1. Conduid
  2. Developer Tools
  3. Trivy MCP
MCP server · Developer Tools

Trivy MCP

by · github.com/aquasecurity/trivy-mcp

Trivy plugin for starting an MCP server

Unclaimed MIT last commit 10 months ago claudemcp-serverdevtoolsvscodecursorsecurity-scannertrivy
InstallView source
66Good

Scored 3 hours ago · breakdown

About Trivy MCP

Trivy MCP is an MCP server published by aquasecurity in the Developer Tools category: trivy plugin for starting an MCP server.

The repository has 53 stars and 9 forks, with the last commit 10 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/aquasecurity/trivy-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Trivy MCP

Powered by Claude · Grounded in docs

I know everything about Trivy MCP. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 3 hours ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • ✓Tests presentA test suite exists in the repository.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

Releases

v0.0.20v0.0.20 · 17 Dec 2025What's Changed chore: bump trivy version by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/70 chore: bump the manifest version by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/71 Full Changelog**:…
v0.0.19v0.0.19 · 17 Dec 2025What's Changed feat: Add support for streamable http servers by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/69 Full Changelog**: https://github.com/aquasecurity/trivy-mcp/compare/v0.0.18...v0.0.19
v0.0.18v0.0.18 · 4 Dec 2025What's Changed chore: update the core MCP dependencies by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/65 Update README by removing demo section by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/66 chore:…
v0.0.17v0.0.17 · 16 Oct 2025What's Changed chore: bump the trivy version to 0.67.2 by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/63 chore: bump the plugin version by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/64 Full Changelog**:…
v0.0.16v0.0.16 · 1 Oct 2025What's Changed chore: bump the latest version of Trivy by @owenrumney in https://github.com/aquasecurity/trivy-mcp/pull/62 Full Changelog**: https://github.com/aquasecurity/trivy-mcp/compare/v0.0.15...v0.0.16

README

Trivy MCP Server Plugin

GitHub All Releases

https://github.com/user-attachments/assets/125791b0-3164-4dcc-8fb3-e45481a9cbf7

This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.

Features

  • Natural Language Scanning: Ask questions about security issues in natural language
  • Multiple Scan Types:
    • Filesystem scanning for local projects
    • Container image vulnerability scanning
    • Remote repository security analysis
  • Integration with Aqua Platform: Optional integration with Aqua Security's platform for enhanced scanning capabilities and assurance policy compliance
  • Flexible Transport: Support for stdio, streamable HTTP, and SSE (Server-Sent Events) transport protocols
  • IDE Integration: Seamless integration with VS Code, Cursor, JetBrains IDEs, and Claude Desktop

Quick Start

Installation

trivy plugin install mcp

Starting the Server

trivy mcp

Documentation

For comprehensive documentation, please see the docs directory:

Example Query

After setting up the plugin and configuring your IDE, you can start asking security-related questions:

Are there any vulnerabilities or misconfigurations in this project?

For more examples, see the Example Queries page.

License

MIT License - see the LICENSE file for details.

README fetched from the repository 3 hours ago. The original is authoritative.

Questions

About Trivy MCP

How do I install Trivy MCP?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Trivy MCP safe to use with an AI agent?

Its trust score is 66 out of 100 (good). It passes 5 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Trivy MCP still maintained?

The last commit was 10 months ago and 5 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.