> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/mend-scanner-reference.md).

# Mend (formerly Whitesource) step configuration

The **Mend step** in Harness STO enables you to scan both **code repositories** and **container images**. You can perform **SAST**, **SCA** and **Container** scans using the available scan modes: **Orchestration**, **Extraction**, and **Ingestion**.

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Mend step settings <a href="#mend-step-settings" id="mend-step-settings"></a>

The recommended workflow is to add a Mend step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

* **Default**: Uses the legacy Mend Unified Agent CLI with the V2 API. This configuration performs only **SCA (Software Composition Analysis)** for repositories and uses the legacy method for container image scanning.
* **SAST, SCA, Container**: Uses the newer Mend CLI with the V3 API. This configuration supports **SAST**, **SCA** for repositories, and **Container** for container image scanning.

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

**Workspace (*****repository*****)**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

The fully-qualified URL to the scanner. The default is `https://saas.whitesourcesoftware.com/`.

**Enforce SSL**

**Access Id**

The user key for your Mend personal account: in the Mend UI, click the **Account Settings** button in the top right.

You should create a Harness text secret with your encrypted token and reference the secret using the format `<+secrets.getValue("my-mend-user-key")>`. For more information, go to [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

**Access Token**

The API key for your Mend organization.

This field is required. If you want to run a scan in an organization other than the default organization for your account, generate an Access Token in that specific organization. In the Mend UI, go to **Integration** > **Organization** > **API Key**.

You should create a Harness text secret with your encrypted token and reference the secret using the format `<+secrets.getValue("my-mend-org-api-key")>`. For more information, go to [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Lookup Type**

You can specify the Mend product or project **By Token** or **By Name**.

**Product Name / Token**

The name or token of the [Mend product](https://docs.mend.io/bundle/sca_user_guide/page/understanding_organizations__products_and_projects.html#Product) that you want to scan.

This field is required for Orchestration and Extraction scans.

**Project Name / Token**

The name or token of the [Mend project](https://docs.mend.io/bundle/sca_user_guide/page/understanding_organizations__products_and_projects.html#Project) that you want to scan.

This field is required for Extraction scans.

**Include**

If you're running an orchestration scan on a code repository, you can use this setting to specify the files to include in the scan. By default, a Mend scan includes all files in the code repository.

This setting corresponds to the [**Includes** configuration parameter](https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html#General) for the Mend United Agent.

**Exclude**

If you're running an orchestration scan on a code repository, you can use this setting to specify the specific files to exclude from the scan. By default, a Mend scan includes all files in the code repository.

This setting corresponds to the [**excludes** configuration parameter](https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html#General) for the Mend United Agent.

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [Mend Unified Agent](https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html#General) with additional flags.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

{% hint style="info" %}
Mend requires higher compute resources for orchestration. Recommended minimum resource limits:

* Memory: 16 GB
* CPU: 2
  {% endhint %}

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### Mend orchestration pipeline example <a href="#mend-orchestration-pipeline-example" id="mend-orchestration-pipeline-example"></a>

The following pipeline shows an end-to-end orchestration workflow. The Mend step includes the settings needed to run this specific scan: [`access_token`](#access-token), [`domain`](#domain), [`access_id`](#access-id), and [`product_name`](#product-name--token).

```yaml
pipeline:
  projectIdentifier: STO
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: CODEBASE_CONNECTOR
        build: <+input>
  stages:
    - stage:
        name: mend
        identifier: mend
        type: SecurityTests
        spec:
          cloneCodebase: true
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: K8S_DELEGATE_CONNECTOR
              namespace: harness-delegate-ng
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux
          execution:
            steps:
              - step:
                  type: Mend
                  name: mend_orch
                  identifier: mend_orch
                  spec:
                    mode: orchestration
                    config: default
                    target:
                      name: secrets
                      type: repository
                      variant: master
                    advanced:
                      log:
                        level: debug
                    resources:
                      limits:
                        memory: 1Gi
                    imagePullPolicy: Always
                    auth:
                      access_token: <+secrets.getValue("my-mend-organization-api-key")>
                      domain: https://saas.whitesourcesoftware.com/agent
                      ssl: true
                      access_id: <+secrets.getValue("my-mend-user-key")>
                    tool:
                      product_name: secretsrepo
          caching:
            enabled: false
          sharedPaths:
            - ""
        variables:
          - name: runner_tag
            type: String
            description: ""
            required: false
            value: latest
  identifier: mend_secrets
  name: mend - secrets

```