Trivy

Record your Trivy connection as vulnerability scanning evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Trivy:

   1. Trivy is an open-source CLI with no accounts or token UI. The only token Trivy documents is the shared secret of Trivy server (client/server mode).
   2. Choose a random secret and start the server with it, for example trivy server --listen <host>:<port> --token <secret>.
   3. Paste the same secret into Safeguard's token field.

   Where to find the other values:

   • Base URL (optional): The address the Trivy server listens on (the --listen value, for example http://host:8080). Health (/healthz) and version (/version) endpoints need no authentication.
   • Account / Org / Workspace (optional): Not used by Trivy; leave empty.

   Trivy issues this credential through its API or its support team, not through its admin screens.

   Source: trivy.dev, trivy.dev, checked 2026-10-07.

2. On Compliance › Connectors, open Trivy, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Trivy yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks