Trivy MCP, from Aquasecurity, is a free Model Context Protocol (MCP) server built with Go. It extends Trivy's security scanning to integrate with various MCP-enabled tools and AI assistants. This plugin allows developers, AI engineers, DevOps engineers, and security analysts to embed vulnerability and misconfiguration detection directly into their development workflows. It supports multiple transport protocols, making it adaptable for modern AI-driven development environments. Trivy MCP enhances security practices by enabling natural language queries and automated remediation within familiar IDEs and AI clients.

What does Trivy MCP connect to?

Trivy MCP functions as a Model Context Protocol (MCP) server, connecting Trivy's security scanning capabilities with various MCP-enabled tools and AI assistants. MCP is an open standard designed to link AI assistants with external data sources and tools, enabling richer interactions. This integration allows it to operate within modern AI-driven development environments, providing essential security insights directly where developers work. It supports stdio, streamable HTTP, and Server-Sent Events (SSE) transport protocols, ensuring flexible and efficient communication with diverse client applications and IDEs.

Core features and tools

The server exposes several callable tools for security operations. Users can employ scan_project to identify security vulnerabilities and misconfigurations within project directories, providing detailed analysis results. It also offers a tool for "Automated Fixes" to update vulnerable packages to secure versions, significantly simplifying remediation efforts. Additional capabilities include fix_vulnerability for targeted remediation actions and get_vulnerability_details to retrieve specific information about identified security issues. These tools enable direct interaction with security scanning and remediation processes.

Who is it for?

Trivy MCP targets a broad audience including developers, AI engineers, DevOps engineers, and security analysts. It is designed for those who wish to integrate security checks directly into their development and AI-driven workflows, enhancing security posture early in the development cycle. The tool supports scenarios like asking natural language questions about security issues in an IDE or automating vulnerability fixes. This is not the right fit if your development environment does not use MCP-enabled tools or AI assistants.

How to get started

No credentials are required by default. Optional authentication for Aqua Platform integration involves configuring the MCP Server with AQUA_KEY and AQUA_SECRET environment variables, supporting stdio, streamable HTTP, and SSE transport protocols.

Use cases

• Natural language scanning for security issues, allowing users to ask questions like "Are there any vulnerabilities or misconfigurations in this project?" directly in their IDE.
• Automated fixes, where the tool can automatically update vulnerable packages to secure versions.
• Continuous security checks, by automatically triggering scans when dependency files or Infrastructure as Code (IaC) files are modified.

Trivy MCP provides a valuable bridge between security scanning and AI-driven development. It enables developers and security teams to integrate vulnerability detection and automated remediation directly into their existing workflows and AI clients. Its support for various IDEs and AI assistants makes it a versatile tool for enhancing security posture.