# Copa (Project Copacetic)

**Canonical:** https://apis.io/providers/copa/  
**Website:** https://project-copacetic.github.io/copacetic/website/  
**APIs profiled:** 3

Project Copacetic (Copa) is an open source command line tool that patches container images directly using BuildKit, without requiring a full image rebuild. Copa parses vulnerability scan reports from Trivy and other scanners, applies the corresponding OS package updates via the appropriate package manager (apt, apk, dnf, tdnf, yum, zypper), and produces a new container image with a patched layer. Copa supports multi-platform images, distroless images, and custom scanner plugins through the Vulnerability Exchange (VEX) and pluggable scanner interface.

## Kin Score — 17.7 / 100 (emerging)

Scored 2026-08-20 under rubric 0.12.0. Trend: flat (+0.0 from 17.7).

| Facet | Score |
|---|---|
| Discoverability | 74.1 |
| Contract Quality | 0.0 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 36.8 |
| Developer Ergonomics | 11.9 |
| Commercial Clarity | 15.8 |
| Access Clarity | 15.8 |

## Agent readiness — 3.0 (human-only)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## Access

Freemium — onboarding: unknown, pricing: freemium, trial: no (confidence: medium).

## APIs (3)

- **Copa CLI** — The copa command line interface used to patch container images. The core subcommand `copa patch` accepts an image reference and an optional vulnerability report and produces a n...
- **Copa Scanner Plugin Interface** — Copa exposes a plugin interface that allows third-party vulnerability scanners to feed reports into the patcher. Out of the box, Copa supports Trivy JSON reports and provides do...
- **Copa VEX Output** — Copa can emit a Vulnerability Exchange (VEX) document describing which CVEs were patched. VEX documents help security teams and downstream consumers verify that an image has bee...

## Plans (1)

- **Copa Plans Pricing**

## Tags

BuildKit, CLI, CNCF Sandbox, Container Patching, Containers, Open-Source, Security, Trivy, Vulnerability Management

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/copa/). Scores are computed from the provider's own public artifacts under a published rubric.