Snyk vs Trivy

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Snyk
   Snyk✓fullprobed8/10

   Snyk publishes an llms.txt file confirmed live via direct probe (HTTP 200) with structured docs navigation, and also maintains extensive agent-oriented documentation (MCP server setup, Snyk Studio, remediation agent) that an AI agent could be pointed at. missing for 10: no independent/community corroboration of agents actually consuming llms.txt in practice, and no evidence of additional agent-friendly formats (e.g., structured API schemas, since openapi.json probes 404).

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.snyk.io/llms.txt # Snyk User Docs ## Discover Snyk - [Homepage](https://docs.snyk.io/readme.md): …”
   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”
   • [probe] “official MCP server documented at https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”

   proof ↗⚑ flag

   Trivy—none0/10

   Probes confirm no llms.txt exists (404) and no agent-oriented docs format is available; while an MCP server exists (separate axis), there's no evidence of llms.txt or agent-native documentation being served.

   • [probe] “PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://trivy.dev/docs/latest/guide/.md”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   Snyk✓fullprobed9/10

   Snyk CLI is explicitly documented to run locally, in IDEs, and in CI/CD pipelines, with dedicated CI/CD-oriented service account roles (cli-tester-role-template) that grant scoped permissions to run `snyk test`/`snyk monitor` in pipelines, plus headless commands across languages (snyk test, snyk code test, snyk iac test, snyk secrets test). Missing for 10: no explicit named CI plugin/integration docs (e.g., Jenkins/GitHub Actions specifics) or independent hands-on CI automation report beyond docs.

   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands.”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands. The role grants permissions to run `…”
   • [claimed-docs] “This Organization-level role blocks the use of `snyk monitor`.”
   • [claimed-docs] “To perform source code analysis, run `snyk code test` from the root of the Project.”
   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”
   • [probe] “official CLI documented at https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli”

   proof ↗⚑ flag

   Trivy✓fullprobed9/10

   Trivy is a CLI-first tool distributed via brew/docker/binary with commands like `trivy image`, `trivy k8s --report summary`, designed for scripted/automated scanning, and community evidence confirms it's widely integrated into CI/CD pipelines ('super easy to integrate in every ci/cd pipeline', 'very easy to write automation around'). Missing for 10: no first-party CI-specific docs (e.g., GitHub Actions integration guide) cited in the pack, though community corroboration is strong.

   • [github] “trivy k8s --report summary cluster”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “we use AquaSec and it's absolutely the same engine. Trivy is so good we were tempted to drop AquaSec entirely as we only use it in our CI an…”
   • [community] “it's super easy to integrate in every ci/cd pipeline”
   • [probe] “official CLI documented at https://github.com/aquasecurity/trivy”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   Snyk✓fullprobed8/10

   Snyk documents an official local MCP server (Snyk MCP Server, part of Snyk Studio) that agents can connect to for security scanning, corroborated by a probe confirming the official docs page, and usage examples like prompting coding agents with natural language and running /snyk-fix commands in the agent. Missing for 10: independent/hands-on third-party validation of the MCP server working reliably, and more detail on setup/configuration beyond docs snippets.

   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”
   • [claimed-docs] “To validate the MCP server configuration, prompt your coding agent with natural language, for example, "scan my directory for security issue…”
   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [probe] “official MCP server documented at https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio”

   proof ↗⚑ flag

   Trivy✓fullprobed8/10

   Trivy ships an official trivy-mcp plugin that starts a Model Context Protocol server integrating Trivy's scanning with VS Code and other MCP-enabled tools, enabling natural-language security queries — directly matching the story. Missing for 10: independent/hands-on third-party corroboration of the MCP server's reliability beyond vendor docs.

   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round drawn
   Snyk✓fullprobed8/10

   Snyk ships an official, well-documented CLI (snyk/cli) supporting test, monitor, code test, secrets test, and fix --agentic commands, plus explicit AI-native integrations (MCP server, /snyk-fix slash commands, agentic remediation agent) confirming CLI usability in AI-native workflows. missing for 10: no independent/hands-on review specifically validating the CLI's AI-native agentic commands in production use.

   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “To scan your source code, run `snyk code test`.”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”
   • [probe] “official CLI documented at https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli”
   • [probe] “official MCP server documented at https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio”

   proof ↗⚑ flag

   Trivy✓fullprobed8/10

   Trivy is fundamentally shipped as an official CLI (trivy image, trivy fs, trivy k8s, trivy aws) distributed via brew/docker/github release, and community reports confirm it is easy to script and integrate into CI/CD pipelines. Missing for 10: dedicated independent benchmarking of CLI ergonomics for AI-agent use cases and any first-party AI-specific CLI flags (the AI-native/natural-language angle is handled by the separate MCP server, not the core CLI itself).

   • [github] “trivy k8s --report summary cluster”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
   • [probe] “official CLI documented at https://github.com/aquasecurity/trivy”
   • [claimed-docs] “It detects known vulnerabilities in your container image... `$ trivy image [YOUR_IMAGE_NAME]`”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Trivy
   Snyk~partialprobed4/10

   Docs reference a Snyk API/Web product (e.g., running operations on targets, scans, and findings via identifiers or filters), implying a public API exists, but a direct probe for an OpenAPI/swagger spec returned 404s, and there is no dedicated API reference page cited in the evidence pack. This indicates some documented API surface but not a clearly published, comprehensive public API doc. missing for 10: a dedicated public API reference/OpenAPI spec, authentication/rate-limit docs, and independent confirmation of API usage.

   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”

   proof ↗⚑ flag

   Trivy~partialprobed6/10

   Trivy exposes a documented CLI and an official MCP server (trivy-mcp) that explicitly targets AI-agent/natural-language driving of scans, which fits the agenticness/AI-native story. However, probes confirm no OpenAPI/REST API or machine-readable API spec (openapi.json, swagger.json all 404) and no llms.txt, so there's no general-purpose documented public API beyond the CLI/MCP surface. Missing for 10: a formal OpenAPI/REST API spec, broader API documentation beyond MCP, and independent confirmation of MCP server reliability/adoption.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”
   • [probe] “PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”

   proof ↗⚑ flag

6. ai-native userBuild against official SDKs

   weight 2 · round to Snyk
   Snyk~partialprobed3/10

   Snyk documents an SDK for writing custom IaC rules in Rego (install, parse, test, bundle, push) — a real official SDK, but narrowly scoped to IaC rule authoring rather than a general-purpose SDK for building AI-native integrations or agents against Snyk's platform/API. No official multi-language client SDKs for the core Snyk API/scanning capabilities are evidenced, and the OpenAPI spec probe returned 404s. Missing for 10: general-purpose language SDKs (Python/JS/Go) for the Snyk API, evidence of broader AI-native SDK usage beyond the niche IaC rules SDK, and independent corroboration of SDK adoption.

   • [claimed-docs] “Install the SDK using one of these options”
   • [claimed-docs] “The SDK helps you write, debug, test, bundle, and distribute custom rules written in Rego, which can then be used by the Snyk IaC CLI to fin…”
   • [claimed-docs] “Rules are written in Rego.”
   • [claimed-docs] “Snyk provides a `parse` command.”
   • [claimed-docs] “Add unit tests for the rules you have written to verify your rules.”
   • [claimed-docs] “Optionally, once you have generated your custom rules bundle, you can distribute it automatically to one of our supported OCI registries by …”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy's evidence pack documents a CLI, container/filesystem scanning, SBOM generation, and an MCP server plugin, but no official language SDKs (Go/Python/JS client libraries) for developers to build against are mentioned anywhere; probes for llms.txt/openapi also return 404. missing for 10: any documented official SDK/client library, language-specific package for programmatic integration, API reference for building custom tooling.

   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”
   • [probe] “PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”

   proof ↗⚑ flag

7. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Snyk—none0/10

   No evidence in the pack mentions webhooks or event subscription mechanisms; Snyk's integrations are covered via Jira/Slack partner integrations, Broker, MCP server, and CLI, but none describe a webhook subscription API for AI-native event consumption.

   ⚑ flag

   Trivy—none0/10

   Trivy is a CLI security scanner with an MCP server for AI querying, but there is no evidence of webhook subscription/event notification capability anywhere in the docs, GitHub repo, or probes. missing for 10: any webhook API/endpoint, event subscription mechanism, or documentation of push-based notifications.

   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”
   • [github] “trivy k8s --report summary cluster”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”

   proof ↗⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round to Snyk
   Snyk~partialcommunity7/10

   Snyk documents multiple AI-driven insight/suggestion features—DeepCode AI's 85%-accurate autofixes and context-aware risk scoring, an LLM-driven Remediation Agent that generates and applies fix plans, and risk-based prioritization—directly surfaced in the product (IDE, CLI, coding assistants). However, independent community feedback specifically criticizes the quality of Snyk's automated fix/PR suggestions ('disappointed with their PR tools... ended up turning off their automated PRs'), tempering confidence in how well these AI-generated suggestions perform in practice. Missing for 10: independent hands-on validation of the newer DeepCode AI/Remediation Agent accuracy claims, and resolution of community concerns about suggestion quality.

   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “DeepCode AI powers 85%-accurate security autofixes and comprehensive app coverage, letting developers build fast while staying secure.”
   • [claimed-docs] “DeepCode AI supports Snyk’s context-aware risk scoring, assessing the popularity of the affected package and the reachability of vulnerable …”
   • [claimed-docs] “It scans your Project with Snyk, generates a fix plan enriched with Snyk security intelligence, applies the fixes, and verifies the result, …”
   • [claimed-docs] “Sort by and prioritize the more important issues by incorporating factors such as issue prevalence, ease of fix, and risk factor into a sing…”
   • [community] “I'm not convinced their tools are better than npm audit + a license checker package... I've been very disappointed with their PR tools, and …”

   proof ↗⚑ flag

   Trivy~partialprobed5/10

   Trivy ships an official MCP server (trivy-mcp) that lets AI tools query scan results via natural language ('Ask questions about security issues in natural language'), which enables AI-generated interaction with Trivy's data, but the evidence never shows Trivy itself producing AI-generated insights, remediation suggestions, or summaries beyond raw scan results being queryable. missing for 10: evidence of AI-generated remediation/insight suggestions produced by Trivy itself, first-party docs detailing what kind of AI reasoning the MCP server enables beyond Q&A, independent hands-on validation of the natural-language feature.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk supports background automation via CI/CD pipeline integration (snyk test/monitor running unattended in pipelines) and an LLM-driven Remediation Agent that autonomously scans, plans, applies, and verifies fixes, plus `snyk monitor` for continuous project tracking. However, most agentic features (Remediation Agent, `snyk fix --agentic`, MCP server prompts) are explicitly framed as human-in-the-loop or invoked on-demand from an IDE/CLI/coding assistant rather than self-scheduling background jobs, and there is no evidence of a scheduler or fully unattended trigger system. Missing for 10: evidence of a scheduling/trigger mechanism for fully unattended runs, independent confirmation that the Remediation Agent operates without human prompts, and clarity that CI/CD scans qualify as 'autonomous' vs event-triggered.

   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “It scans your Project with Snyk, generates a fix plan enriched with Snyk security intelligence, applies the fixes, and verifies the result, …”
   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands. The role grants permissions to run `…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”

   proof ↗⚑ flag

   Trivy~partialprobed4/10

   Trivy is a CLI scanner that community evidence shows is easy to wire into CI/CD pipelines (trivy-comm-14) and it ships an MCP server (trivy-docs-13, trivy-probe-4) that lets agentic tools invoke scans via natural language, which supports background/automated invocation by an AI agent. However there is no documented native scheduler, daemon mode, or first-party 'autonomous background job' feature — automation depends entirely on external CI/cron infrastructure. Missing for 10: evidence of built-in scheduling/daemon mode, first-party autonomous trigger/orchestration docs, and independent confirmation of unattended long-running automation.

   • [community] “it's super easy to integrate in every ci/cd pipeline”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”
   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”

   proof ↗⚑ flag

3. ai-native userDelegate tasks to a built-in AI assistant inside the product

   weight 3 · round to Snyk
   Snyk~partialclaimed7/10

   Snyk documents an LLM-driven 'Remediation Agent' that users delegate remediation tasks to via `snyk fix --agentic` or slash commands in a coding assistant, and it scans, plans, applies, and verifies fixes autonomously — a genuine built-in AI agent. However, this agent operates largely through/inside external coding assistants and the Snyk CLI rather than as a fully self-contained in-product chat assistant, and there's no independent/hands-on corroboration of its reliability. Missing for 10: independent verification of the Remediation Agent's real-world performance, and clearer evidence of a native (non-third-party-assistant) chat/delegation interface within Snyk itself.

   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “It scans your Project with Snyk, generates a fix plan enriched with Snyk security intelligence, applies the fixes, and verifies the result, …”
   • [claimed-docs] “Run /snyk-fix in your coding assistant to scan the project and apply a fix for the top vulnerability.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects.”
   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a CLI/scanner and provides an MCP server (trivy-mcp) so external AI assistants (e.g., in VS Code) can call Trivy's scanning capabilities — this is the reverse relationship of 'delegating tasks to a built-in AI assistant inside the product.' There is no evidence of an assistant embedded within Trivy itself that a user can delegate tasks to.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

4. ai-native userOperate the product with natural-language commands

   weight 2 · round to Snyk
   Snyk✓fullprobed8/10

   Snyk documents an official MCP server plus Snyk Studio hooks for agentic IDEs, explicitly instructing users to prompt their coding agent in natural language (e.g. "scan my directory for security issues"), and supports slash commands like /snyk-fix and /snyk-batch-fix plus an LLM-driven Remediation Agent that plans and applies fixes conversationally. Missing for 10: independent/hands-on corroboration that natural-language commands reliably work end-to-end outside vendor docs.

   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “To validate the MCP server configuration, prompt your coding agent with natural language, for example, "scan my directory for security issue…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”
   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [probe] “official MCP server documented at https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio”

   proof ↗⚑ flag

   Trivy~partialprobed6/10

   Trivy ships an official MCP server (trivy-mcp) explicitly advertised for 'Natural Language Scanning: Ask questions about security issues in natural language,' integrating with VS Code and other MCP-enabled tools, which enables natural-language operation via AI assistants. However, this is a separate plugin, not native to the core CLI, and evidence lacks independent hands-on validation of the natural-language experience quality. Missing for 10: independent/hands-on confirmation of natural-language query accuracy, broader detail on supported commands/scope beyond the one-line docs claim.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Snyk—none0/10

   Snyk has an API/web platform (referenced in snyk-docs-71) but there is no evidence of an interactive API reference with runnable examples; a probe for OpenAPI/Swagger specs at docs.snyk.io returned 404 across all candidate paths, and no docs mention a live API playground or runnable code samples.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”
   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a CLI security scanner with no public API reference; probes confirm no OpenAPI/Swagger spec exists (trivy-probe-3) and no llms.txt (trivy-probe-1). There is no evidence of any interactive API reference with runnable examples.

   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”
   • [probe] “PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Snyk—none0/10

   The evidence includes explicit probes for an OpenAPI/Swagger spec at Snyk's docs domain, all returning 404, and no other citation in the pack references a downloadable OpenAPI file for Snyk's API despite Snyk having a documented REST API (snyk-api-web). No first-party or independent evidence shows a machine-readable API spec is published.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”
   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a CLI/scanner tool, not an API-driven service, but the story asks specifically for a downloadable machine-readable API spec; probes explicitly confirm no OpenAPI/swagger spec exists at any expected location and no llms.txt either. No evidence of any published API spec anywhere in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”
   • [probe] “PROBE llms.txt: HTTP 404 at https://trivy.dev/llms.txt”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round drawn
   Snyk—none0/10

   Snyk's remediation agent and CLI tools operate directly on user code/projects, but the evidence pack contains no mention of a sandbox environment, test/staging mode, or any mechanism to try Snyk's agentic remediation or scanning without touching the user's actual codebase or production configs. Missing for 10: any documented sandbox/staging mode, dry-run isolation for the Remediation Agent, or synthetic test-data environment.

   ⚑ flag

   Trivy—none0/10

   The evidence pack shows Trivy scans real filesystems, images, repos, and IaC configs, and even documents an MCP plugin and CLI, but nothing describes a dedicated sandbox/test environment or non-production test mode that isolates it from production data. No mention of dry-run, mock targets, or staging environment support exists anywhere in the pack.

   ⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Snyk—none0/10

   No evidence of API versioning scheme or a documented deprecation policy; the OpenAPI spec probe returned 404s and no docs reference version lifecycle or deprecation commitments.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.snyk.io/openapi.json, https://docs.snyk.io/swagger.json, https://docs.snyk.io/api/opena…”

   proof ↗⚑ flag

   Trivy—none0/10

   No evidence of versioned APIs or a documented deprecation policy; probes show no OpenAPI spec, and docs evidence never mentions API versioning or deprecation guarantees.

   • [probe] “PROBE openapi: all candidate paths 404 (https://trivy.dev/openapi.json, https://trivy.dev/swagger.json, https://trivy.dev/api/openapi.json, …”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk documents explicit bulk operations: the API/CLI supports running operations on targets, scans, and findings 'one by one or in bulk by providing identifiers or applying a filter' (snyk-docs-71), CLI flags like --all-projects/--yarn-workspaces for testing many projects at once (snyk-docs-43), and /snyk-batch-fix for addressing multiple vulnerabilities at once in agentic workflows (snyk-docs-23). This shows genuine bulk-operation support across CLI, API, and agentic/AI-native fix flows. missing for 10: no independent/hands-on corroboration of bulk API usage at scale, no detail on bulk operation limits or performance, and no evidence of bulk operations for other item types (e.g., bulk policy or ignore rule management).

   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [claimed-docs] “`--yarn-workspaces`: For Yarn Workspaces use the `--all-projects` flag to test and monitor your packages”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”

   proof ↗⚑ flag

   Trivy~partialcommunity5/10

   Trivy's CLI supports scanning multiple targets (images, filesystems, repos) and cluster-wide scans (e.g., trivy k8s cluster), and community evidence confirms it's easy to script and integrate into CI/CD pipelines for batch automation. However, there's no explicit documentation of a dedicated bulk/batch API, parallel multi-target job orchestration, or native support for processing large lists of items in one invocation beyond shell-level scripting. missing for 10: documented bulk/batch processing API, evidence of parallelized multi-target scanning at scale, first-party guidance on bulk operations beyond single-target CLI invocations.

   • [github] “trivy k8s --report summary cluster”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “it's super easy to integrate in every ci/cd pipeline”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Snyk
   Snyk~partialclaimed4/10

   Snyk offers some automated actions triggered by scan events — e.g., automatically opening fix PRs (snyk-docs-21), exporting issues to Jira (snyk-docs-6), and a vaguely-documented 'Policy management' feature (snyk-docs-32) — plus custom Rego-based IaC detection rules (snyk-docs-60/68). However there is no evidence of a general-purpose rule engine or webhook-style 'on event X, trigger action Y' automation framework that an AI-native user could configure themselves. Missing for 10: documented rule/trigger builder, webhook or event-subscription API, examples of custom automated actions beyond PR creation and Jira export.

   • [claimed-docs] “Track and export Snyk issues to your Jira project.”
   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [claimed-docs] “Policy management”
   • [claimed-docs] “Rules are written in Rego.”
   • [claimed-docs] “The SDK helps you write, debug, test, bundle, and distribute custom rules written in Rego, which can then be used by the Snyk IaC CLI to fin…”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a scanner run on-demand or in CI pipelines; the evidence shows no rule-based/event-triggered automation engine (e.g., defining rules that fire actions on events) within Trivy itself—only scan integrations into CI/CD and an MCP server for querying results conversationally. No evidence of a rules engine or event-driven action system.

   ⚑ flag

Agent scanning

1. ai-native userHave an agent run a scan headlessly via the CLI, parse machine-readable results, and file issues for real findings

   weight 3 · round to Trivy
   Snyk~partialclaimed6/10

   Snyk CLI clearly supports headless execution in CI/CD pipelines with a dedicated CI-CD-tester service-account role (snyk-docs-47, snyk-docs-73, snyk-gh-3), and terminal-based test/code-test commands report findings with severity, path, and fix guidance (snyk-gh-4, snyk-gh-5, snyk-gh-6). Jira and Slack integrations exist for tracking/exporting issues (snyk-docs-6, snyk-intdir-1), which supports 'filing issues for real findings.' Missing for 10: explicit documentation of machine-readable output flags (JSON/SARIF) for CLI results, and explicit evidence that an autonomous agent (rather than a human or existing integration) programmatically files issues from parsed CLI output.

   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “Look at the `test` command report in your terminal. The report shows the vulnerabilities Snyk found in the package.”
   • [github] “To scan your source code, run `snyk code test`.”
   • [github] “The report shows the vulnerabilities Snyk found in the package. For each issue found, Snyk reports the severity of the issue, provides a lin…”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands.”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands. The role grants permissions to run `…”
   • [claimed-docs] “Track and export Snyk issues to your Jira project.”
   • [claimed-docs] “Partner integrations Jira and Slack integrations”

   proof ↗⚑ flag

   Trivy~partialcommunity7/10

   Trivy is a CLI-first scanner explicitly designed for headless CI use, with documented commands (trivy image/fs) and structured output formats like SBOM (CycloneDX/SPDX), and community reports confirm it's 'super easy to integrate in every ci/cd pipeline' and easy to script automation around. However, the evidence pack lacks explicit documentation of JSON/table output flags for machine parsing, and there's no evidence of built-in issue-filing/ticketing integration (that would require external glue code an agent would write). missing for 10: explicit --format json output docs, native issue-tracker filing integration, independent validation of an agent successfully parsing results end-to-end.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”
   • [github] “trivy k8s --report summary cluster”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

2. ai-native userWire the scanner into my coding agent so AI-generated code is scanned for issues before it lands

   weight 2 · round to Snyk
   Snyk✓fullprobed8/10

   Snyk Studio provides an official local MCP server and hooks-based integration for agentic dev environments (Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot) so AI-generated code is scanned via natural-language prompts or hooks before landing, plus CLI slash-commands like /snyk-fix for in-agent remediation. missing for 10: independent/hands-on verification of the Studio MCP workflow in production, and detail on automatic pre-commit enforcement (vs. manual prompting).

   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “To validate the MCP server configuration, prompt your coding agent with natural language, for example, "scan my directory for security issue…”
   • [claimed-docs] “The Snyk MCP Server is designed as a local MCP server, running on your system using the Snyk CLI to ensure local file access.”
   • [claimed-docs] “Snyk Studio supports a default hooks-based approach for some agentic development environments (ADEs) to ensure code written by AI coding ass…”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [claimed-docs] “Run /snyk-fix in your coding assistant to scan the project and apply a fix for the top vulnerability.”
   • [probe] “official MCP server documented at https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio”

   proof ↗⚑ flag

   Trivy~partialprobed6/10

   Trivy ships an official MCP server (trivy-mcp) that integrates with VS Code and other MCP-enabled tools, letting coding agents invoke Trivy's scanning and query results in natural language — a direct fit for wiring into an AI coding agent. However, evidence is limited to first-party docs with no independent hands-on account of this specific workflow catching AI-generated code issues pre-merge. Missing for 10: independent/hands-on validation of the MCP integration in real agent workflows, and specifics on scanning AI-generated code specifically before it lands (e.g., pre-commit/pre-merge gating via the agent).

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

Ci gates

1. devops-leadRun scans in CI on every pull request and fail the build on new findings via exit codes

   weight 3 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk CLI is explicitly documented to run in CI/CD pipelines (snyk-gh-3, snyk-gh-7), with a dedicated CLI Tester role for CI/CD service accounts to run `snyk test`/`monitor` (snyk-docs-47, snyk-docs-73), and PR inline-comment integration is documented (snyk-docs-50). However, the evidence never explicitly confirms exit-code-based build failure behavior or documents a PR-triggered scan gating workflow. Missing for 10: explicit documentation of exit codes/build-fail behavior, explicit PR-trigger CI config examples, independent hands-on confirmation of CI gating working as described.

   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands.”
   • [claimed-docs] “This Organization-level role allows service accounts in CI/CD pipelines to run basic Snyk CLI commands. The role grants permissions to run `…”
   • [claimed-docs] “see the issues in the PR if you are using the inline comments capability, and view the details in the Snyk portal”

   proof ↗⚑ flag

   Trivy~partialcommunity4/10

   Evidence confirms Trivy is widely used in CI/CD pipelines and is 'super easy to integrate' (trivy-comm-14, trivy-comm-11), and its scanning targets (image, filesystem, git) support PR-triggered scans, but the pack lacks any documentation of exit-code flags, fail-on-new-findings logic, or CI-specific configuration (e.g., GitHub Actions, exit-code thresholds). Missing for 10: explicit docs on --exit-code / --exit-on-eol flags, examples of failing CI builds on new vs. baseline findings, and first-party GitHub Actions/pipeline integration guides.

   • [community] “it's super easy to integrate in every ci/cd pipeline”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”

   proof ↗⚑ flag

2. developerSee scan findings surfaced as pull-request comments or checks in GitHub or GitLab

   weight 2 · round to Snyk
   Snyk~partialclaimed5/10

   Docs confirm Snyk integrates scanning results into 'repositories' and 'source code managers' and supports GitHub/GitLab via Snyk Broker (snyk-intdir-3, snyk-intdir-4), plus CI/CD pipeline integration (snyk-docs-18, snyk-gh-3) and PR-based fix workflows (snyk-docs-21). However, no evidence explicitly describes PR comments or GitHub/GitLab check-run surfaces for findings—only generic 'integrations' and 'fix PR' language. Missing for 10: explicit documentation or screenshot of PR comment/check UI, independent confirmation of check-status behavior, and GitLab-specific PR comment support.

   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [claimed-docs] “By scanning code in real-time and providing actionable insights directly in the developer workflow across IDEs, repositories, and CI/CD pipe…”
   • [claimed-docs] “Real-time code scanning Integrations with IDE, CLI, and source code managers”
   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [claimed-docs] “GitHub - install and configure Snyk Broker”
   • [claimed-docs] “GitLab - install and configure Snyk Broker:”

   proof ↗⚑ flag

   Trivy—none0/10

   No evidence in the pack mentions PR/MR comments, GitHub/GitLab checks, or CI annotation integration; the pack only covers scanning targets, SBOM, MCP server, and unrelated security incidents. This is a plausible capability for a scanner (via CI actions), so the axis applies, but absence of evidence means 'none' rather than 'na'.

   ⚑ flag

Pre commit

1. developerRun the scanner as a pre-commit hook so secrets and issues never enter my git history

   weight 3 · round drawn
   Snyk—none0/10

   Snyk documents CLI-based scanning (including a dedicated `snyk secrets test` command) that can run locally or in CI/CD, but no evidence describes a pre-commit git hook integration or any workflow to block commits before secrets enter git history. The axis applies to a CLI security scanner, but no such hook capability is documented anywhere in the evidence pack.

   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”
   • [github] “You can run the CLI locally from the command line or in an IDE. You can also run the CLI in your CI/CD pipeline.”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”

   proof ↗⚑ flag

   Trivy—none0/10

   Evidence shows Trivy scans secrets and filesystems and is easy to integrate into CI/CD generally, but no documentation or mention of a pre-commit hook framework integration (e.g., .pre-commit-hooks.yaml) is provided in the evidence pack.

   ⚑ flag

Containers

1. devops-leadScan container images for OS-package and application-layer vulnerabilities before deploying them

   weight 3 · round to Trivy
   Snyk✓fullcommunity7/10

   Snyk explicitly ships 'Snyk Container' for scanning container images and is described platform-wide as scanning 'container images' alongside code and dependencies, and one community comment even notes hearing good things about the container security tooling specifically. missing for 10: explicit doc language distinguishing OS-package vs application-layer vulnerability detection within images, and any hands-on/independent verification of a container scan (the probes only exercise `snyk test`/MCP, not `snyk container test`).

   • [claimed-docs] “Snyk Container provides tools and integrations to quickly find and fix vulnerabilities. This allows you to create images that have security …”
   • [claimed-docs] “Scan, prioritize, and fix vulnerabilities in your code, open-source dependencies, container images, and cloud configurations.”
   • [community] “Dependabot doesn't work well for a Fortune 50 company... Snyk like most security tools lacks perspective that takes business and how product…”

   proof ↗⚑ flag

   Trivy✓fullcommunity9/10

   Trivy's core, well-documented capability is scanning container images for OS-package vulnerabilities (trivy-docs-1, trivy-docs-17) and application-layer/lock-file vulnerabilities (trivy-docs-2), backed by community corroboration of strong real-world CI/CD scanning use (trivy-comm-11, trivy-comm-12, trivy-comm-14). This directly matches the devops-lead's pre-deployment scanning need. missing for 10: independent benchmark/comparison of detection accuracy beyond community sentiment.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “It detects known vulnerabilities in your container image... `$ trivy image [YOUR_IMAGE_NAME]`”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “we use AquaSec and it's absolutely the same engine. Trivy is so good we were tempted to drop AquaSec entirely as we only use it in our CI an…”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

Iac misconfig

1. devops-leadScan Terraform, Kubernetes, and other IaC files for security misconfigurations

   weight 2 · round to Trivy
   Snyk✓fullclaimed8/10

   Snyk IaC is explicitly documented to scan Terraform, Kubernetes, CloudFormation, and ARM configurations for misconfigurations, with CLI/IDE/SCM/CI integration, drift detection, and custom Rego rules for extending checks. The Snyk CLI GitHub docs corroborate this with a direct feature description ("Snyk IaC: Find and fix insecure configurations in Terraform and Kubernetes code"). Missing for 10: independent/hands-on user reports specifically validating IaC misconfiguration detection quality (community evidence in the pack concerns dependency/OSS scanning, not IaC).

   • [claimed-docs] “With Snyk IaC, you can: Write secure configurations for HashiCorp Terraform, AWS CloudFormation, Kubernetes, and Azure Resource Manager (ARM…”
   • [claimed-docs] “Detect manually created resources in your cloud.”
   • [claimed-docs] “Write secure configurations for HashiCorp Terraform, AWS CloudFormation, Kubernetes, and Azure Resource Manager (ARM) - for IDE, SCM, CLI, a…”
   • [claimed-docs] “Write secure configurations for HashiCorp Terraform, AWS CloudFormation, Kubernetes, and Azure Resource Manager (ARM)... View issues and rec…”
   • [claimed-docs] “With Snyk Infrastructure as Code (IaC), you can secure cloud infrastructure configurations before and after deployment.”
   • [claimed-docs] “With Snyk IaC, you can: * Write secure configurations for HashiCorp Terraform, AWS CloudFormation, Kubernetes, and Azure Resource Manager (…”
   • [claimed-docs] “Install the SDK using one of these options”
   • [claimed-docs] “Rules are written in Rego.”
   • [claimed-docs] “The SDK helps you write, debug, test, bundle, and distribute custom rules written in Rego, which can then be used by the Snyk IaC CLI to fin…”
   • [github] “Snyk IaC: Find and fix insecure configurations in Terraform and Kubernetes code”

   proof ↗⚑ flag

   Trivy✓fullcommunity9/10

   Trivy's docs explicitly state built-in misconfiguration checks for Docker, Kubernetes, Terraform, CloudFormation and more, plus k8s cluster scanning via `trivy k8s`, and community reviews corroborate strong CI/CD IaC scanning usage. Missing for 10: independent hands-on validation specifically of Terraform/K8s misconfig detection accuracy (only Docker/vuln scanning has community corroboration).

   • [claimed-docs] “Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terrafor…”
   • [github] “trivy k8s --report summary cluster”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

Coverage

1. developerScan projects across all the major languages and package ecosystems my organization uses

   weight 2 · round to Snyk
   Snyk✓fullcommunity8/10

   Snyk documents broad ecosystem coverage: Open Source (SCA) with dependency scanning across languages (Java/Kotlin, JavaScript/Yarn, .NET, Python explicitly documented CLI usage), Snyk Code (SAST), Container, IaC (Terraform, CloudFormation, Kubernetes, ARM), and secrets scanning, all via CLI/IDE/CI-CD integrations. Community evidence corroborates real-world usage across npm and other ecosystems, though some users note database discrepancies vs npm audit and noise/false-positive complaints, which don't contradict breadth of coverage. Missing for 10: independent benchmark of coverage across all claimed languages/ecosystems and no explicit list of all supported package managers beyond the few named.

   • [claimed-docs] “Snyk Open Source allows you to find and fix vulnerabilities in the open-source libraries used by your applications.”
   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “Snyk Container provides tools and integrations to quickly find and fix vulnerabilities. This allows you to create images that have security …”
   • [claimed-docs] “With Snyk IaC, you can: Write secure configurations for HashiCorp Terraform, AWS CloudFormation, Kubernetes, and Azure Resource Manager (ARM…”
   • [claimed-docs] “To test Maven and Gradle Projects, use the `snyk test` command as follows”
   • [claimed-docs] “`--yarn-workspaces`: For Yarn Workspaces use the `--all-projects` flag to test and monitor your packages”
   • [claimed-docs] “To perform source code analysis, run `snyk code test` from the root of the Project.”
   • [claimed-docs] “To set the Python version in the CLI, add the following option to `snyk test` or `snyk monitor` with the name of the Python binary”
   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [github] “To scan your source code, run `snyk code test`.”
   • [community] “They use a different vulnerability database. Snyk's contains vulnerabilities that NPM's doesn't have, and vice versa. We're using them both …”
   • [community] “These confuse me because they don't align with yarn/npm audit. Which one is right? It is pretty unrealistic to dig into it myself.”

   proof ↗⚑ flag

   Trivy~partialcommunity7/10

   Trivy documents scanning of container images, filesystems, and git repos for vulnerabilities via lock files (e.g., Gemfile.lock, package-lock.json), plus secrets, misconfigurations, licenses, and SBOM generation—covering many languages/ecosystems and package managers broadly. However, the evidence pack lacks an explicit enumerated list of 'all major languages/ecosystems' supported, and one community report notes a runtime panic on a specific scan type (AWS scanning), suggesting coverage gaps or bugs in some scan modes. missing for 10: an authoritative full list of supported languages/package managers, independent verification of breadth across ecosystems, and confirmation that edge-case scans (e.g., cloud scanning) are reliable.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terrafor…”
   • [claimed-docs] “Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”
   • [community] “Just tried it: ./trivy aws --region us-east-1 -> panic: runtime error: invalid memory address or nil pointer dereference. Posted a Github is…”
   • [community] “I would kill for an all-in-one solution where I work... today we use a different scanner for every single type of scan we perform, and it's …”

   proof ↗⚑ flag

Output formats

1. developerEmit scan results in machine-readable formats like JSON or SARIF for downstream tooling

   weight 2 · round drawn
   Snyk—none0/10

   The evidence pack documents Snyk CLI commands (test, code test, monitor) and even a report-generation plugin (snyk-to-html) but never mentions JSON or SARIF output formats anywhere in the docs or CLI descriptions provided. Missing for 10: explicit mention of --json/--sarif flags, SARIF format support, or documentation of machine-readable output for CI/downstream tooling.

   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [github] “Look at the `test` command report in your terminal. The report shows the vulnerabilities Snyk found in the package.”
   • [claimed-docs] “To help generate reports locally or at build time, see the [snyk-to-html plugin]”
   • [claimed-docs] “To perform source code analysis, run `snyk code test` from the root of the Project.”

   proof ↗⚑ flag

   Trivy—none0/10

   The evidence pack shows Trivy generates SBOM formats (CycloneDX/SPDX) and integrates well with CI/CD, but nowhere documents the --format flag or explicit JSON/SARIF vulnerability-scan output that this story asks about. missing for 10: explicit documentation of JSON/SARIF output format flags for vulnerability/misconfiguration scan results, any example of SARIF file generation, and confirmation of downstream tool consumption (e.g., GitHub Code Scanning integration).

   • [community] “I would kill for an all-in-one solution where I work... today we use a different scanner for every single type of scan we perform, and it's …”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

Dependency fixes

1. developerGet concrete upgrade paths or automated fix pull requests that remediate vulnerable dependencies

   weight 2 · round to Snyk
   Snyk!disputedcontradicted5/10

   Snyk's docs clearly claim actionable fix advice, automated fix PRs, and an agentic Remediation Agent that generates and applies fix plans (snyk-docs-21, snyk-docs-12, snyk-docs-13, snyk-docs-23). However, hands-on community reports concretely contradict the PR remediation experience: users report Snyk's automated PRs were low-quality, generated 'dozens or hundreds' of PRs rather than sensible upgrades, missed version updates, and were ultimately turned off in favor of Dependabot (snyk-comm-6, snyk-comm-11). Missing for 10: independent corroboration that the newer agentic/Remediation Agent workflow fixes these earlier PR-quality complaints.

   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [community] “I'm not convinced their tools are better than npm audit + a license checker package... I've been very disappointed with their PR tools, and …”
   • [community] “we have this thrust on us ... we get pull requests for point release updates but it misses entire versions, it decides that packages that ha…”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is purely a scanner/detector—evidence shows it detects vulnerabilities, misconfigurations, secrets, and generates SBOMs, but nothing indicates it suggests upgrade paths, fix versions, or opens automated remediation pull requests. No auto-fix PR or dependency-upgrade feature is documented anywhere in the evidence pack.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”

   proof ↗⚑ flag

Sca scanning

1. developerScan my dependency manifests and lockfiles for packages with known vulnerabilities

   weight 3 · round drawn
   Snyk✓fullcommunity9/10

   Snyk Open Source explicitly scans manifests/lockfiles across ecosystems (npm, yarn workspaces, Maven/Gradle, .NET, Python) via `snyk test`, reports severity, vulnerable path, and fix advice, including indirect/transitive dependencies, and this is corroborated by community usage reports confirming it surfaces real vulnerabilities from its own database. Missing for 10: independent benchmark of detection accuracy/false-positive rate beyond community anecdotes.

   • [claimed-docs] “Snyk Open Source allows you to find and fix vulnerabilities in the open-source libraries used by your applications.”
   • [claimed-docs] “Open-source packages often reference other packages, and many vulnerabilities are found in these indirect dependencies.”
   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [github] “Alternatively, you can perform a quick test on a public npm package, for example `snyk test ionic`.”
   • [github] “Look at the `test` command report in your terminal. The report shows the vulnerabilities Snyk found in the package.”
   • [github] “The report shows the vulnerabilities Snyk found in the package. For each issue found, Snyk reports the severity of the issue, provides a lin…”
   • [claimed-docs] “To test Maven and Gradle Projects, use the `snyk test` command as follows”
   • [claimed-docs] “`--yarn-workspaces`: For Yarn Workspaces use the `--all-projects` flag to test and monitor your packages”
   • [claimed-docs] “To set the Python version in the CLI, add the following option to `snyk test` or `snyk monitor` with the name of the Python binary”
   • [community] “They use a different vulnerability database. Snyk's contains vulnerabilities that NPM's doesn't have, and vice versa. We're using them both …”

   proof ↗⚑ flag

   Trivy✓fullcommunity9/10

   Trivy explicitly documents scanning lockfiles like Gemfile.lock and package-lock.json for known vulnerabilities, with strong first-party docs and positive independent community feedback on its CI/CD scanning usage. missing for 10: broader independent benchmark of lockfile-specific detection accuracy across more ecosystems.

   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [community] “I've had a great experience with Trivy, very solid tool, very easy to write automation around.”
   • [community] “it's super easy to integrate in every ci/cd pipeline”

   proof ↗⚑ flag

2. security-engineerPrioritize dependency alerts by whether the vulnerable code is actually reachable from my code

   weight 2 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk's DeepCode AI documentation explicitly states it supports 'context-aware risk scoring, assessing the popularity of the affected package and the reachability of vulnerable code' (snyk-docs-36), directly addressing reachability-based prioritization, and Snyk Code offers risk scoring incorporating prevalence and ease of fix (snyk-docs-4). However, this reachability capability is described only briefly and tied to DeepCode AI/Code rather than clearly extended to Snyk Open Source (dependency/SCA) alerts specifically, and there is no independent or hands-on evidence confirming reachability analysis works reliably in practice for dependency vulnerabilities. missing for 10: explicit documentation that reachability analysis applies to Snyk Open Source (SCA) alerts specifically (not just SAST/DeepCode), independent/hands-on verification of reachability accuracy, and detail on how reachability signals surface in the alert triage UI/workflow.

   • [claimed-docs] “DeepCode AI supports Snyk’s context-aware risk scoring, assessing the popularity of the affected package and the reachability of vulnerable …”
   • [claimed-docs] “Sort by and prioritize the more important issues by incorporating factors such as issue prevalence, ease of fix, and risk factor into a sing…”
   • [claimed-docs] “Open-source packages often reference other packages, and many vulnerabilities are found in these indirect dependencies.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy's evidence pack shows vulnerability detection, SBOM generation, secret scanning, and misconfiguration checks, but nothing about reachability analysis or code-path tracing to determine if vulnerable dependency code is actually invoked/exposed. No mention of call-graph analysis, static reachability, or exploitability-based prioritization.

   ⚑ flag

1. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Trivy
   Snyk~partialclaimed3/10

   Snyk offers some data egress mechanisms—exporting issues to Jira, generating local HTML reports via snyk-to-html, and API endpoints to operate on targets/scans/findings in bulk—but there is no documented full-data export/backup feature or explicit open-format portability/exit path for a user's entire account data. missing for 10: a comprehensive 'export all my data' feature, explicit open format guarantees (e.g., JSON/CSV bulk export), and documentation on data portability upon account closure.

   • [claimed-docs] “Track and export Snyk issues to your Jira project.”
   • [claimed-docs] “To help generate reports locally or at build time, see the [snyk-to-html plugin]”
   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”

   proof ↗⚑ flag

   Trivy~partialclaimed5/10

   Trivy generates SBOMs and scan reports in open, interoperable standards (CycloneDX, SPDX) rather than proprietary formats, and being open-source/self-hosted there is inherently no vendor lock-in to escape from. However, there's no explicit documentation framing this as 'exporting all your data to leave' — it's a scanner tool, not a data-storing platform, so the story is only partially applicable and evidenced. Missing for 10: explicit statement about exporting full scan history/config, independent corroboration that these formats are freely portable across tools, and clarity on what 'all data' means for a stateless CLI scanner.

   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”
   • [claimed-docs] “Trivy can generate the following SBOM formats.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * CycloneDX * SPDX”
   • [claimed-docs] “Trivy can generate SBOM for local projects.”

   proof ↗⚑ flag

2. ai-native userRead the product's source under an open license

   weight 2 · round to Trivy
   Snyk—none0/10

   Snyk is a commercial SaaS security platform; while the Snyk CLI repo is hosted on GitHub (snyk-gh-1..9), no evidence in the pack states an open-source license for the CLI or any other Snyk component, and the core scanning/backend product is proprietary. No claimed-docs or community evidence confirms open licensing of the product's source.

   ⚑ flag

   Trivy~partialprobed6/10

   Trivy's source is hosted publicly on GitHub (aquasecurity/trivy) and its own site describes it as an 'open source vulnerability scanning' tool, implying an open license, but no evidence pack item explicitly cites a license file (e.g., Apache-2.0) or license text. Missing for 10: explicit license identifier/citation, confirmation of license terms (permissions, redistribution), and independent corroboration of license compliance.

   • [github] “trivy k8s --report summary cluster”
   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
   • [claimed-docs] “After evaluating several leading options for open source vulnerability scanning, Trivy really stood out”
   • [probe] “official CLI documented at https://github.com/aquasecurity/trivy”

   proof ↗⚑ flag

3. ai-native userSelf-host the core product

   weight 3 · round to Trivy
   Snyk—none0/10

   Snyk's core product (scanning engine, vulnerability database, dashboard, prioritization) is a hosted SaaS platform; the evidence only shows a CLI/IDE client and a 'Broker' that lets the SaaS reach into private networks (e.g., self-hosted registries/repos) — it does not self-host the core analysis/platform itself. No documentation describes an on-prem/self-hosted deployment of the core Snyk service.

   • [claimed-docs] “Run your Broker deployment on your container engine ([Docker Compose](#docker-compose-example) or [Kubernetes cluster](#helm)).”
   • [claimed-docs] “Snyk can integrate with self-hosted private container registries that are not internet-accessible and can help you to better secure containe…”
   • [claimed-docs] “Keep sensitive data such as your access tokens inside your private network, never sharing that information with Snyk.”
   • [github] “The Snyk CLI brings the functionality of Snyk into your development workflow. You can run the CLI locally from the command line or in an IDE…”
   • [claimed-docs] “Scan, prioritize, and fix vulnerabilities in your code, open-source dependencies, container images, and cloud configurations.”

   proof ↗⚑ flag

   Trivy✓fullprobed7/10

   Trivy is an open-source CLI/binary distributed via package managers and Docker images, meaning the core scanning engine runs entirely on the user's own infrastructure with no mandatory SaaS dependency, satisfying the self-hosting expectation for an AI-native user who wants full control over the tool. Missing for 10: explicit documentation of a self-hosted 'Trivy Server' mode/architecture for shared caching, and independent hands-on confirmation of air-gapped/offline self-hosted deployments.

   • [github] “Trivy is available in most common distribution channels. ... `brew install trivy` ... `docker run aquasec/trivy`”
   • [probe] “official CLI documented at https://github.com/aquasecurity/trivy”
   • [claimed-docs] “After evaluating several leading options for open source vulnerability scanning, Trivy really stood out”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Snyk—none0/10

   No evidence pack items document data retention controls, deletion policies, or configurable data lifecycle management for Snyk's platform or its AI/agentic features; if anything, the community evidence (perpetual, transferable license grant over uploaded source code) points the opposite direction. No first-party documentation addresses how users can control or delete stored scan data, source snapshots, or AI-related data.

   • [community] “From their policies page: 'by uploading or posting content to the Platform and providing access to your system's source code repository, you…”

   proof ↗⚑ flag

   Trivy—none0/10

   No evidence describes any data retention, storage duration, or deletion controls for Trivy's scan results, cache, vulnerability DB, or MCP interactions; the docs focus solely on scanning capabilities and CLI/MCP setup, not privacy/retention policy.

   ⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Snyk—none0/10

   No evidence pack item mentions telemetry, usage data collection, or an opt-out/opt-out flag for Snyk's CLI, MCP server, or platform. This is a fair question for a dev tool that runs locally and could collect usage analytics, but nothing in the provided docs, GitHub, or community sources addresses telemetry settings. missing for 10: any mention of telemetry collection, a documented opt-out flag/env var, privacy policy details on usage tracking, or community confirmation of opt-out behavior.

   ⚑ flag

   Trivy—none0/10

   No evidence pack item mentions telemetry, usage tracking, or an opt-out mechanism for Trivy or its MCP server; the axis is plausible for a CLI/MCP tool but no documentation confirms or denies it.

   ⚑ flag

Ai remediation

1. ai-native userHave AI draft remediation pull requests for security findings that I review and merge

   weight 2 · round to Snyk
   Snyk!disputedcontradicted4/10

   Snyk documents both a rule-based fix-PR workflow for Open Source vulnerabilities (snyk-docs-21) and a newer LLM-driven 'Remediation Agent' that scans, generates a fix plan, and applies fixes via CLI/coding assistant (snyk-docs-12, snyk-docs-29, snyk-docs-30), which aligns with 'AI drafts a remediation PR for review.' However, hands-on community feedback specifically about Snyk's automated PR feature reports it as poor quality — generating dozens/hundreds of noisy PRs rather than meaningful rewrites, to the point the user disabled it in favor of Dependabot (snyk-comm-6) — directly contradicting the smooth 'draft-then-review-and-merge' experience implied by the story. Missing for 10: first-party or independent evidence the Remediation Agent itself opens a git PR (docs show it applying fixes locally/in-IDE, not confirmed PR creation), and corroboration that the AI-drafted PR quality is trustworthy enough for simple review-and-merge.

   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “It scans your Project with Snyk, generates a fix plan enriched with Snyk security intelligence, applies the fixes, and verifies the result, …”
   • [claimed-docs] “Run /snyk-fix in your coding assistant to scan the project and apply a fix for the top vulnerability.”
   • [community] “I'm not convinced their tools are better than npm audit + a license checker package... I've been very disappointed with their PR tools, and …”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a scanner that detects vulnerabilities, misconfigurations, secrets, and generates SBOMs; the evidence shows an MCP server for natural-language querying of scan results, but nowhere does it show Trivy or its MCP integration drafting remediation pull requests for review/merge. No evidence of automated PR generation capability.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”

   proof ↗⚑ flag

Code analysis

1. security-engineerDetect taint-style vulnerabilities that flow across files and function boundaries

   weight 2 · round to Snyk
   Snyk✓fullclaimed7/10

   Snyk Code's docs explicitly describe SAST scanning with 'source to sink' step-by-step flow visualization, which is textbook taint-style vulnerability detection tracing data flow through code paths (snyk-docs-2, snyk-docs-3, snyk-docs-18/26/33). This is corroborated by the CLI's snyk code test command for source code scanning (snyk-gh-5). missing for 10: explicit documentation stating flows are tracked across separate files/modules and function boundaries specifically (vs. within a single file), and independent hands-on validation of cross-file taint accuracy

   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “Visualize the path of the issue from source to sink with a step-by-step flow.”
   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [github] “To scan your source code, run `snyk code test`.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is a vulnerability/misconfiguration/secret/SBOM scanner focused on known-CVE and dependency detection; the evidence pack shows no taint-analysis or cross-file/cross-function data-flow SAST capability (e.g. no mention of source-code taint tracking like Semgrep/CodeQL). This is an applicable axis for a security scanning tool, but there is no evidence Trivy performs taint-style SAST analysis.

   ⚑ flag

2. developerRun static analysis that finds vulnerability classes like injection and XSS in my source code

   weight 3 · round to Snyk
   Snyk✓fullclaimed8/10

   Snyk Code is documented as a dedicated SAST solution that scans source code in real time across IDEs, repos, and CI/CD, with source-to-sink flow visualization for tracing vulnerable paths (e.g., injection/XSS-style taint flows), risk-based prioritization, and CLI/IDE integration confirmed by both docs and CLI usage examples (`snyk code test`). Missing for 10: explicit named CWE/OWASP coverage lists (e.g., explicit mention of 'SQL injection' or 'XSS' rule categories) and independent benchmark/accuracy validation beyond vendor claims.

   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “Visualize the path of the issue from source to sink with a step-by-step flow.”
   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [claimed-docs] “By scanning code in real-time and providing actionable insights directly in the developer workflow across IDEs, repositories, and CI/CD pipe…”
   • [claimed-docs] “Snyk Code is a developer-first static application security testing (SAST) solution. By scanning code in real-time and providing actionable i…”
   • [github] “To scan your source code, run `snyk code test`.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy's documented capabilities are vulnerability scanning (known CVEs in dependencies/images), secret detection, IaC misconfiguration checks, license and SBOM generation — none of the evidence shows a SAST engine that analyzes source code for vulnerability classes like injection or XSS. This is a fair axis for a security scanning product, but no evidence supports it, so it is 'none' rather than 'na'.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terrafor…”
   • [claimed-docs] “Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”

   proof ↗⚑ flag

Custom rules

1. security-engineerWrite custom static-analysis rules in a simple syntax and share them across repositories

   weight 2 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk documents a full custom-rules SDK (writing rules in Rego, unit testing, parsing, and pushing a compiled bundle to an OCI registry for distribution) but this applies specifically to Snyk IaC, not to Snyk Code (the SAST product) — the only SAST-adjacent hook is a one-line mention of writing custom DeepCode AI queries with autocomplete, which is far less developed. Rego is also a specialized policy language rather than a 'simple syntax'. Missing for 10: documented custom rule authoring for Snyk Code/SAST specifically, evidence that Rego/DeepCode queries are beginner-simple, and a clear cross-repo sharing workflow beyond OCI bundle push.

   • [claimed-docs] “Install the SDK using one of these options”
   • [claimed-docs] “Rules are written in Rego.”
   • [claimed-docs] “Snyk provides a `parse` command.”
   • [claimed-docs] “Add unit tests for the rules you have written to verify your rules.”
   • [claimed-docs] “The SDK helps you write, debug, test, bundle, and distribute custom rules written in Rego, which can then be used by the Snyk IaC CLI to fin…”
   • [claimed-docs] “Optionally, once you have generated your custom rules bundle, you can distribute it automatically to one of our supported OCI registries by …”
   • [claimed-docs] “Write your own queries using DeepCode AI logic (with autocomplete) and leverage the hybrid AI to instantly find matches in your code.”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy's evidence covers vulnerability, misconfiguration, secret, license, and SBOM scanning, but there is no mention of a custom rule-writing syntax (e.g., Rego/OPA policies) or a mechanism for sharing custom rules across repositories in this evidence pack.

   ⚑ flag

Fix suggestions

1. developerApply suggested or automatic code fixes for findings instead of only reading reports

   weight 2 · round to Snyk
   Snyk!disputedcontradicted6/10

   Snyk documents multiple fix-application paths beyond reporting: automated fix PRs for Open Source vulnerabilities, DeepCode AI-driven autofixes with claimed 85% accuracy, the LLM-driven Remediation Agent (`snyk fix --agentic`, `/snyk-fix`, `/snyk-batch-fix`) that scans, plans, applies and verifies fixes, and IaC/Code fix advice with an 'ignore suggested fix' override (snyk-docs-12/13/14/21/23/30/5). However, hands-on community feedback specifically about the automated PR fix workflow reports it creates noisy, low-value PRs that miss versions or wrongly replace legitimately forked packages, leading users to disable the automated PR feature (snyk-comm-6, snyk-comm-11) — a concrete counter-example to the 'automatic fix' claim for at least one workflow. Missing for 10: independent verification of the newer Remediation Agent/DeepCode autofix accuracy claims, and resolution of the documented PR-quality complaints.

   • [claimed-docs] “The Remediation Agent is an LLM-driven tool that automates vulnerability remediation in your projects. It scans your Project with Snyk, gene…”
   • [claimed-docs] “Snyk CLI: Run `snyk fix --agentic` from your terminal to trigger a human-in-the-loop interactive remediation experience without an IDE.”
   • [claimed-docs] “DeepCode AI powers 85%-accurate security autofixes and comprehensive app coverage, letting developers build fast while staying secure.”
   • [claimed-docs] “Snyk provides actionable fix advice for vulnerabilities and supports workflows to fix vulnerabilities using pull requests.”
   • [claimed-docs] “Run `/snyk-fix` in your coding assistant to scan the project and apply a fix for the top vulnerability. Use `/snyk-batch-fix` to address mul…”
   • [claimed-docs] “Run /snyk-fix in your coding assistant to scan the project and apply a fix for the top vulnerability.”
   • [claimed-docs] “Configure Snyk to ignore suggested fixes for an issue to suppress specific warnings.”
   • [community] “I'm not convinced their tools are better than npm audit + a license checker package... I've been very disappointed with their PR tools, and …”
   • [community] “we have this thrust on us ... we get pull requests for point release updates but it misses entire versions, it decides that packages that ha…”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy is purely a scanner that detects vulnerabilities, misconfigurations, secrets, and licenses and reports findings; there is no evidence of any suggested-fix or auto-remediation capability in the docs, CLI, or MCP integration, which only supports natural-language querying of scan results.

   • [claimed-docs] “It detects known vulnerabilities in your container image.”
   • [claimed-docs] “Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terrafor…”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”

   proof ↗⚑ flag

Custom detection

1. security-engineerDefine custom detection rules for my organization's internal token and secret formats

   weight 2 · round drawn
   Snyk—none0/10

   Snyk documents a secrets-scanning feature (`snyk secrets test` for hard-coded API keys/passwords) but there is no evidence of any mechanism to define custom detection rules/regex patterns for an organization's own internal token or secret formats. The custom-rules SDK/Rego capability documented elsewhere is scoped to Snyk IaC (infrastructure configuration rules), not to secret detection. Missing for 10: any documented custom-pattern/rule authoring for Snyk Secrets, API/config for adding internal token signatures, or community evidence of this being used in practice.

   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”
   • [claimed-docs] “Install the SDK using one of these options”
   • [claimed-docs] “Rules are written in Rego.”
   • [claimed-docs] “The SDK helps you write, debug, test, bundle, and distribute custom rules written in Rego, which can then be used by the Snyk IaC CLI to fin…”

   proof ↗⚑ flag

   Trivy—none0/10

   Evidence confirms Trivy has built-in secret scanning for passwords, API keys, and tokens (trivy-docs-3, trivy-docs-10), but nothing in the pack describes an ability for users to define custom regex/rules for organization-specific token formats. Missing for 10: any documentation of custom secret rule configuration, regex pattern definition, or allow/deny-list rule authoring.

   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens.”

   proof ↗⚑ flag

Secret scanning

1. developerScan a repository and its full git history for hardcoded secrets and credentials

   weight 3 · round drawn
   Snyk~partialclaimed5/10

   Snyk explicitly offers secrets scanning via `snyk secrets test` to detect hardcoded API keys and passwords in the codebase, but no evidence describes scanning the full git history (e.g., past commits) for secrets. Missing for 10: documented git-history scanning capability, evidence of commit-level secret detection, and independent confirmation of history-wide coverage.

   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”

   proof ↗⚑ flag

   Trivy~partialclaimed5/10

   Trivy explicitly supports secret scanning across filesystem, container image, and git repository targets, enabled by default (trivy-docs-3, trivy-docs-10). However, the evidence never confirms that this scan traverses the full git commit history (e.g., detecting secrets committed and later removed) rather than just the current working tree/HEAD state. Missing for 10: explicit documentation or demonstration of full git-history secret scanning, independent verification of history-depth coverage.

   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens.”
   • [claimed-docs] “it stores analysis results, using the latest commit hash as the key.”

   proof ↗⚑ flag

2. security-engineerScan non-git sources like S3 buckets, Docker images, and CI logs for leaked secrets

   weight 2 · round to Trivy
   Snyk—none0/10

   Snyk documents secrets scanning only via `snyk secrets test` against a codebase, and container/IaC scanning is for vulnerabilities, not secrets, in container images. There is no evidence of scanning S3 buckets, Docker images, or CI logs specifically for leaked secrets.

   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”
   • [claimed-docs] “The Snyk Broker Container Registry Agent enables you to connect with network-restricted container registries so you can scan these registrie…”
   • [claimed-docs] “Snyk can integrate with self-hosted private container registries that are not internet-accessible and can help you to better secure containe…”

   proof ↗⚑ flag

   Trivy~partialcommunity4/10

   Trivy's secret scanner explicitly supports container images, filesystem, and git repositories (trivy-docs-3, trivy-docs-10), covering the 'Docker images' part of the story, but there is no evidence of secret scanning for S3 buckets or CI logs specifically. A 'trivy aws' subcommand exists (trivy-comm-15) but it's shown crashing and is not documented as a secret-detection target. missing for 10: documented S3 bucket secret scanning, documented CI log secret scanning, and hands-on confirmation these non-git sources work reliably.

   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens.”
   • [community] “Just tried it: ./trivy aws --region us-east-1 -> panic: runtime error: invalid memory address or nil pointer dereference. Posted a Github is…”

   proof ↗⚑ flag

3. security-engineerHave detected secrets verified against the issuing service so I know which ones are live

   weight 2 · round drawn
   Snyk—none0/10

   Snyk documents a secrets scanning capability (snyk secrets test) that detects hard-coded secrets like API keys and passwords, but there is no evidence of any verification step that checks detected secrets against the issuing service to determine if they are live/valid.

   • [claimed-docs] “Scan your codebase for hard-coded secrets, including API keys and passwords. Use the `snyk secrets test` command to run a secrets scan from …”

   proof ↗⚑ flag

   Trivy—none0/10

   Trivy's docs describe detecting secrets (passwords, API keys, tokens) via pattern-based scanning, but there is no evidence of any feature that verifies detected secrets against the issuing service (e.g., calling an API to check if a credential is still active/live). No mention of live-verification capability anywhere in the evidence pack.

   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens. Secret scanni…”
   • [claimed-docs] “Trivy scans any container image, filesystem and git repository to detect exposed secrets like passwords, api keys, and tokens.”

   proof ↗⚑ flag

Licenses

1. devops-leadDetect the licenses of my dependencies and enforce a license policy in scans

   weight 1 · round to Snyk
   Snyk~partialclaimed6/10

   Snyk Open Source explicitly documents license compliance scanning ('checking against licenses known to Snyk') and finding/addressing licensing issues in dependencies, plus a general 'Policy management' plan feature. However, evidence lacks detail on how license enforcement policies are configured (e.g., allow/deny lists, build-breaking thresholds) and no independent/community confirmation of this specific feature working well. missing for 10: explicit documentation of license policy configuration/enforcement workflow, evidence of blocking builds on license violations, independent corroboration of license scanning accuracy.

   • [claimed-docs] “Snyk Open Source can also scan your Projects for license compliance, checking against licenses known to Snyk.”
   • [claimed-docs] “You can also find and address licensing issues in or caused by these open-source libraries.”
   • [claimed-docs] “Snyk Open Source allows you to find and fix vulnerabilities in the open-source libraries used by your applications. You can also find and ad…”
   • [claimed-docs] “Policy management”

   proof ↗⚑ flag

   Trivy~partialclaimed5/10

   Trivy documents dedicated license scanning that detects license files in container images and gives an opinionated risk categorization (trivy-docs-5), which covers the 'detect licenses' half of the story. However, the evidence pack contains no documentation of configurable allow/deny license lists or exit-code/policy enforcement gating a build on disallowed licenses—only the general misconfiguration/IaC policy engine is described (trivy-docs-4), not license-specific policy enforcement. missing for 10: explicit license allow/deny-list configuration, CI/CD gating or exit-code enforcement tied to license violations, independent confirmation of license policy enforcement in practice.

   • [claimed-docs] “Trivy scans any container image for license files and offers an opinionated view on the risk associated with the license.”
   • [claimed-docs] “Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terrafor…”

   proof ↗⚑ flag

Sbom

1. security-engineerGenerate a software bill of materials (SPDX or CycloneDX) for my project or image

   weight 2 · round to Trivy
   Snyk—none0/10

   The evidence pack covers Snyk Open Source, Code, Container, IaC scanning, remediation agents, and CLI usage, but nowhere mentions SBOM generation, SPDX, or CycloneDX output. Missing for 10: any documentation of an `snyk sbom` command or SPDX/CycloneDX export capability, missing for 10: any reference to bill-of-materials format support.

   ⚑ flag

   Trivy✓fullclaimed9/10

   Trivy's docs explicitly document SBOM generation in both CycloneDX and SPDX formats for container images and filesystems/local projects, backed by a dedicated supply-chain SBOM guide and CLI usage. Missing for 10: independent/hands-on community corroboration specifically of SBOM output quality (community evidence focuses on vulnerability scanning and unrelated security incidents, not SBOM generation).

   • [claimed-docs] “Trivy can generate the following SBOM formats. * [CycloneDX](#cyclonedx) * [SPDX](#spdx)”
   • [claimed-docs] “Trivy can generate the following SBOM formats.”
   • [claimed-docs] “Trivy can generate SBOM for local projects.”
   • [claimed-docs] “Trivy can generate the following SBOM formats. * CycloneDX * SPDX”

   proof ↗⚑ flag

Ai triage

1. ai-native userUse AI to triage findings — explaining them, deduplicating, and flagging likely false positives

   weight 3 · round to Snyk
   Snyk~partialcommunity5/10

   Snyk's DeepCode AI and Snyk Code provide AI-driven risk scoring, reachability and exploit-maturity analysis to prioritize findings (snyk-docs-4, snyk-docs-36, snyk-docs-14), and users can manually suppress/ignore findings (snyk-docs-5), which partially supports the triage-noise theme. However there is no explicit AI-driven deduplication or automated false-positive flagging feature documented, and community feedback explicitly states that alerts 'remain mostly noise' without context-aware understanding and that users are confused about vulnerability validity (snyk-comm-9, snyk-comm-10), undercutting the strength of the triage claim. Missing for 10: explicit AI deduplication capability, explicit automated false-positive detection/flagging, and independent evidence that AI prioritization concretely reduces noise in practice.

   • [claimed-docs] “Sort by and prioritize the more important issues by incorporating factors such as issue prevalence, ease of fix, and risk factor into a sing…”
   • [claimed-docs] “DeepCode AI supports Snyk’s context-aware risk scoring, assessing the popularity of the affected package and the reachability of vulnerable …”
   • [claimed-docs] “DeepCode AI powers 85%-accurate security autofixes and comprehensive app coverage, letting developers build fast while staying secure.”
   • [claimed-docs] “Configure Snyk to ignore suggested fixes for an issue to suppress specific warnings.”
   • [community] “These confuse me because they don't align with yarn/npm audit. Which one is right? It is pretty unrealistic to dig into it myself.”
   • [community] “Until these alerts get better at understanding context of use of a dependency, they're going to remain mostly noise... No, I don't care abou…”

   proof ↗⚑ flag

   Trivy~partialprobed4/10

   Trivy's official MCP server (trivy-mcp) enables natural-language querying/explanation of scan findings via AI-enabled tools like VS Code, which supports the 'explaining findings' part of the story, but there is no documented feature for AI-driven deduplication of findings or automated false-positive flagging. Missing for 10: explicit deduplication logic, false-positive triage/suppression via AI, and independent hands-on evidence that MCP-based triage actually reduces noise in practice.

   • [claimed-docs] “Natural Language Scanning: Ask questions about security issues in natural language”
   • [claimed-docs] “**Natural Language Scanning**: Ask questions about security issues in natural language”
   • [claimed-docs] “This plugin starts a Model Context Protocol (MCP) server that integrates Trivy's security scanning capabilities with VS Code and other MCP-e…”
   • [probe] “official MCP server documented at https://github.com/aquasecurity/trivy-mcp”

   proof ↗⚑ flag

Fp management

1. security-engineerBaseline or ignore existing and false-positive findings so only new issues alert

   weight 3 · round to Snyk
   Snyk~partialcommunity5/10

   Docs confirm an explicit ignore capability ('Configure Snyk to ignore suggested fixes for an issue to suppress specific warnings') and a 'Policy management' feature is listed in plans, which supports suppressing known/false-positive findings. However, there is no evidence of a dedicated baseline mechanism (e.g., 'only alert on new issues since baseline scan') or detail on ignore workflows across SCA/Container/IaC beyond Snyk Code, and community feedback notes ongoing noise complaints suggesting the ignore/triage experience is imperfect in practice. Missing for 10: dedicated baseline/'new-only' gating documentation, cross-product ignore policy details (SCA, IaC, Container), and independent confirmation that ignored/baselined findings stay suppressed reliably.

   • [claimed-docs] “Configure Snyk to ignore suggested fixes for an issue to suppress specific warnings.”
   • [claimed-docs] “Policy management”
   • [community] “Until these alerts get better at understanding context of use of a dependency, they're going to remain mostly noise... No, I don't care abou…”

   proof ↗⚑ flag

   Trivy—none0/10

   The evidence pack contains no mention of Trivy's .trivyignore file, ignore-policies, baseline/suppression features, or VEX-based suppression that would let a security engineer mark existing findings as accepted/false-positive so only new issues alert. All docs excerpts focus on scanning capabilities (vulnerabilities, secrets, misconfig, SBOM) with none addressing triage/ignore workflows. Missing for 10: documentation of .trivyignore/ignore-file support, VEX suppression, baseline diffing, or any triage-noise reduction feature.

   ⚑ flag

2. developerFilter and gate on findings by severity or confidence so low-value noise does not block builds

   weight 2 · round to Snyk
   Snyk~partialcommunity6/10

   Snyk documents risk-based prioritization (issue prevalence, risk score, context-aware exploit maturity/reachability scoring), the ability to filter/operate on findings, and the ability to suppress specific issues via ignore rules and policy management, which supports reducing noise. However, the evidence pack never explicitly documents a severity-threshold or confidence-threshold CLI/CI gating flag, and community feedback (e.g., low-severity findings called 'mostly noise') suggests the filtering doesn't fully eliminate noise in practice. Missing for 10: explicit documented severity/confidence threshold gating mechanism for CI builds, independent confirmation that gating reduces false-positive build blocks.

   • [claimed-docs] “Sort by and prioritize the more important issues by incorporating factors such as issue prevalence, ease of fix, and risk factor into a sing…”
   • [claimed-docs] “Configure Snyk to ignore suggested fixes for an issue to suppress specific warnings.”
   • [claimed-docs] “Risk-based prioritization – – Reporting dashboard”
   • [claimed-docs] “Policy management”
   • [claimed-docs] “DeepCode AI supports Snyk’s context-aware risk scoring, assessing the popularity of the affected package and the reachability of vulnerable …”
   • [claimed-docs] “You can run operations on your targets, scans, and findings one by one or in bulk by providing the identifiers or applying a filter.”
   • [github] “The report shows the vulnerabilities Snyk found in the package. For each issue found, Snyk reports the severity of the issue, provides a lin…”
   • [community] “Until these alerts get better at understanding context of use of a dependency, they're going to remain mostly noise... No, I don't care abou…”

   proof ↗⚑ flag

   Trivy—none0/10

   The evidence pack contains no mention of severity or confidence filtering flags (e.g. --severity, --exit-code) or any gating mechanism to suppress low-value findings; all cited docs focus on scan targets (image, filesystem, secrets, misconfig, SBOM) rather than triage/filtering controls. Missing for 10: any documentation of severity/confidence thresholds, exit-code gating, or ignore-file mechanisms to reduce noise.

   ⚑ flag