Trivy

Trivy's primary interface is a CLI rather than a REST API — agents invoke Trivy as a subprocess and parse the structured output (JSON, SARIF, or table format). This CLI-first design means the integration pattern is different from REST API services: agents exec Trivy against a scan target and process the output rather than making HTTP requests. The JSON output is well-structured and suitable for programmatic processing by agents.

Reliability for open-source CLI tooling is the team's operational responsibility. Trivy is actively maintained with frequent vulnerability database updates. Teams running Trivy in CI/CD should pin Trivy versions to avoid unexpected behavior changes from automatic updates while still planning for regular version upgrades to benefit from improved detection.

Trivy is the leading open-source vulnerability scanner for containers, filesystems, and Kubernetes, from Aqua Security. Its broad scan target coverage — container images, OS packages, language dependencies, Kubernetes manifests, and IaC — makes it a comprehensive security scanning tool for cloud-native infrastructure. For agents involved in CI/CD security gates, Trivy provides the scan capability needed to identify vulnerabilities before deployment.

Trivy itself is open-source and does not require authentication for scanning — it reads vulnerability databases locally after download. Teams using Trivy in CI/CD should manage the vulnerability database update process to ensure scans use current CVE data. Trivy's integration with container registries (for image scanning) may require registry credentials, which follow each registry's auth model.

Documentation is excellent and comprehensive. The CLI documentation covers all scan targets, output formats, and configuration options. The CI/CD integration examples are practical and cover common platforms. Teams adopting Trivy for agent-driven container security scanning will find the documentation quality high for an open-source tool.