Trivy website screenshot

Trivy

Trivy is a comprehensive and versatile open-source security scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, clouds, and more. Trivy runs as a CLI tool, in client/server mode with an HTTP API, and as a Kubernetes Operator (trivy-operator) that continuously scans clusters and generates security reports as native Kubernetes Custom Resources.

3 APIs 0 Features
ContainersKubernetesSBOMSecurityVulnerability ScanningOpen SourceDevSecOpsCloud Security

APIs

Trivy Server API

Trivy can run in client/server mode where the server maintains vulnerability databases and clients submit scan requests. The server exposes HTTP endpoints including /healthz for...

Trivy Operator

The Trivy Operator is a Kubernetes-native security toolkit that automatically scans clusters and generates security reports as Kubernetes Custom Resources. It defines 12 CRDs co...

Trivy CLI

The primary interface for Trivy is its command-line tool, which scans container images, filesystems, Git repositories, Kubernetes clusters, virtual machine images, and SBOMs. Su...

Collections

Trivy Server API

OPEN

Pricing Plans

Trivy Plans Pricing

3 plans

PLANS

Rate Limits

Trivy Rate Limits

5 limits

RATE LIMITS

FinOps

Trivy Finops

FINOPS

Semantic Vocabularies

Trivy Context

25 classes · 0 properties

JSON-LD

API Governance Rules

Trivy API Rules

6 rules · 5 warnings 1 info

SPECTRAL

JSON Structure

Trivy Scan Structure

0 properties

JSON STRUCTURE

Example Payloads

Trivy Health Check Example

4 fields

EXAMPLE

Trivy Vulnerability Report Example

4 fields

EXAMPLE

Kubernetes CRDs

aquasecurity.github.io clustercompliancereports

CRD

aquasecurity.github.io clusterconfigauditreports

CRD

aquasecurity.github.io clusterinfraassessmentreports

CRD

aquasecurity.github.io clusterrbacassessmentreports

CRD

aquasecurity.github.io clustersbomreports

CRD

aquasecurity.github.io clustervulnerabilityreports

CRD

aquasecurity.github.io configauditreports

CRD

aquasecurity.github.io exposedsecretreports

CRD

aquasecurity.github.io infraassessmentreports

CRD

aquasecurity.github.io rbacassessmentreports

CRD

aquasecurity.github.io sbomreports

CRD

aquasecurity.github.io vulnerabilityreports

CRD

Resources

🔗
Website
Website
🔗
Documentation
Documentation
🚀
GettingStarted
GettingStarted
👥
GitHubOrganization
GitHubOrganization
👥
GitHubRepository
GitHubRepository
🔗
Trivy Operator
Trivy Operator
👥
GitHub Action
GitHub Action
💻
VS Code Extension
VS Code Extension
🔗
Helm Chart
Helm Chart
🔗
Docker Image
Docker Image
📄
ReleaseNotes
ReleaseNotes
🔗
OpenAPI
OpenAPI
🔗
JSONSchema
JSONSchema
🔗
JSONSchema
JSONSchema
🔗
JSONStructure
JSONStructure
🔗
JSONLD
JSONLD
🔗
SpectralRules
SpectralRules
🔗
Vocabulary
Vocabulary
🔗
x-profiled
x-profiled
🔗
MCPServer
MCPServer

Sources

Raw ↑ 
opencollection: 1.0.0
info:
  name: Trivy Server API
  version: 0.70.0
items:
- info:
    name: Health
    type: folder
  items:
  - info:
      name: Health Check
      type: http
    http:
      method: GET
      url: http://localhost:4954/healthz
    docs: Check if the Trivy server is running and healthy. Returns 200 OK with "ok" body when the server is operational.
      Does not require authentication.
- info:
    name: Server
    type: folder
  items:
  - info:
      name: Get Server Version
      type: http
    http:
      method: GET
      url: http://localhost:4954/version
    docs: Retrieve the Trivy server version, vulnerability database version, Java database version, and policy bundle version.
      Does not require authentication.
bundled: true