aicoolies logo
Trivy logo
Trivy logo

Trivy

Comprehensive open-source vulnerability scanner

open sourceupdated Apr 21, 2026

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

Trivy is a comprehensive open-source security scanner by Aqua Security that has become the de facto standard for container and infrastructure security scanning. With over 24,000 GitHub stars, it covers the broadest range of scanning targets in a single tool.

Trivy scans container images, file systems, Git repositories, Kubernetes clusters, and virtual machine images for known vulnerabilities in OS packages and language-specific dependencies. It also detects IaC misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Dockerfiles.

Additional capabilities include secrets detection for finding leaked credentials, license scanning for compliance, and SBOM generation in CycloneDX and SPDX formats. VEX support allows filtering out vulnerabilities that are not applicable to your specific deployment.

The tool runs as a standalone CLI with zero configuration needed — just point it at a target and get results. It integrates with CI/CD pipelines through GitHub Actions, GitLab CI, Jenkins, and other platforms. Enterprise features are available through Aqua Security's commercial platform.

Pricing

Free and open-source

Platforms

CLI, Docker, GitHub Actions, CI/CD

Categories

Tags

Use Cases

Steel logo

Steel

Open-source browser infrastructure for AI agents at scale

Steel is an open-source browser API purpose-built for AI agents, providing managed headless browser sessions with anti-bot bypass, proxy rotation, CAPTCHA solving, and session persistence. It handles the infrastructure layer that browser automation agents like Browser Use and Stagehand run on top of. Self-hostable or available as a cloud service. Over 6,000 GitHub stars.

Open Source
Trigger.dev logo

Trigger.dev

Open-source background jobs and AI workflows for TypeScript

Trigger.dev is an open-source platform for building and deploying background jobs, AI agents, and long-running workflows in TypeScript. It eliminates serverless timeouts with durable task execution, automatic retries, queue-based concurrency control, and elastic scaling. Used by 30,000+ developers at companies like MagicSchool and Icon.com, it processes hundreds of millions of agent runs monthly. Backed by a $16M Series A led by Dalton Caldwell's Standard Capital fund.

freemiumOpen Source
Dokploy logo

Dokploy

Open-source PaaS alternative to Vercel, Heroku, and Netlify

Dokploy is a free open-source platform-as-a-service for self-hosting applications without cloud vendor lock-in. It provides automated deployments from Git repositories, built-in SSL certificates, database provisioning, Docker and Docker Compose support, and a clean web dashboard for managing multiple applications on your own servers. With 18,000+ GitHub stars, it fills the gap for teams wanting Vercel-like deployment simplicity on their own infrastructure.

Open Source

Related Tools

computed discovery: shared active categories · kept separate from editor-verified Alternatives

KTransformers parent kvcache-ai logo

KTransformers

Heterogeneous CPU-GPU inference and SFT for large MoE models

Open-source framework for running and fine-tuning large Mixture-of-Experts models with heterogeneous CPU-GPU execution, optimized kernels, limited VRAM and SGLang or LLaMA-Factory integrations.

Open Source
vLLM Production Stack parent vLLM logo

vLLM Production Stack

Official Kubernetes and Helm reference stack built on the vLLM inference engine

Official vLLM reference implementation for scaling the existing inference engine on Kubernetes with Helm, request routing, KV-cache offload, autoscaling and Prometheus/Grafana observability.

Open Source
Dynamo logo

NVIDIA Dynamo

Distributed inference orchestration above vLLM, SGLang and TensorRT-LLM

Open-source, datacenter-scale orchestration layer that coordinates vLLM, SGLang and TensorRT-LLM across nodes with disaggregated serving, KV-aware routing, multi-tier cache management and automatic scaling.

Open Source
GPUStack logo

GPUStack

Open-source GPU control plane for scalable AI model serving

Open-source GPU cluster manager that configures vLLM, SGLang, TensorRT-LLM or custom engines, serves models through compatible APIs, and provisions SSH-accessible GPU instances across on-premises, Kubernetes and cloud environments.

Open Source
Mooncake logo

Mooncake

Disaggregated KV cache storage and transfer for LLM serving

Open-source infrastructure for disaggregated LLM serving that pools KV caches across prefill and decode workers, with high-performance transfer, distributed storage and integrations for vLLM and SGLang.

Open Source
ToolHive mascot logo

ToolHive

Run and govern MCP servers across desktop, CLI and Kubernetes

Open-source MCP runtime and governance platform that runs servers in isolated containers, curates registries, enforces access policies, and operates gateways across desktop, CLI, and Kubernetes.

Open Source

Used in Stacks

Comparisons

AccuKnox vs Trivy vs Falco — Kubernetes Security Tools for Runtime Protection & Vulnerability Scanning

Kubernetes security requires multiple layers of defense, from image scanning to runtime threat detection. This comparison examines three leading tools that address different aspects of the Kubernetes security stack: AccuKnox as a comprehensive Zero Trust CNAPP platform with eBPF-powered runtime enforcement, Trivy as a versatile open-source vulnerability scanner for containers and infrastructure, and Falco as the CNCF graduated standard for kernel-level runtime threat detection.

FAQ

What is Trivy?

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

Is Trivy free?

Yes — Trivy is open source and free to use. Free and open-source

Is Trivy open source?

Yes — Trivy is open source.

What are the best Trivy alternatives?

The top editor-verified Trivy alternatives are Steel, Trigger.dev, Dokploy.