A host-based vulnerability scanner is not required to use a Client/Server architecture. Host-based only means, that the scanner runs on the same machine that it is scanning.
If it uses a Client/Server pattern, the client is the agent running on the host. The server is usually a central orchestrator, managing the individual agents. This makes sense in larger environments, where many agents are rolled out and need to be controlled remotely.
The orchestrator can have several duties, including the following:
- Deploy rule-set on agents
- Schedule and trigger scans
- Collect scan results
- Provide an overview of scan results (e.g. on a dashboard)
- Alert in case of high risk findings
It is basically the centralized management system for the agents.