10 alternatives to trivy

aquasecurity/trivy — Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more (38,706 stars, Apache-2.0, infra, security, database).

These are the closest projects in the JustClaw-It index that we serve licence-cleared code from, ranked by relevance and by our code-quality score (1–10, the mean over each repo's graded components: completeness, code quality, deployability, reusability, strategic value). JustClaw-It also serves 964 licence-cleared components from aquasecurity/trivy itself.

#	Repo	Score	Licence	Stars
1	deepfence/secretscanner	7.3	MIT	3,401
2	owasp/nettacker	7.0	Apache-2.0	5,685
3	kata-containers/kata-containers	6.4	Apache-2.0	8,993
4	moby/moby	7.1	Apache-2.0	72,197
5	google/gvisor	4.7	Apache-2.0	19,781
6	kubernetes/kubernetes	7.7	Apache-2.0	128,584
7	gitguardian/ggshield	5.3	MIT	2,009
8	gitleaks/gitleaks	5.4	MIT	30,317
9	bitnami/sealed-secrets	7.6	Apache-2.0	9,317
10	abiosoft/colima	7.3	MIT	31,388

The alternatives in detail

deepfence/secretscanner

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

score 7.3/10 · MIT permissive · 3,401 stars · 15 components · search them
owasp/nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

score 7.0/10 · Apache-2.0 permissive · 5,685 stars · 38 components · search them
kata-containers/kata-containers

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and secur

score 6.4/10 · Apache-2.0 permissive · 8,993 stars · 948 components · search them
moby/moby

The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

score 7.1/10 · Apache-2.0 permissive · 72,197 stars · 1,253 components · search them · alternatives
google/gvisor

Application Kernel for Containers

score 4.7/10 · Apache-2.0 permissive · 19,781 stars · 1,868 components · search them
kubernetes/kubernetes

Production-Grade Container Scheduling and Management

score 7.7/10 · Apache-2.0 permissive · 128,584 stars · 3,000 components · search them · alternatives
gitguardian/ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

score 5.3/10 · MIT permissive · 2,009 stars · 218 components · search them
gitleaks/gitleaks

Find secrets with Gitleaks 🔑

score 5.4/10 · MIT permissive · 30,317 stars · 180 components · search them · alternatives
bitnami/sealed-secrets

A Kubernetes controller and tool for one-way encrypted Secrets

score 7.6/10 · Apache-2.0 permissive · 9,317 stars · 22 components · search them
abiosoft/colima

Container runtimes on macOS (and Linux) with minimal setup

score 7.3/10 · MIT permissive · 31,388 stars · 98 components · search them · alternatives

Licence data: JustClaw-It's per-repo licence policy. Is trivy still maintained? Check it. Licence details: licence checker. Ranking data from 2026-10-29T06:21:36Z.

Want code like trivy without the licence risk? JustClaw-It is an MCP server with 1,518,000+ licence-cleared, quality-scored code components. Search is free; every result carries its licence and attribution.

Remote MCP endpoint: https://justclaw.it.com/mcp (API key auth). Works with Claude Code, Cursor, Codex, Windsurf and other MCP clients. A one-line CLI installer (@justclaw-it/cli) is coming.

Get a free API key Read the docs