Trivy MCP Server

trivy plugin install mcp

This is distributed as a Trivy plugin rather than a standalone binary, installed with a single plugin command and started with trivy mcp. The consequence matters: it drives the Trivy that is already on the machine, with its existing vulnerability database and cache, instead of shipping a second scanner that drifts out of sync. Scan targets cover the local filesystem, container images and remote repositories, so the same conversation can move from a dependency finding to the image that ships it. Transport is flexible — stdio, streamable HTTP or SSE — and an optional Aqua Platform connection adds assurance policy checks for teams that already run one.