drio
Open app

Trivy Security Scanner MCP Server

Source

A Model Context Protocol (MCP) server that provides Trivy security scanning capabilities through a standardized interface.

Catalog onlyCatalog onlySTDIO

Overview

Trivy Security Scanner MCP Server is a Model Context Protocol (MCP) server that provides Trivy security scanning capabilities through a standardized interface, designed for experimentation and learning purposes.

To use the server, install the required dependencies, start the server using the command python server.py --transport sse --port 54321, and configure it in Cursor IDE to automatically scan for vulnerabilities when dependencies are modified.

  • 🔍 Project Scanning: Automatically scans project directories for security vulnerabilities using Trivy. - 🛠️ Automated Fixes: Updates vulnerable dependencies to secure versions automatically. - 📦 Multi-Package Support: Supports multiple package managers including Python, Node.js, Ruby, and Go.
  1. Scanning a project for security vulnerabilities before deployment.
  2. Automatically fixing vulnerable dependencies during development.
  3. Integrating security checks into the development workflow with Cursor IDE.

Add to your AI client

Use these steps to connect Trivy Security Scanner MCP Server in Cursor, Claude, VS Code, and other MCP-compatible apps. The same JSON appears in the Use with menu above for one-click copy.

Cursor

Add this to your .cursor/mcp.json file in your project root, then restart Cursor.

.cursor/mcp.json

{
  "mcpServers": {
    "cursor-mcp-trivy-norbinsh": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

Claude Desktop

Add this server entry to the mcpServers object in your Claude Desktop config, then restart the app.

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

{
  "mcpServers": {
    "cursor-mcp-trivy-norbinsh": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

Claude Code

Add this to your project's .mcp.json file. Claude Code will detect it automatically.

.mcp.json (project root)

{
  "mcpServers": {
    "cursor-mcp-trivy-norbinsh": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

VS Code (Copilot)

Add this to your .vscode/mcp.json file. Requires the GitHub Copilot extension with MCP support enabled.

.vscode/mcp.json

{
  "servers": {
    "cursor-mcp-trivy-norbinsh": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

Windsurf

Add this to your Windsurf MCP config file, then restart Windsurf.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "cursor-mcp-trivy-norbinsh": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

Cline

Open Cline settings, navigate to MCP Servers, and add this server configuration.

Cline MCP Settings (via UI)

{
  "mcpServers": {
    "cursor-mcp-trivy-norbinsh": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-cursor-mcp-trivy-norbinsh"
      ]
    }
  }
}

FAQ

Is this project production-ready?

No, this is a proof of concept project intended for experimentation and learning purposes only.

What are the prerequisites for using this server?

You need Python 3.12 or higher and Trivy installed on your system.

How does the server integrate with Cursor IDE?

You can configure the server in Cursor IDE to automatically trigger security scans when dependency files are modified.7:["$","div",null,{"className":"container mx-auto flex flex-col gap-4","children":["$L26","$L27",["$","$L28",null,{"currentProject":{"id":1291,"uuid":"420dff36-03ea-4095-8707-c5ab7de8ce87","name":"cursor-mcp-trivy","title":"Trivy Security Scanner MCP Server","description":"A Model Context Protocol (MCP) server that provides Trivy security scanning capabilities through a standardized interface.","avatar_url":"https://avatars.githubusercontent.com/u/12733941?v=4","created_at":"2025-02-20T14:38:02.876Z","updated_at":"2025-02-23T07:20:28.312Z","status":"created","author_name":"norbinsh","author_avatar_url":"https://avatars.githubusercontent.com/u/12733941?v=4","tags":"trivy,security-scanner,mcp-server","category":"security","is_featured":false,"sort":1,"url":"https://github.com/norbinsh/cursor-mcp-trivy","target":"_self","content":"$29","summary":"$2a","img_url":"https://github.com/norbinsh/cursor-mcp-trivy/raw/main/images/mcp-trivy-demo.gif","type":null,"metadata":null,"user_uuid":null,"tools":null,"sse_url":null,"sse_provider":null,"sse_params":null,"is_official":false,"server_command":null,"server_params":null,"server_config":null,"allow_call":false,"is_innovation":false,"is_dxt":false,"dxt_manifest":null,"dxt_file_url":null,"is_audit":false},"randomProjects":[],"currentServerKey":"$undefined"}]]}]

Security