What is Trivy?
Trivy is a single Go binary that looks for security problems in the things you ship. Its targets are container images, filesystems, remote Git repositories, virtual machine images and Kubernetes clusters; its scanners find known vulnerabilities (CVEs) in OS packages and language dependencies, misconfigurations in Terraform, Dockerfiles, Helm charts and Kubernetes manifests, hard-coded secrets and software licences, and it writes SBOMs.
Nothing in it is specific to AI, but an AI stack is mostly ordinary software: a model-serving image built on CUDA and Python, a requirements file with hundreds of packages, and the Terraform or Helm that deploys it. Trivy scans all three with the same command line, and its secret scanner has a rule for Hugging Face access tokens. A separate plugin, trivy-mcp, runs Trivy as an MCP server so a coding agent can ask for a scan.
Trivy is Apache-2.0 and maintained by Aqua Security, which sells a commercial platform built on a fork of it. Integrations include an official GitHub Action (trivy-action), a Kubernetes operator and a VS Code extension.
Is Trivy worth it?
Trivy is the broadest free scanner for the parts of an AI system that are not the model: one binary covers CVEs in a vLLM or PyTorch image, vulnerable packages in a Python lockfile, an S3 bucket left public in Terraform and an API key committed by mistake. About 39,100 GitHub stars and a release every few weeks (v0.76.2 shipped on 5 November 2026) make it the default in many CI pipelines, and its JSON, SARIF and CycloneDX output feeds most dashboards.
For AI work the useful habit is scanning the serving image, not only your code. GPU base images are large and old packages hide in them, and Trivy reports them by layer. It does not inspect model weights for pickle exploits, test prompts or judge an agent; garak, PyRIT and the skill scanners do that. The trivy-mcp plugin lets Claude Desktop, Cursor or VS Code ask for a filesystem, image or repository scan in plain language, but it is small (58 stars), has had no release since v0.0.20 on 17 December 2025, and with an Aqua key it sends results to Aqua's platform.
The catch: Trivy was the entry point of the TeamPCP campaign that later hit LiteLLM. According to Aqua's advisory (CVE-2026-33634), attackers who had obtained a privileged token in late February kept access because the credential rotation after the 1 March disclosure was not atomic. On 19 March 2026 they published a malicious Trivy v0.69.4, live for about 3 hours on GitHub, GHCR, ECR Public, Docker Hub and the deb and rpm repositories; force-pushed 76 of 77 tags of trivy-action (about 12 hours) and all 7 tags of setup-trivy (about 4 hours) to code that dumped CI runner memory and sent secrets to a look-alike domain; and on 22 March pushed images 0.69.5 and 0.69.6 to Docker Hub with separately stolen credentials, live for about 10 hours. The malicious code never reached Trivy's main branch. LiteLLM says the PyPI token used to poison its releases on 24 March was taken through Trivy in its own CI pipeline.
Aqua removed the artefacts, re-published trivy-action tags with a v prefix pointing at the original commits, restored Docker Hub's latest tag to 0.69.3, published indicators of compromise and signature checks, and brought in the incident response firm Sygnia; it says its commercial platform, which builds from a separate fork, was not affected. The advice that follows is the general rule for security tools in CI: pin actions to full commit SHAs and images to digests, and treat a scanner as code that can read every secret in the job.
Our take: a scanner earns its place by being boring, and Trivy is boring in the right ways: fast, broad and free. Grype and Snyk cover similar ground, and the March incident is an argument for pinning rather than for switching.
Where it earns its place
An ML platform engineer running vLLM on Kubernetes
Know which CVEs are in the serving image before it reaches the cluster
Run trivy image on the built image in CI, fail on HIGH and CRITICAL with fixes available, and upload SARIF to GitHub code scanning. Free; the vulnerability database is downloaded on each run unless you cache it.
A two-person startup shipping a RAG app on AWS
Catch a public bucket or an open security group before Terraform applies it
trivy config on the Terraform folder flags misconfigurations in seconds and trivy fs --scanners secret checks for committed keys, including Hugging Face tokens. No account or licence needed.
A head of security after the March 2026 incident
Keep Trivy in CI without trusting mutable tags again
Pin trivy-action to a full commit SHA and the image to a digest, verify release signatures with cosign as Aqua's advisory shows, and rotate any secret a pipeline exposed on 19 to 20 March 2026.
Before you commit
- Setup
- brew install trivy, docker run aquasec/trivy or a release binary; trivy image python:3.12 then returns a report once the vulnerability database has downloaded on first run.
- Integrations
- GitHub Action (trivy-action), setup-trivy, Kubernetes operator, VS Code extension, SARIF and CycloneDX output; the trivy-mcp plugin serves MCP over stdio by default or HTTP on localhost port 23456.
- Data and privacy
- Runs locally and sends no scan results anywhere by default, but anonymous usage telemetry (a hashed installation ID, version, OS and non-revealing flags) is on until you pass --disable-telemetry, and it contacts check.trivy.dev for updates unless you add --skip-version-check. The MCP plugin sends results to Aqua only with --use-aqua-platform and a stored key.
- Cost at scale
- Free at any scale; the real costs are CI minutes and database downloads, which teams usually cache or mirror. Aqua's commercial platform is priced on request.
- Limits
- 307 open issues and pull requests; findings are only as current as the downloaded database; no scanning of model weights, notebooks for pickle payloads, prompts or agent tools.
What’s good
- One binary for CVEs, IaC, secrets, licences and SBOMs
- Scans model-serving images, lockfiles and Helm or Terraform alike
- SARIF, JSON and CycloneDX output for CI and dashboards
- Frequent releases and Apache-2.0 licence
What’s not
- Its release and GitHub Action were compromised in March 2026
- Nothing for model files, prompts or agent behaviour
- Anonymous usage telemetry is on by default
- trivy-mcp plugin small and without a release since December 2025
Best for
Platform and ML engineers who want one free check on every image, dependency file and IaC change that ships an AI service.
Trivy alternatives
Trivy: common questions
- Is Trivy worth it?
- Trivy remains the free scanner most AI teams should put in front of their images and IaC, as long as they pin it by digest and remember that in March 2026 the scanner itself was the attack. We rate it 4.3 out of 5.
- How much does Trivy cost?
- Free and open source under Apache-2.0. Aqua Security sells a commercial platform built on Trivy, priced on request; the trivy-mcp plugin is free under MIT.
- What are the downsides of Trivy?
- Its release and GitHub Action were compromised in March 2026; nothing for model files, prompts or agent behaviour; anonymous usage telemetry is on by default; trivy-mcp plugin small and without a release since December 2025.
- Who is Trivy best for?
- Platform and ML engineers who want one free check on every image, dependency file and IaC change that ships an AI service.
- How much does Trivy cost for a team or in production?
- Free at any scale; the real costs are CI minutes and database downloads, which teams usually cache or mirror. Aqua's commercial platform is priced on request.
- Is Trivy safe for company data?
- Runs locally and sends no scan results anywhere by default, but anonymous usage telemetry (a hashed installation ID, version, OS and non-revealing flags) is on until you pass --disable-telemetry, and it contacts check.trivy.dev for updates unless you add --skip-version-check. The MCP plugin sends results to Aqua only with --use-aqua-platform and a stored key.
- What are the best Trivy alternatives?
- The closest alternatives we have reviewed are Snyk Agent Scan, Cisco Skill Scanner and garak.
Answers checked Nov 7, 2026.
Make Trivy? Show this rating on your site
