This plugin adds an MCP server to Trivy so tools like Cursor and other MCP clients can query security results in natural language. It supports filesystem scans, container image scans, and remote repository analysis, with optional Aqua Platform integration and multiple transport options.
Builders who want their editor or MCP client to ask Trivy about security issues in code, images, and repositories.
You can check security problems from your agent or IDE instead of switching to separate Trivy commands.
You can ask questions about vulnerabilities and misconfigurations in plain language.
It can scan local filesystems, container images, and remote repositories.
It supports stdio, streamable HTTP, and SSE transport.
The README calls out support for VS Code, Cursor, JetBrains IDEs, and Claude Desktop.
It can connect to Aqua Security's platform for extra scanning and assurance policy compliance.
trivy plugin install mcp
trivy mcp
https://github.com/user-attachments/assets/125791b0-3164-4dcc-8fb3-e45481a9cbf7
This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.
trivy plugin install mcp
trivy mcp
For comprehensive documentation, please see the docs directory:
After setting up the plugin and configuring your IDE, you can start asking security-related questions:
Are there any vulnerabilities or misconfigurations in this project?
For more examples, see the Example Queries page.
MIT License - see the LICENSE file for details.
Sign in to join the discussion.
No comments yet. Be the first to say what this is good for.
High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.
Universal provider proxy for OpenAI Codex & Claude Code — use any LLM (Claude, Gemini, Grok, DeepSeek, Ollama…) with Codex CLI, App, SDK, and Claude Code
Git-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zero external databases or dependencies. Built in pure Go.
Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
20 MB lightweight cross-platform database client for 90+ databases, including MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, and Dameng. Built-in AI, MCP Server, CLI, desktop and Docker. | 轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 90+ 数据库，提供桌面端、Docker、CLI、内置 AI 助手和 MCP Server。