Trivy MCP

🚀 Trivy MCP Server Plugin - EXPERIMENTAL WIP

This plugin starts an MCP server that can be used as a gateway for Trivy.

⚠️ Important Note

This is an MCP server in the early stages of development, so assume that the current functionality is incomplete.

📦 Installation

To install the plugin, you can use Trivy's plugin management system.

trivy plugin install mcp

This will install the latest version of the plugin.

🚀 Quick Start

Now you're ready to start the plugin, which will launch an MCP server that can interact with Cursor or VSCode. Currently, we're focusing on VSCode.

trivy mcp

Options

In addition to the global flags supported by Trivy, the following options are available for the MCP server. You don't need to specify any of these options for now.

💻 Configuration in VSCode

Now we need to configure the server in VSCode to start using it as a proxy.

Prerequisites

• VS Code version >= 1.99.0

Configure the Plugin

You can configure Trivy mcp to start on its own or use the SSE HTTP endpoint.

Configure as stdio

1. Press F1 in VS Code.
2. Search for "Preferences: Open User Settings (JSON)".
3. Find or create the "mcp" block and add the server as follows:

   "mcp": {
      "servers": {
         "Trivy MCP": {
            "command": "trivy",
            "args": [
               "mcp",
               "-t",
               "stdio"
            ]
         }
      }
   }
   

4. After saving, a prompt will appear asking you to Start the server.

Configure as SSE HTTP

1. Start the MCP Server:

   trivy mcp -t sse -p 23456
   

2. Press F1 in VS Code.
3. Search for "Preferences: Open User Settings (JSON)".
4. Find or create the "mcp" block and add the server as follows:

   "mcp": {
      "servers": {
         "Trivy SSE": {
            "type": "sse",
            "url": "http://localhost:23456/sse"
         }
      }
   }
   

5. After saving, a prompt will appear asking you to Start the server.

💻 Usage Examples

⚠️ Important Note

Make sure the chat window is in Proxy mode instead of Question.

File System Scan

For an open project, why not try:

Are there any vulnerabilities or misconfigurations in this project?

Image Scan

You can query images for information.

Are there any vulnerabilities in the python:3.12 image?

Repository Scan

Find out about the vulnerabilities in a remote repository.

What vulnerabilities exist in github.com/aquasecurity/trivy-ci-test?