Skip to content
SPECIFICTION
Get listed

Trivy

trivy.dev

Free plan WindowsmacOSLinuxSelf-hosted
Visit trivy.dev
Spec score 8.2 #6 of 29 in Container Image Scanning Tools

What it is

Trivy is a free, Apache-2.0-licensed scanner for code repositories, binary artifacts, container images, and Kubernetes clusters. Its scanners cover vulnerabilities, infrastructure-as-code misconfigurations, secrets, and licenses, and it can generate software bills of materials. Vulnerability checks include operating-system and language-specific packages, some non-packaged software, and Kubernetes components. Configuration checks cover Docker, Kubernetes, Terraform, and CloudFormation files, and users can write custom checks. Trivy supports ecosystems including Ruby, Python, PHP, Node.js, .NET, Java, Go, Rust, C/C++, Elixir, Dart, Swift, Julia, and operating-system packages. It can run as a CI/CD binary without middleware or database dependencies and can be used in air-gapped environments. Installation options include container images, release binaries, package repositories, Homebrew, and Windows downloads; official integrations include Azure DevOps and GitHub Actions. Results can be exported as JUnit XML, SARIF, and ASFF. The vulnerability scanner documentation says third-party or self-compiled packages and binaries are unsupported, and the scanner may skip third-party packages. Trivy automatically fetches and maintains the security databases it needs for scans. The project is identified as Go software under the Apache-2.0 License; Aqua Security is listed as founded in 2015 with headquarters in Boston and Ramat Gan.

Spec sheet

Purpose
Trivy scans code repositories, binary artifacts, container images, and Kubernetes clusters for vulnerabilities and misconfigurations.Read 4 Oct 2026 · trivy.dev
Deployment
Aqua says Trivy can be installed as a binary for CI/CD and does not require middleware or database dependencies.Read 4 Oct 2026 · aquasec.com
License
The Trivy homepage identifies the project as Go software under the Apache-2.0 License.Read 4 Oct 2026 · trivy.dev
Headquarters
Boston, Massachusetts, and Ramat Gan, IsraelRead 28 Sep 2026 · trivy.dev
Founded
2015Read 28 Sep 2026 · trivy.dev
Company
Aqua says it was founded in 2015 and is headquartered in Boston and Ramat Gan, Israel.Read 4 Oct 2026 · aquasec.com
Air-gapped use
Aqua says Trivy can run in air-gapped environments.Read 4 Oct 2026 · aquasec.com
CI integrations
The docs list official Azure DevOps and GitHub Actions integrations, alongside community integrations for other CI systems.Read 4 Oct 2026 · trivy.dev
CI/CD integrations
The ecosystem documentation lists an official Azure DevOps Pipelines Task and an official GitHub Action for integrating Trivy into pipelines.Read 4 Oct 2026 · trivy.dev
Coverage limit
The vulnerability scanner documentation says Trivy does not support third-party or self-compiled packages and binaries.Read 4 Oct 2026 · trivy.dev
Database handling
Trivy automatically fetches and maintains the security databases it needs for scans.Read 4 Oct 2026 · trivy.dev
IaC checks
Built-in misconfiguration checks cover files such as Docker, Kubernetes, Terraform, and CloudFormation, and users can write custom checks.Read 4 Oct 2026 · trivy.dev
IaC scanning
Trivy provides infrastructure-as-code misconfiguration scanning.Read 4 Oct 2026 · aquasec.com
IDE integrations
The integrations documentation lists official plugins for VS Code and JetBrains IDEs.Read 4 Oct 2026 · trivy.dev
Install options
Official installation options include container images, GitHub release binaries, package repositories, Homebrew, and Windows downloads.Read 4 Oct 2026 · trivy.dev
Kubernetes integration
Trivy Operator can be installed in a Kubernetes cluster to automatically and continuously scan workloads and the cluster for security issues.Read 4 Oct 2026 · trivy.dev
Maintainer support distinction
The documentation says official integrations are developed and supported by the core Trivy team, while community integrations are not guaranteed to be secure or maintained.Read 4 Oct 2026 · trivy.dev
Output formats
Aqua says Trivy can export results in formats including JUnit XML, SARIF, and AWS Security Finding Format (ASFF).Read 4 Oct 2026 · aquasec.com
Plugin security
Trivy plugins run with the user's permissions and are not sandboxed; publicly available plugins are not audited for security.Read 4 Oct 2026 · trivy.dev
SBOM
Trivy supports SBOM output, which its documentation describes as an output format rather than a scanner.Read 4 Oct 2026 · trivy.dev
Scanner types
Trivy has vulnerability, misconfiguration, secret, and license scanners.Read 4 Oct 2026 · trivy.dev
Secrets scanning
Trivy includes a secret scanner.Read 4 Oct 2026 · trivy.dev
Supported installation platforms
Official installation options include Windows, macOS, Linux, and FreeBSD; Trivy is also available as an official container image.Read 4 Oct 2026 · trivy.dev
Vulnerability coverage
It detects known vulnerabilities in operating-system packages, language-specific packages, some non-packaged software, and Kubernetes components.Read 4 Oct 2026 · trivy.dev
Vulnerability coverage limit
Trivy focuses on packages from official operating-system vendors and may skip third-party packages.Read 4 Oct 2026 · trivy.dev
Vulnerability scanning
Trivy detects known vulnerabilities in OS packages, language-specific packages, non-packaged software, and Kubernetes components.Read 4 Oct 2026 · trivy.dev
What it scans
Trivy scans code repositories, binary artifacts, container images, and Kubernetes clusters for vulnerabilities and infrastructure-as-code misconfigurations.Read 4 Oct 2026 · trivy.dev

Plans and prices

Trivy Free Apache-2.0 licensed open-source scanner Read 4 Oct 2026 · trivy.dev

Every Trivy plan and price →

Strong points and limits

Strong points

  • Scans vulnerabilities, misconfigurations, secrets, and licenses
  • Generates software bills of materials
  • Supports custom infrastructure-as-code checks
  • Can operate in air-gapped environments
  • Official Azure DevOps and GitHub Actions integrations

Limits

  • Third-party or self-compiled packages and binaries are unsupported
  • Third-party packages may be skipped
  • Plugins run unsandboxed with user permissions

Who it suits

It suits teams or developers scanning repositories, artifacts, container images, or Kubernetes environments for security issues. Its CI/CD integrations, self-hosted deployment option, and air-gapped operation may be relevant to pipeline and isolated-environment use.

Verdict

Trivy combines several scanner types with SBOM generation and integrations for pipeline use. Its documented package-coverage limits and unsandboxed plugin permissions are important considerations.

Where Specifiction places it

Alternatives to TrivyAll alternatives →