Skip to content
ProductArena

How Trivy’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score27/100

Agent-ready 43.0 × 0.30 = 12.90

API quality 0.0 × 0.20 = 0.00

Openness 46.5 × 0.20 = 9.30

Built-in AI 20.0 × 0.15 = 3.00

Automation 12.0 × 0.15 = 1.80

(12.90 + 0.00 + 9.30 + 3.00 + 1.80) ÷ (0.30 + 0.20 + 0.20 + 0.15 + 0.15) = 27.00 ÷ 1.00 = 27.0

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready43.0/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
  • [probe] https://trivy.dev/docs/latest/guide/.md“PROBE docs-md: HTTP 404 at https://trivy.dev/docs/latest/guide/.md”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

  • [github] https://github.com/aquasecurity/trivy“trivy k8s --report summary cluster”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
  • [community] https://hn.algolia.com/api/v1/items/29181577“I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
  • [community] https://hn.algolia.com/api/v1/items/29181577“we use AquaSec and it's absolutely the same engine. Trivy is so good we were tempted to drop AquaSec entirely as we only use it in our CI and this covers our requirements.”
  • [community] https://hn.algolia.com/api/v1/items/29181577“it's super easy to integrate in every ci/cd pipeline”
  • [probe] https://github.com/aquasecurity/trivy“official CLI documented at https://github.com/aquasecurity/trivy”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

Connect an agent via an official MCP serverweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“**Natural Language Scanning**: Ask questions about security issues in natural language”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

Use an official CLIweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

  • [github] https://github.com/aquasecurity/trivy“trivy k8s --report summary cluster”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
  • [probe] https://github.com/aquasecurity/trivy“official CLI documented at https://github.com/aquasecurity/trivy”
  • [claimed-docs] https://trivy.dev/docs/latest/target/container_image/“It detects known vulnerabilities in your container image... `$ trivy image [YOUR_IMAGE_NAME]`”
  • [community] https://hn.algolia.com/api/v1/items/29181577“I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
  • [community] https://hn.algolia.com/api/v1/items/29181577“it's super easy to integrate in every ci/cd pipeline”

Drive the product through a documented public APIweight 3

3 (weight) × 6 (quality) × 0.6 (partial) = 10.8 of 30 max

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“**Natural Language Scanning**: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”
  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”

Issue scoped/least-privilege API credentials for an agentweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Build against official SDKsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”

Subscribe to events via webhooksweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [github] https://github.com/aquasecurity/trivy“trivy k8s --report summary cluster”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”

Agent-ready = 68.8 ÷ 160 × 100 = 43.0

API quality0.0/100×0.20 of the PA blend

The programmable surface once an agent is there — machine-readable spec, interactive docs, sandbox, versioning discipline.

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 10 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”

API quality = 0.0 ÷ 70 × 100 = 0.0

Openness46.5/100×0.20 of the PA blend

Can you leave, inspect, or self-host — data export, open source, portability.

Do everything through the API that I can do in the UIweight 2

n/a — not applicable to this product: excluded from numerator and denominator

  • [probe] https://trivy.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, https://trivy.dev/.well-known/openapi.json)”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
  • [probe] https://trivy.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”

Export all of my data in open formats and leaveweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

  • [claimed-docs] https://trivy.dev/docs/latest/supply-chain/sbom/“Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”
  • [claimed-docs] https://trivy.dev/docs/latest/supply-chain/sbom/“Trivy can generate the following SBOM formats.”
  • [claimed-docs] https://trivy.dev/docs/latest/supply-chain/sbom/“Trivy can generate the following SBOM formats. * CycloneDX * SPDX”
  • [claimed-docs] https://trivy.dev/docs/latest/target/filesystem/“Trivy can generate SBOM for local projects.”

Read the product's source under an open licenseweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [github] https://github.com/aquasecurity/trivy“trivy k8s --report summary cluster”
  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
  • [claimed-docs] https://trivy.dev“After evaluating several leading options for open source vulnerability scanning, Trivy really stood out”
  • [probe] https://github.com/aquasecurity/trivy“official CLI documented at https://github.com/aquasecurity/trivy”

Self-host the core productweight 3

3 (weight) × 7 (quality) × 1.0 (full) = 21.0 of 30 max

  • [github] https://github.com/aquasecurity/trivy“Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
  • [probe] https://github.com/aquasecurity/trivy“official CLI documented at https://github.com/aquasecurity/trivy”
  • [claimed-docs] https://trivy.dev“After evaluating several leading options for open source vulnerability scanning, Trivy really stood out”

Openness = 37.2 ÷ 80 × 100 = 46.5

Built-in AI20.0/100×0.15 of the PA blend

Inside-out: how agentic the product itself is for its users — built-in assistants, autonomous features.

Get AI-generated insights and suggestions from my data inside the productweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“**Natural Language Scanning**: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [community] https://hn.algolia.com/api/v1/items/29181577“it's super easy to integrate in every ci/cd pipeline”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

Operate the product with natural-language commandsweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“Natural Language Scanning: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“**Natural Language Scanning**: Ask questions about security issues in natural language”
  • [claimed-docs] https://github.com/aquasecurity/trivy-mcp“This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-enabled tools.”
  • [probe] https://github.com/aquasecurity/trivy-mcp“official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

Built-in AI = 18.0 ÷ 90 × 100 = 20.0

Automation12.0/100×0.15 of the PA blend

Depth of automation primitives — rules, scheduling, bulk operations, webhooks.

Perform bulk operations across many items at onceweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

  • [github] https://github.com/aquasecurity/trivy“trivy k8s --report summary cluster”
  • [community] https://hn.algolia.com/api/v1/items/29181577“I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
  • [community] https://hn.algolia.com/api/v1/items/29181577“it's super easy to integrate in every ci/cd pipeline”
  • [claimed-docs] https://trivy.dev/docs/latest/target/filesystem/“Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Schedule recurring jobs or workflowsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Automation = 6.0 ÷ 50 × 100 = 12.0