# Install trivy with Homebrew

Vulnerability scanner for container images, file systems, and Git repos. Version 0.72.0 via Homebrew; verified 2026-07-26.

## Install

```sh
sudo av install brew:trivy
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install trivy
```

  Evidence: provider-native install command

## Package facts

- **Package key:** brew:trivy
- **Package manager:** Homebrew
- **Version:** 0.72.0
- **Source summary:** Vulnerability scanner for container images, file systems, and Git repos
- **Homepage:** <https://trivy.dev/>
- **Repository:** <https://github.com/aquasecurity/trivy>
- **Last updated:** 2026-07-26T00:51:27+02:00
- **Generated:** 2026-08-03T00:40:33+00:00

## Executables

- trivy (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.72.0
## Project history and usage

Trivy is Aqua Security's open-source security scanner. It began public life in the container-image vulnerability scanning niche and is now documented as a comprehensive scanner for container images, filesystems, Git repositories, VM images, and Kubernetes.

### Project history

Aqua's official blog announced on August 19, 2019 that Trivy, described there as a popular open-source container image vulnerability scanner, had joined the Aqua open-source family. The current project README shows how the scope expanded: Trivy now has multiple target types and scanners, including vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and license scanning.

That expansion mirrors the wider cloud-native security shift from image scanning as a point task to supply-chain and runtime-adjacent checks in CI, repositories, Kubernetes clusters, and local filesystems. Trivy's own docs and README frame it as a single CLI front end for those related checks rather than a collection of separate tools.

### Adoption history

The official homepage calls Trivy the most popular open-source security scanner for vulnerability scanning, IaC, SBOM discovery, cloud scanning, and Kubernetes security. The README lists integrations with GitHub Actions, the Trivy Kubernetes operator, and a VS Code extension, while the installation docs distinguish official and community install channels.

Homebrew adoption fits the way Trivy is commonly used: installed as a local CLI for developers and CI authors, run in Docker for pipeline isolation, and embedded into GitHub Actions or Kubernetes workflows for continuous scanning. Its package-manager presence is not ornamental; the package is a common entry point for trying a scanner before wiring it into automation.

### How it is used

The README's general pattern is `trivy <target> [--scanners <scanner1,scanner2>] <subject>`. Examples include `trivy image python:3.4-alpine`, filesystem scans such as `trivy fs --scanners vuln,secret,misconfig myproject/`, and Kubernetes scans such as `trivy k8s --report summary cluster`.

In the package-nerd niche, Trivy is often used to inspect what a package, container image, repository, lockfile, or cluster would expose to a vulnerability database or policy scanner. The same executable can produce quick local answers and also serve as the scanner behind CI jobs, image-registry checks, and Kubernetes security reports.

### Why package nerds care

Trivy is significant because it connects package metadata to security outcomes. It reads OS packages and language dependencies, maps them to CVEs and other findings, and can emit SBOM-centered views. For people who track package ecosystems, it is both a user-facing CLI and a packaging/data-source stress test across distros, language lockfiles, images, and repositories.

It is also a good example of a security CLI becoming infrastructure: package managers install it, CI systems wrap it, Kubernetes operators schedule it, and downstream tools consume its reports. That makes its history more important than a normal formula entry.

### Timeline

- 2019-08-19: Aqua announced that Trivy had joined the Aqua open-source family.
- Current README: Trivy documents targets including container images, filesystems, Git repositories, VM images, and Kubernetes.
- Current README: Trivy documents scanners for vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and licenses.
- Current docs: Installation documentation covers official and community channels and points users to CI/CD, IDE, Kubernetes, and other integrations.

### Related projects

- Aqua Security, Trivy DB, Trivy Operator, trivy-action, Harbor scanner integrations, Kubernetes, SBOM tooling

### Sources

- <https://github.com/aquasecurity/trivy#readme>
- <https://trivy.dev/>
- <https://trivy.dev/docs/latest/getting-started/installation/>
- <https://www.aquasec.com/blog/trivy-vulnerability-scanner-joins-aqua-family/>


## Security Notes

broad file, network, media, or database tool signal. escape, surveillance, or offensive capability signal.

- **Geiger risk:** red / medium
- broad file, network, media, or database tool signal
- escape, surveillance, or offensive capability signal
- infrastructure mutation or orchestration signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: trivy.yaml

## Combined YAML source

View the package source record on GitHub. [combined/trivy.yml](https://github.com/automic-vault/db/blob/main/combined/trivy.yml)


## Sources

- Nucleus package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation