Scanner Quickstart

If your team already uses Azure DevOps, the easiest distribution path is the free Cerbi Scanner extension in Visual Studio Marketplace. Install it into the Azure DevOps organization, then add CerbiScan@1 to an existing pipeline.

Install Cerbi Scanner from Visual Studio Marketplace

steps:
- task: UseDotNet@2
  displayName: Install .NET 10 SDK
  inputs:
    packageType: sdk
    version: 10.0.x

- task: CerbiScan@1
  displayName: Cerbi logging governance scan
  inputs:
    scanPath: $(Build.SourcesDirectory)
    failOn: none

Cerbi Scanner 1.1.0 targets net10.0. The machine or CI agent running the scanner must have the .NET 10 LTS runtime; the SDK is the simplest option for developer machines and build agents.

dotnet --version

The command should report a 10.0.x SDK. .NET 8-only hosts must install .NET 10 before running the current Scanner release.

dotnet tool install -g Cerbi.Scanner

After installation, verify the CLI:

cerbi-scanner --version
cerbi-scanner --help

To update an existing global-tool install:

dotnet tool update -g Cerbi.Scanner

The package is available on NuGet.

From the repository or source folder you want to inspect:

cerbi-scanner scan . --fail-on none

--fail-on none is the safest first run: Scanner reports findings but does not fail the command because of finding severity.

Generate JSON, SARIF, and a Markdown summary in one run:

mkdir -p scan-results
cerbi-scanner scan \
  --path . \
  --fail-on none \
  --format json --output scan-results/findings.json \
  --sarif scan-results/findings.sarif \
  --summary scan-results/build-summary.md

When you are ready to use Scanner as a build gate, change the threshold to --fail-on error (high severity) or another supported threshold. See the CI/CD guide.

Scanner uses one language-neutral finding contract across these implementations. For the current rule set, see Scanner rules.