A
license-
qualityF
maintenanceProvides Trivy security scanning capabilities through a standardized interface, allowing users to scan projects for vulnerabilities and automatically fix them by updating dependencies.
10
MIT
Trivy
Officialby aquasecurity
Enables scanning of GitHub repositories for vulnerabilities and security issues by connecting to repositories like 'github.com/aquasecurity/trivy-ci-test'.
Provides vulnerability scanning capabilities for various sources including filesystems, container images, and code repositories, allowing users to identify vulnerabilities and misconfigurations through an MCP server interface.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Trivyscan this Dockerfile for vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Trivy MCP Server Plugin
https://github.com/user-attachments/assets/125791b0-3164-4dcc-8fb3-e45481a9cbf7
This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.
Features
Natural Language Scanning: Ask questions about security issues in natural language
Multiple Scan Types:
Filesystem scanning for local projects
Container image vulnerability scanning
Remote repository security analysis
Integration with Aqua Platform: Optional integration with Aqua Security's platform for enhanced scanning capabilities and assurance policy compliance
Flexible Transport: Support for stdio, streamable HTTP, and SSE (Server-Sent Events) transport protocols
IDE Integration: Seamless integration with VS Code, Cursor, JetBrains IDEs, and Claude Desktop
Related MCP server: MCP SBOM Server
Quick Start
Installation
trivy plugin install mcpStarting the Server
trivy mcpDocumentation
For comprehensive documentation, please see the docs directory:
Example Query
After setting up the plugin and configuring your IDE, you can start asking security-related questions:
Are there any vulnerabilities or misconfigurations in this project?For more examples, see the Example Queries page.
License
MIT License - see the LICENSE file for details.
This server cannot be installed
Maintenance
–Maintainers
–Response time
2wRelease cycle
9Releases (12mo)
Commit activity
Issues opened vs closed
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- FlicenseBqualityDmaintenanceA Model Context Protocol server that performs Trivy scans to generate Software Bill of Materials (SBOM) in CycloneDX format.13
- FlicenseAquality-maintenancePerforms vulnerability scans using Trivy to generate Software Bill of Materials (SBOM) in CycloneDX format. It enables automated security auditing and dependency tracking through the Model Context Protocol.1
- Alicense-qualityCmaintenanceGo-based SBOM, vulnerability, and secret scanner with MCP support.3Apache 2.0
Related MCP Connectors
Multi-CI security scanner with a live threat-intel feed of compromised CI components
OSV.dev — Google's open-source vulnerability database
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/aquasecurity/trivy-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server