Scan a Docker image for known vulnerabilities using Trivy. Returns a summary of critical/high/medium/low vulnerabilities with package names and fix availability.

Generate a detailed vulnerability report for a Docker image with remediation recommendations (which packages to upgrade). More detailed than scan_image.

Scan a local directory or file for vulnerabilities, misconfigurations, and secrets using Trivy. Supports Dockerfiles, Terraform, Kubernetes manifests, and application dependencies.

Scan a git repository (local or remote URL) for vulnerabilities, misconfigurations, and secrets using Trivy.

Scan a Software Bill of Materials (SBOM) file for known vulnerabilities. Accepts CycloneDX or SPDX format SBOMs.

Generate a Software Bill of Materials (SBOM) for a Docker image in CycloneDX or SPDX format. The SBOM lists all packages and dependencies in the image.

Scan Infrastructure-as-Code files for misconfigurations and security issues. Supports Terraform, Dockerfile, Kubernetes manifests, CloudFormation, Helm charts, and more.

Scan a Docker image for vulnerabilities using Grype (Anchore's scanner). Provides cross-validation against Trivy results — different vulnerability database, different detection coverage.

Scan a local directory or file for vulnerabilities using Grype. Cross-validates against Trivy filesystem scans.

Scan a container image directly from a remote registry using Grype. No Docker daemon required — pulls the image manifest and layers directly.

Look up known vulnerabilities for a specific package using its Package URL (PURL). Useful for checking if a specific dependency version is affected by any CVEs.

Check the status of Grype's vulnerability database — last update time, database schema version, and whether an update is available.

Update Grype's vulnerability database to the latest version. Recommended before scanning if the DB hasn't been updated recently.

Get version information for installed security scanning engines (Trivy and/or Grype).

Scan a Docker image with BOTH Trivy and Grype, then compare results. Surfaces vulnerabilities found by only one engine (different databases = different coverage). This is the key differentiator — no other MCP server offers multi-engine cross-validation.