Trivy MCP Server
MCPTrivy's MCP plugin: lets agents scan local projects, container images and remote repositories for vulnerabilities and misconfigurations in plain language, optionally checking policy compliance via the Aqua platform. Requires Trivy; maintained by Aqua Security.
Trivy MCP Server Plugin
https://github.com/user-attachments/assets/125791b0-3164-4dcc-8fb3-e45481a9cbf7
This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.
Features
- Natural Language Scanning: Ask questions about security issues in natural language
- Multiple Scan Types:
- Filesystem scanning for local projects
- Container image vulnerability scanning
- Remote repository security analysis
- Integration with Aqua Platform: Optional integration with Aqua Security's platform for enhanced scanning capabilities and assurance policy compliance
- Flexible Transport: Support for stdio, streamable HTTP, and SSE (Server-Sent Events) transport protocols
- IDE Integration: Seamless integration with VS Code, Cursor, JetBrains IDEs, and Claude Desktop
Quick Start
Installation
trivy plugin install mcp
Starting the Server
trivy mcp
Documentation
For comprehensive documentation, please see the docs directory:
- Installation Guide
- Quick Start Guide
- Configuration Options
- IDE Integration
- Example Queries
- Authentication
Example Query
After setting up the plugin and configuring your IDE, you can start asking security-related questions:
Are there any vulnerabilities or misconfigurations in this project?
For more examples, see the Example Queries page.
License
MIT License - see the LICENSE file for details.
Recursos relacionados
Trivy
CLIAll-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.
aquasecurity/trivy38.5k
Grype
CLIScans container images, filesystem directories and SBOMs for known vulnerabilities across major Linux distro packages and many language ecosystems, ranks risk by EPSS and KEV, and filters results with OpenVEX. Good for vulnerability gates in CI. Maintained by Anchore.
anchore/grype13k
OSV-Scanner
CLIGoogle's official dependency vulnerability scanner: parses project lockfiles and container images, checks them against the OSV.dev database to find affected dependencies, and can suggest upgrade fixes (experimental).
google/osv-scanner11.2k
Checkov
CLIStatic scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.
bridgecrewio/checkov9.1k
Supply Chain Risk Auditor
SkillTrail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.
trailofbits/skills7.6kStatic Analysis
SkillTrail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.
trailofbits/skills7.6k