Trivy Security Scanner MCP Server
local-only server
The server can only run on the clientβs local machine because it depends on local resources.
Integrations
Trivy Security Scanner MCP Server
A Model Context Protocol (MCP) server that provides Trivy security scanning capabilities through a standardized interface.
β οΈ Note: This is a proof of concept project to demonstrate the integration capabilities between MCP, Cursor IDE, and Trivy. It's intended for experimentation and learning purposes only and is not production-ready. Use at your own risk.
Features
- π Project Scanning: Automatically scan your project directory for security vulnerabilities using Trivy
- π οΈ Automated Fixes: Automatically update vulnerable dependencies to secure versions
- π¦ Multi-Package Support: Handles multiple package managers (Python, Node.js, Ruby, Go)
Demo
Architecture
Prerequisites
- Python 3.12 or higher
- Trivy installed on your system:
Installation
Usage
Start the server using SSE transport:
The server exposes two tools:
scan_project
: Scans a directory for security vulnerabilities- Required argument:
workspace
- The directory path to scan
- Required argument:
fix_vulnerability
: Updates a vulnerable package to a secure version- Required arguments:
workspace
- The directory to modifypkg_name
- Name of the package to updatetarget_version
- Version to update to
- Required arguments:
Using with Cursor IDE
- Start the server with SSE transport:
- Configure in Cursor:
- Open Settings
- Go to Features > MCP Servers
- Add:
http://127.0.0.1:54321/sse
- Add the following to your .cursorrules file, create it if you don't have one yet:This configuration will:
- Automatically trigger a security scan when any dependency file is modified
- Help identify vulnerabilities as soon as new dependencies are added
- Ensure your project stays secure throughout development
if you want to use the tool manually, you can use prompt the agent to use the tool with the following prompt through the composer interface:
Why MCP?
MCP (Model Context Protocol) exists to solve a fundamental problem in working with large language models (LLMs): how to efficiently and consistently connect these models to external data sources and tools.
Learn more at modelcontextprotocol.io.
Contributing
Contributions are welcome! Please feel free to submit a Pull Request.
License
MIT License
Acknowledgments
This server cannot be installed
Provides Trivy security scanning capabilities through a standardized interface, allowing users to scan projects for vulnerabilities and automatically fix them by updating dependencies.