MRPS
← Back to Toolkit

Trivy

CLI

Standalone command-line utility run in terminal or subshell.

1. What it does

A comprehensive, fast vulnerability scanner by Aqua Security for containers, file systems, Git repositories, virtual machine images, and software bills of materials (SBOM).

2. Why MRPS selected it

High-speed, multi-ecosystem vulnerability and secret scanning with comprehensive CVE databases.

3. Tool Kind

CLI: Standalone command-line utility run in terminal or subshell.

4. Original repository

https://github.com/aquasecurity/trivy

5. Official documentation

https://aquasecurity.github.io/trivy/

6. Author and license

Created by Aqua Security under the Apache-2.0 license.

7. Installation

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

8. When the AI should use it

Use when auditing project repositories, lockfiles, and container images for known security vulnerabilities (CVEs), leaked secrets, or configuration errors.

9. When the AI should not use it

Do not use for penetration testing or attacking running web applications.

10. What the AI must not do

  • Before you invoke anything, state what you intend to do and why. Do not act until the user confirms. If a rule is ambiguous, ask — do not guess.
  • Always run scans in read-only mode without executing automated patch scripts.
  • Never print exposed raw secrets or private keys into public conversation logs or reports.
  • State whether a fixed package version is available when reporting vulnerability findings.

11. MRPS usage instructions

Read SECURITY.md

12. Last verified

Verified against live repository on: 2026-11-07

View Complete Agent Constraint Sheet
Tool: Trivy When to use: Use when auditing project repositories, lockfiles, and container images for known security vulnerabilities (CVEs), leaked secrets, or configuration errors. When NOT to use: Do not use for penetration testing or attacking running web applications. Invocation: Run trivy fs --severity HIGH,CRITICAL . or trivy repo <url>. Rules: - Before you invoke anything, state what you intend to do and why. Do not act until the user confirms. If a rule is ambiguous, ask — do not guess. - Always run scans in read-only mode without executing automated patch scripts. - Never print exposed raw secrets or private keys into public conversation logs or reports. - State whether a fixed package version is available when reporting vulnerability findings.