Trivy
CLIAll-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.
Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.
Targets (what Trivy can scan):
- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes
Scanners (what Trivy can find there):
- OS packages and software dependencies in use (SBOM)
- Known vulnerabilities (CVEs)
- IaC issues and misconfigurations
- Sensitive information and secrets
- Software licenses
Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.
To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.
Quick Start
Get Trivy
Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:
brew install trivydocker run aquasec/trivy- Download binary from https://github.com/aquasecurity/trivy/releases/latest/
- See Installation for more
Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:
- GitHub Actions
- Kubernetes operator
- VS Code plugin
- See Ecosystem for more
Canary builds
There are canary builds (Docker Hub, GitHub, ECR images and binaries) generated with every push to the main branch.
Please be aware: canary builds might have critical bugs, so they are not recommended for use in production.
General usage
trivy <target> [--scanners <scanner1,scanner2>] <subject>
Examples:
trivy image python:3.4-alpine
trivy fs --scanners vuln,secret,misconfig myproject/
trivy k8s --report summary cluster
Result
FAQ
How to pronounce the name "Trivy"?
tri is pronounced like trigger, vy is pronounced like envy.
Want more? Check out Aqua
If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.
You can find a high level comparison table specific to Trivy users here.
In addition check out the https://aquasec.com website for more information about our products and services.
If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo
Community
Trivy is an Aqua Security open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here
Please ensure to abide by our Code of Conduct during all interactions.
Ressources associées
Grype
CLIScans container images, filesystem directories and SBOMs for known vulnerabilities across major Linux distro packages and many language ecosystems, ranks risk by EPSS and KEV, and filters results with OpenVEX. Good for vulnerability gates in CI. Maintained by Anchore.
anchore/grype13k
Checkov
CLIStatic scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.
bridgecrewio/checkov9.1k
OSV-Scanner
CLIGoogle's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental).
google/osv-scanner11.2kTrivy MCP Server
MCPTrivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.
aquasecurity/trivy-mcp53
OSS Review Toolkit (ORT)
CLIThe Linux Foundation's open-source compliance toolchain: analyzes project dependencies, scans licenses and copyrights, checks known vulnerabilities, flags policy violations and generates SBOMs and notice files. Needs Java 25 or Docker and ideally 8 GB RAM; have legal review license findings.
oss-review-toolkit/ort2.1k
Docker Compose
CLIDefine multi-container apps in compose.yaml and bring up services, databases, caches and the rest with one docker compose up, handy for agents setting up local dev and test dependencies. Maintained by Docker; included with Docker Desktop on macOS.
docker/compose38.4k