How to use Trivy: what you can do with it

3 use cases

• Scan a container image for known vulnerabilities

  Run Trivy image on any image to list CVEs in its OS packages and dependencies.

  • REPO aquasecurity/trivy
  • Claude Code
  • Codex
  • Cursor
  • Security and science
  • Beginner
  View prompt

  Install aquasecurity/trivy and scan my image <image:tag>. Summarize the critical and high vulnerabilities, which ones have fixed versions, and whether switching to <alternative base image> would remove most of them.

  Share Email me this

• Check a project folder for vulnerabilities, secrets and misconfigurations

  Run one Trivy fs command that looks for vulnerable dependencies, leaked secrets and IaC mistakes.

  • REPO aquasecurity/trivy
  • Claude Code
  • Codex
  • Cursor
  • Security and science
  • Beginner
  View prompt

  Run aquasecurity/trivy fs with the vuln, secret and misconfig scanners on <project folder>. Group the findings by type, propose fixes for each, and list any secrets I must rotate.

  Share Email me this

• Get a security summary of a Kubernetes cluster

  Run Trivy k8s to scan a cluster and print a summary report of what needs attention.

  • REPO aquasecurity/trivy
  • Claude Code
  • Codex
  • Cursor
  • Security and science
  • Intermediate
  View prompt

  Using aquasecurity/trivy, run a summary scan of my current Kubernetes context and list the ten workloads with the most critical findings, with a suggested fix for each. Do not change anything in the cluster.

  Share Email me this

Quick start with Trivy

1. Check you have what it needs: Trivy via `brew install trivy`, the aquasec/trivy Docker image, or a release binary; Access to the image, folder, repo or Kubernetes cluster you want to scan.
2. Open aquasecurity/trivy on GitHub and read the README and license.
3. Install with brew install trivy, or use docker run aquasec/trivy
4. Scan an image, for example trivy image python:3.4-alpine
5. Read the results by severity and focus on the packages with fixes available
6. Rebuild on a newer base image and scan again to confirm the count went down

These steps come from our top use case, Scan a container image for known vulnerabilities, which also has a copy-paste agent prompt.

Using the Deduped MCP, get the setup steps for aquasecurity/trivy

claude mcp add --transport http deduped https://dedupedai.com/mcp

Best AI repos for Security and science

About this repo

• Who it is forDevelopers, DevOps and platform teams who want to find vulnerable packages and misconfigurations before they ship.
• Why it is hot39k stars, talked about in 2 AI sources we track
• LanguageGo
• Sourcegithub.com/aquasecurity/trivy · Back to Hot repos

Requirements

• Trivy via `brew install trivy`, the aquasec/trivy Docker image, or a release binary
• Access to the image, folder, repo or Kubernetes cluster you want to scan

Related repos

• Trended earlier REPO google/osv-scanner Osv Scanner OSV-Scanner is Google's officially supported frontend to the OSV database. It finds known vulnerabilities in your project's dependencies across languages and package managers, scans container images layer by layer, checks licenses, can scan offline against a local database, and offers experimental guided remediation that suggests upgrades.
• Trended earlier REPO Mah3Sec/ForgeGuardian Forge Guardian ForgeGuardian is a local-first, Go-based software supply chain security scanner that checks project dependencies across 9 ecosystems with 8 scan engines.
• Trended earlier REPO ZeroDayEvil/ai-security-tool AI Security Tool AI Security Tool is an open-source, cross-platform terminal and vulnerability scanner that combines multi-protocol remote access, CVE and SBOM supply chain auditing, and autonomous AI agents.