CODE SECURITY / Aqua Security
Trivy MCP
Aqua Security plugin that exposes Trivy scans to MCP clients for a local filesystem, a container image, or a remote repository.
“Installs as a Trivy plugin, starts with trivy mcp, and defaults to stdio while also documenting streamable HTTP and SSE.”
01 / THE REASONING
Why this made the selection.
- The catalogue has Semgrep and Snyk-style security servers and no Trivy MCP server.
- The README names filesystem, image, and remote repository scans rather than a single generic scan.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md
- docs/quickstart.md
- LICENSE
Our findings
- The README lists filesystem scanning, container image scanning, remote repository analysis, and optional Aqua Platform assurance.
- docs/quickstart.md says the default transport is stdio and that --transport accepts streamable-http, sse, and stdio, with host localhost and port 23456 for network modes.
- The quick start says --use-aqua-platform defaults to false. This review did not run a scan.
Not established by this review
- The server was not started.
- No scan tool was called.
- trivy plugin install mcp was not run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
trivy plugin install mcpCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The README quick start is that install line, then trivy mcp.
- Network transports are documented in docs/quickstart.md as separate trivy mcp --transport lines.
Before you start
- The Trivy CLI
- An MCP client that can launch a local stdio server
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Trivy MCP README ↗Checked
https://github.com/aquasecurity/trivy-mcp/blob/076c9b4ed23b460a598ba6b3fe644ad73e737113/README.md
Supports: scan types and install line
- Quick start ↗Checked
https://github.com/aquasecurity/trivy-mcp/blob/076c9b4ed23b460a598ba6b3fe644ad73e737113/docs/quickstart.md
Supports: stdio default and other transports
- MIT LICENSE ↗Checked
https://github.com/aquasecurity/trivy-mcp/blob/076c9b4ed23b460a598ba6b3fe644ad73e737113/LICENSE
Supports: MIT grant