> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md).

# Cortex CLI pre-receive hooks

Integrate the Application Security secrets scanner as pre-receive hook into your workflows installing the Cortex CLI. The hook runs on the remote server before changes are pushed, allowing you to enforce checks before code is accepted into version control.

**Supported version control systems**: Pre-receive hooks are supported for GitHub Enterprise, GitLab self-managed, and Bitbucket Data Center. To setup pre-receive hook on these platforms refer to [Setup on third-party platforms](#setup-on-third-party-platforms) below.

### Pre-receive hook workflow setup

1. [Fulfill prerequisites](#setup-requirements).
2. [Configure API credentials](#configure-credentials).
3. Install the pre-receive hook.
4. [Setup the pre-receive hook on third party platforms](#setup-on-third-party-platforms).

### Setup requirements

{% hint style="warning" %}

### Prerequisites

Before you begin, ensure you have:

* **Administrator** access to the VCS server and console
* A valid license for Application Security
* The **Cortex XSIAM CLI binary** or Docker image installed on the server (requires `GLIBC (GNU C library) version 2.35` or greater). Refer to [Connect Cortex CLI](/cortex-cli/connect-cortex-cli.md) for information about onboarding the CLI
* **Cortex XSIAM API credentials** (API Key ID and API Key) and your API base URL. For more information on creating API keys, refer to [Create a new API key](/cortex-cloud-api/create-a-new-api-key.md)
* **Git** installed on your machine. For installation instructions, refer to the [official Git website](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
  {% endhint %}

### Configure credentials

It is recommended to configure credentials for the Application Security Cortex CLI using a configuration file, instead of embedding them directly in the hook script.

1. Create a directory:

   ```programlisting
   mkdir -p ~/.cortexcli/.cortex.yaml
   ```

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Make sure to create the directory under the home directory of the Linux user that runs the Git hooks. This user is typically not the root user.</p></div>
2. Configure credentials: Open the `.cortex.yaml` file in the `~/.cortexcli/` directory and add the following configuration parameters:
   * `CORTEX_API_BASE_URL`: \<API base URL>
   * `CORTEX_API_KEY_ID`: < API key ID >
   * `CORTEX_API_KEY`: < API key>

### Setup on third-party platforms

To set up the Cortex CLI as a pre-receive hook on supported third-party platforms, refer to the official vendor documentation:

* **GitHub Enterprise**: [About pre-receive hooks](https://docs.github.com/en/enterprise-server@3.16/admin/enforcing-policies/enforcing-policy-with-pre-receive-hooks/about-pre-receive-hooks)
* **GitLab self-managed**: [Git server hooks](https://docs.gitlab.com/ee/administration/server_hooks.html)
* **Bitbucket Enterprise**: [Using repository hooks](https://confluence.atlassian.com/bitbucketserver/using-repository-hooks-776639836.html)

### Reference script

Use the script below as reference to extend or modify your existing pre-receive hooks in your VCS provider.

```programlisting
#!/usr/bin/env bash

# This script is used to run Cortex CLI in a pre-receive hook.

# Hide the update notice.
export CORTEX_HIDE_UPDATE_NOTICE=1

CORTEX_CLI="/usr/local/bin/cortexcli"
BASE_COMMAND="--api-base-url ${CORTEX_API_BASE_URL} --api-key-id ${CORTEX_API_KEY_ID} --api-key ${CORTEX_API_KEY} code pre-receive"
OPTIONAL_FLAGS=''

# Run cortex cli
${CORTEX_CLI} ${BASE_COMMAND:-''} ${OPTIONAL_FLAGS:-''}

exit_code=$?

exit $exit_code
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.