal panel of its app, or a `tmux` session on the server that you attach to from your own SSH session. The agent follows the output and carries on when the installer finishes: *Started by an agent in tmux* ``` command -v tmux || sudo apt-get install -y tmux tmux new-session -d -s scansuite 'cd ~/scansuite-licence && bash -c "$(curl -sSL https://scansuite.eu/install-teams)"; exec bash' tmux capture-pane -p -t scansuite | tail -20 ``` You attach with `tmux attach -t scansuite`, type the password when asked, and detach with Ctrl+B then D. An agent with neither a terminal panel nor tmux gives you the two commands above to run yourself, and continues with step 4 once they finish. ![ScanSuite installer output](https://scansuite.eu/static/assets/img/docs/installation/install-scansuite-server/01.png) *The installer starting up* The host checks warn but do not stop: too little free disk space, or another program on ports 80 and 443, is reported and the installation goes on. Only a missing Docker that the installer cannot install stops it. On WSL, Docker's own install script prints a Docker Desktop hint and waits 20 seconds (`You may press Ctrl+C now to abort`): let it continue. When it installs Docker it prints `Docker installed. Run 'newgrp docker' (or log out and back in) to use docker without sudo.` — do that after the installer finishes. By default the installer brings up the application and DefectDojo, without the classic scanner containers. To choose differently on the first run, install by hand instead of the one-liner: *Install with options* ``` sudo mkdir -p /opt/scansuite && sudo chown "$USER": /opt/scansuite git clone https://github.com/cepxeo/scansuite /opt/scansuite cp ~/scansuite-licence/*.lic /opt/scansuite/key/ cd /opt/scansuite && ./scansuite install --all-scanners ``` Every option is in [Installer options](https://scansuite.eu/documentation/installation/install-scansuite-server#installer-options) below; you can also add scanners later with `./scansuite update --all-scanners`. ## 3. Sign in to the image registry On a host that has not signed in yet, the installer stops at: *Installer prompt* ``` [*] Signing in to the image registry as Password: ``` ![Password prompt](https://scansuite.eu/static/assets/img/docs/installation/install-scansuite-server/02.png) *The installer prompting for the container registry password* > **A person does this step:** Type the registry access token sent with your order (it starts with dckr_pat_) at the installer's Password: prompt and press Enter. Type it into that terminal only, never into a chat. Expected: `Login Succeeded`, then the image downloads. The host stays signed in, so later runs and updates do not ask again. Docker keeps the token in `/root/.docker/config.json`, readable by root only, and warns that it is stored unencrypted; `sudo docker logout` removes it, and the next update then asks again. If the installer was started without a terminal to type in, Docker prints `cannot perform an interactive login from a non-TTY device` and the installer ends with `Registry sign-in failed. Check the credentials sent with your licence.` and `Installation failed`. That is not a fault for `doctor`: start the installer again in a terminal as step 2 describes; running it again is safe. Wait until the images are downloaded. The installer starts the services and waits until every one reports healthy. A successful run ends with: *Expected end of the installer output* ``` [+] All services healthy [*] Open https:///setup in a browser to create the first account. [+] ScanSuite Teams is installed in /opt/scansuite ``` ![ScanSuite startup output](https://scansuite.eu/static/assets/img/docs/installation/install-scansuite-server/03.png) *ScanSuite starting after a successful installation* If it ends with `Start failed. Run ./scansuite doctor for the reason.` or `Installation failed` (and the lines above it are not the registry sign-in), go to step 4 and then [Troubleshooting](https://scansuite.eu/documentation/installation/troubleshooting). ## 4. Check the installation ```bash cd /opt/scansuite ./scansuite doctor curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/setup ``` Expected: `doctor` ends with `[+] No problems found`, and the `curl` line prints `200` — the setup page is waiting for the first account. Anything else: [Troubleshooting](https://scansuite.eu/documentation/installation/troubleshooting) maps each doctor message to its fix. ## 5. Create the first account A fresh installation has no accounts, so it serves a setup page. Open `https:///setup` in a browser right away: whoever opens it first creates the account that administers the installation. The console is served with a self-signed certificate until you replace it ([SSL/TLS Setup](https://scansuite.eu/documentation/installation/ssl-tls-setup)), so the browser warns the first time. | Field | What to enter | Note | |---|---|---| | Team name | The name of your first team. | Rename it later in the team settings. | | User name | The account you sign in with. | — | | Password | At least 8 characters, with an uppercase letter, a lowercase letter, a digit and a special character. | — | | Confirm password | The same password again. | — | > **A person does this step:** Fill in the setup form, choose the password yourself and click Create the first account. > > Nothing is generated and no password is written to a log; an agent must not choose or see this password. Expected: the sign-in page. Sign in with the new account. The setup page is gone for good: the `curl` check from step 4 now prints `302`. That account is the administrator of its team and of the installation; adding people and teams is in [Members and accounts](https://scansuite.eu/documentation/administration/user-administration) and [System Settings](https://scansuite.eu/documentation/administration/platform-administration). ## 6. Connect an AI provider The scan forms start with the AI scanners selected, and an AI scan cannot start until a model answers. Until then **Task routing** says *No model answers the default route yet: AI scans cannot start until one does.* Set up one model for the whole installation: 1. Open the user menu (top right) → **System Settings** → **Shared services**. 2. On **AI connections**, click **Add connection**. Enter a **Name**, choose the **Kind** — *OpenAI-compatible* (OpenAI, Azure OpenAI, vLLM, Ollama and similar: **API URL** and **API key**) or *Vertex AI (Claude)* (**Google Cloud project ID**, **Vertex AI region** and a service account key) — and click **Save**. 3. On **AI models**, click **Add model**. Enter a **Name**, pick the **Connection**, enter the **Model ID** as the provider knows it (for Azure OpenAI, the deployment name) and click **Save**. 4. On **Task routing**, click **Change** on the **Default** row, pick the model as **First model** and click **Save**. 5. On **System AI**, click **Test connection**. > **A person does this step:** Type the provider's API key or paste the service account key into the form yourself. Keys are entered in the console only, never in a chat. Expected: *Answered in N s: …* next to **Test connection**, and the warning on Task routing is gone. Every field, the per-task routing and the costs are in [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers). ## 7. Next steps - **Your first scan**: [Quick start](https://scansuite.eu/documentation/quick-start) continues from here — create the first account, connect AI, create a product, scan, read the report. - **Your own certificate**: [SSL/TLS Setup](https://scansuite.eu/documentation/installation/ssl-tls-setup). - **DefectDojo**, for the classic scanners' full results: [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo). - **Protect browser sessions**: cross-site request forgery checks are off until you turn them on. Do it for any installation a browser reaches: add `CSRF_PROTECTION=true` to `/opt/scansuite/.env` and run `./scansuite restart`. API tokens are not affected. - **Backups**: [Backup and restore](https://scansuite.eu/documentation/administration/backup-and-restore). Or let your coding agent take it from here: Connect your AI agent to ScanSuite Paste this line into Claude Code, Codex, Copilot, Cursor or another coding agent. It installs the ScanSuite skill and connects it to your server, and stops for the steps only you can do. ``` Set up ScanSuite for me: fetch and follow https://scansuite.eu/documentation/agent-setup.md ``` [What the agent will do](https://scansuite.eu/documentation/agent-setup) Day to day, everything is one command in `/opt/scansuite`: ```bash ./scansuite status # what is running ./scansuite logs web # recent log lines for one service ./scansuite doctor # check the host and the installation ./scansuite update # fetch the current release and apply it ``` An update keeps `.env`, `key/`, your changes to the configuration files and your TLS certificate and key, and services that crash restart by themselves. Every command and `.env` setting is in [Setup parameters and services](https://scansuite.eu/documentation/administration/setup-parameters-and-services). ## Installer options `./scansuite install ` and `./scansuite update` take these options. The scanner and DefectDojo choice is saved in `.env` (`SCANSUITE_SCANNERS`, `SCANSUITE_DOJO`), so later updates and starts keep to it until you give another. | Option | What it does | Default | When to use | |---|---|---|---| | --no-scanners | No classic scanner containers; the AI scanners run without them. | Yes | The lean platform. | | --static-only | Only the static (code) scanners: Semgrep, KICS, gosec, SpotBugs, Bandit, phpcs-security-audit, NodeJsScan, Brakeman, Security Code Scan, Flawfinder. | — | You scan code only. | | --dynamic-only, --infra-only | Only the dynamic and infrastructure scanners: ZAP, Nuclei, Wapiti, Dastardly and the OSINT and brute-force tools. | — | You scan running applications and hosts only. | | --all-scanners | Both groups. | — | You want every classic scanner; needs about 40 GB. | | --scanners=all\|static\|dynamic\|none | The same choice as one option. | — | Scripts. | | --no-static, --no-dynamic | Remove one group and keep the other. | — | Drop a group you no longer use. | | --no-dojo | Leave out DefectDojo; an installed one is stopped and its data kept. | — | You do not run classic scanners, or you have a DefectDojo elsewhere. | | --with-dojo | Install DefectDojo, or bring it back. | Yes | — | | --offline | Use images loaded with ./scansuite offline load; contact neither the registry nor git. | Off | No registry access (below). | | --no-pull | Do not fetch the release files with git; use the ones in /opt/scansuite. | Off | Re-apply the files you have, without a network to git. | | --ntp= | Also check that this NTP server answers before installing. | No check | Hosts that must use a corporate time server. | | --workers= | Start n scan workers (1 to 100). The count is saved: later starts, updates and the start at boot keep it. | 2 | More parallel scans. | | --yes, -y | Answer yes to any confirmation. | Off | Unattended runs. | | Environment variable | What it does | |---|---| | SCANSUITE_ASSUME_YES=1 | The same as --yes, for every command in the shell. | | SCANSUITE_WORKERS= | The worker count for this command, instead of the saved one. | | SCANSUITE_NTP= | The NTP server to check, as --ntp=. | The options combine, for example `--static-only --no-dojo`. A scan that needs a scanner container you have not installed is not available until you add it, for example with `./scansuite update --all-scanners`. ## Without access to the image registry A server that cannot reach the registry or git is installed from files carried over on disk. You need a second host with registry access and the same licence. 1. On the connected host, in an installation of the same licence with the scanner choice you want, save the images: ```bash cd /opt/scansuite && ./scansuite offline save /tmp/scansuite-images ``` Expected: `[+] N images written to /tmp/scansuite-images`. The set follows that installation's scanner and DefectDojo choice. 2. Copy that directory and the installation files to the target server — the whole `/opt/scansuite` directory without `.env` and `backups/`, or a `git clone https://github.com/cepxeo/scansuite` made on the connected host — and put the files in `/opt/scansuite`, owned by the installing account, with your licence in `key/`. 3. On the target, install Docker and its Compose plugin yourself (the installer cannot download them), then load the images: ```bash cd /opt/scansuite && ./scansuite offline load /tmp/scansuite-images ``` Expected: `[+] Bundle checksums verified` and `[+] Images loaded`. 4. Install without the registry, with the same scanner option as the source: ```bash ./scansuite install --offline ``` Then continue with step 4 above. A later release goes the same way: save it on the connected host after its update, copy the images and the updated installation files over, load, then `./scansuite update --offline`. ## Behind a web server the host already runs If the host already serves ports 80 and 443, the installer starts everything except ScanSuite's nginx and says which program holds the ports. Let that web server proxy to ScanSuite instead: [SSL/TLS Setup](https://scansuite.eu/documentation/installation/ssl-tls-setup).