Trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more observed · 2026-10-07
Health v2 · maintenance only
98/100
- Activity 98
- Release rhythm 98
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-21. Adoption (stars, forks) is never an input.
- gap_med: 13
- age_days: 2750
- days_rel: 19
- days_push: 14
- n_releases_24m: 10
Adoption not part of the score
38274 stars · 738 forks observed · 2026-10-07
What it is AI-extracted, prompt v1, taxonomy v1, 2026-09-28, confidence 0.99
Trivy is an open‑source command‑line security scanner that detects vulnerabilities, misconfigurations, secrets, licenses and generates SBOMs. It supports container images, filesystems, Git repositories, virtual machine images and Kubernetes clusters.
Use cases
- scan container images for known CVEs
- detect misconfigurations in Kubernetes manifests
- find hard‑coded secrets in source code repositories
- generate a software bill of materials (SBOM) for a filesystem
- check software licenses across project dependencies
- scan virtual machine images for security issues
- integrate vulnerability scanning into CI/CD pipelines
When to choose
- You need a single, easy‑to‑use CLI that covers multiple targets (containers, code, cloud, etc.).
- You want fast, out‑of‑the‑box scanning with minimal configuration.
- You require integration with CI/CD systems, GitHub Actions, or Kubernetes operators.
- You prefer an actively maintained, community‑driven tool with a permissive Apache‑2.0 license.
When to avoid
- You need a graphical user interface or a full‑featured security dashboard.
- Your use case demands deep static code analysis beyond known CVEs and simple secret patterns.
- You require commercial support or advanced policy management not provided by the open‑source version.
Facets
cli-tool · maturity active
vulnerability-scanning security cloud-computing windows cli container-image-scanning kubernetes git-repo virtual-machine-image open-source go misconfiguration-scanning secret-scanning sbom-generation license-detection devops linux macos docker
4 sources
- readme: https://github.com/aquasecurity/trivy · fetched 2026-10-07 · b04221382fc2
- homepage: https://trivy.dev · fetched 2026-09-14 · 4f7592ce3fab
- site_page: https://trivy.dev/docs · fetched 2026-09-14 · 0f971f3f3e2e
- site_page: https://trivy.dev/docs/latest/getting-started · fetched 2026-09-14 · faea6d27bd87
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| aquasecurity/trivy | main | 98 |
| aquasecurity/trivy-operator | backend | 98 |
| aquasecurity/trivy-action | plugin | 85 |
| aquasecurity/trivy-db | infra | 66 |
| aquasecurity/harbor-scanner-trivy | plugin | 10 |
| aquasecurity/trivy-vscode-extension | plugin | 75 |
| aquasecurity/trivy-checks | infra | 84 |
| aquasecurity/trivy-azure-pipelines-task | plugin | 97 |
For agents
markdown · JSON · MCP: product_card(name="aquasecurity/trivy")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem