InfraClaude

Instructions

Implementation Reference

• src/tools/security/trivy_scan.ts:7-60 (handler)

  The main handler function `trivyScanImage` which executes the Trivy scan command and formats the output.

  export async function trivyScanImage(args: Record<string, unknown>): Promise<string> {
    const image = args.image as string;
    if (!image) throw new Error("Image name is required");
    const severity = (args.severity as string) || "HIGH,CRITICAL";
  
    try {
      const { stdout } = await execFileAsync(
        "trivy",
        ["image", "--format", "json", "--severity", severity, image],
        { timeout: 120000 }
      );
  
      const report = JSON.parse(stdout);
      const results = report.Results || [];
      const lines: string[] = [`Trivy scan results for '${image}':`];
  
      let totalVulns = 0;
      for (const result of results) {
        const vulns = result.Vulnerabilities || [];
        totalVulns += vulns.length;
  
        if (vulns.length === 0) continue;
  
        lines.push(`\nTarget: ${result.Target} (${result.Type})`);
        const headers = ["ID", "SEVERITY", "PACKAGE", "VERSION", "FIXED IN", "TITLE"];
        const rows = vulns.slice(0, 20).map((v: any) => [
          v.VulnerabilityID || "",
          v.Severity || "",
          v.PkgName || "",
          v.InstalledVersion || "",
          v.FixedVersion || "N/A",
          (v.Title || "").substring(0, 40),
        ]);
        lines.push(formatTable(headers, rows));
  
        if (vulns.length > 20) {
          lines.push(`  ... and ${vulns.length - 20} more vulnerabilities`);
        }
      }
  
      if (totalVulns === 0) {
        lines.push(`\nNo ${severity} vulnerabilities found.`);
      } else {
        lines.push(`\nTotal: ${totalVulns} vulnerabilities found.`);
      }
  
      return lines.join("\n");
    } catch (error: any) {
      if (error.code === "ENOENT") {
        throw new Error("Trivy is not installed. Install it from https://aquasecurity.github.io/trivy/");
      }
      throw new Error(`Trivy scan failed: ${error.stderr || error.message}`);
    }
  }

• src/tools/security/index.ts:7-18 (registration)

  Tool registration definition for `security_trivy_scan` including name, description, and input schema.

  {
    name: "security_trivy_scan",
    description: "Scan a container image for vulnerabilities using Trivy",
    inputSchema: {
      type: "object" as const,
      properties: {
        image: { type: "string", description: "Container image to scan (e.g., 'nginx:latest')" },
        severity: { type: "string", description: "Severity filter (default: 'HIGH,CRITICAL')" },
      },
      required: ["image"],
    },
  },

• src/tools/security/index.ts:47-48 (handler)

  The switch-case entry point that delegates the `security_trivy_scan` tool call to the handler function.

  switch (name) {
    case "security_trivy_scan": return trivyScanImage(a);