CRACI vs Trivy

The short answer

Trivy is one of the most useful free security tools there is. It scans container images, filesystems, repositories, virtual machine images and Kubernetes for vulnerabilities, misconfigurations, secrets and licenses, and it emits SBOMs as a side effect. CRACI is a GitHub Actions runner that records what each build fetched, controls where the build can connect and keeps tracking vulnerabilities in what shipped. The core difference: Trivy infers the component list from files, while CRACI observes it. For the SBOM and dependency vulnerabilities of the software you build, CRACI replaces Trivy. For the rest of what Trivy scans, pick a tool per job from the list below.

Why teams look for Trivy alternatives

• The March 2026 supply chain compromise. Aqua Security's advisory (CVE-2026-33634) describes a malicious Trivy v0.69.4 release and poisoned trivy-action and setup-trivy tags on March 19, 2026, followed by malicious Docker Hub images on March 22. The injected code stole credentials from CI runners. Aqua published safe versions and recommends pinning actions to full commit SHAs.
• A scan is not tracking. Trivy reports what it finds when it runs. Keeping findings, owners and status across repositories and releases, and rechecking shipped software as new advisories appear, is left to you.
• The SBOM is inferred from files. A pre-build scan reads lock files. Where a repository commits none, there is little to read, and the versions a real install resolves are decided at build time.
• Breadth over depth. One binary covers many jobs. Teams that need more in one area, such as infrastructure as code or container images, often move that job to a dedicated tool.

Every scanner your pipeline downloads and runs is itself part of your software supply chain, running next to the job's secrets. On CRACI, the runner records the SBOM, so there is no scanner step to download for the software you build. The runner's egress policy can limit which hosts any step in the job reaches, and each job's network trace is recorded. Pinning actions to commit SHAs, as Aqua recommends, applies on CRACI too.

Trivy alternatives, by the job Trivy does for you

• SBOMs and dependency vulnerabilities for software you build: CRACI. It records the SBOM from the build, keeps re-evaluating it, and routes findings to the owning team.
• Scanning container images and filesystems: Grype, Anchore's open-source vulnerability scanner for container images, filesystems and SBOMs, with EPSS and KEV data for prioritization. It pairs with Syft for SBOMs. See CRACI vs Syft and Grype.
• Infrastructure as code: Checkov scans Terraform, OpenTofu, CloudFormation, Kubernetes, Helm, Dockerfiles, Bicep and ARM templates, and also checks secrets and open-source packages. KICS covers Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, Pulumi and more. Both are open source under Apache-2.0.
• Secrets: Gitleaks detects passwords, API keys and tokens in Git repositories and files, open source under MIT.
• A commercial scanner with fix advice: see CRACI vs Snyk and the SCA tools comparison.

For each option in more detail, and for Grype vs Trivy, see the full guide to Trivy alternatives.

What Trivy does well

Trivy's own description is "a comprehensive and versatile security scanner," and that is accurate. One binary covers several jobs that would otherwise need separate tools:

• Many targets. Container images, filesystems, remote Git repositories, virtual machine images and Kubernetes.
• Many scanners. OS packages and software dependencies, known vulnerabilities, infrastructure as code misconfigurations, secrets and software licenses.
• SBOMs in and out. trivy fs --format cyclonedx or --format spdx-json writes an SBOM, and trivy sbom scans an existing SBOM for vulnerabilities.
• Runs anywhere. It is open source under Apache-2.0, works as a CLI, and has a GitHub Action and a Kubernetes operator.

CRACI does none of the IaC, secret or cluster scanning. If you need to check a Terraform plan, catch a committed token or scan a third-party image you did not build, Trivy or one of the tools above is the right choice.

2:07

Where CRACI is different

Trivy reads files; CRACI watches the build

Trivy's documentation is clear about its method: "If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files." For a post-build target such as a container image, it reads installed package metadata and binaries instead. For Node.js repositories, that means package-lock.json, yarn.lock, pnpm-lock.yaml or bun.lock.

That design is reasonable, and it has a predictable edge. expressjs/express 5.2.1 commits no lockfile, and the anthropics/claude-code repository has no dependency manifest of any kind, so for a pre-build scan of either there is nothing for Trivy to read. That is Trivy working as documented, not failing. The versions a real install would resolve are decided at build time.

CRACI starts from the other end. Jobs run with runs-on: craci, and a package-aware proxy records what the job pulls from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. Packages restored from a CI cache carry their evidence forward. The SBOM (CycloneDX or SPDX) describes what the build actually used, with or without a lockfile.

It says when the record is incomplete

Every CRACI job and cache has a completeness state: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. An empty or thin SBOM is visible as such, rather than looking the same as a project with few dependencies.

It controls the build

Because CRACI runs the job, it can enforce a network egress policy: default deny or default allow, with 24 built-in software-source presets, validated before the job starts and failing closed. Egress control is outside Trivy's scope. The API returns SBOMs, network traces and provenance. CRACI does not sign provenance. For signing, Trivy's docs show a two-tool flow: Trivy writes the SBOM and Cosign signs it as an attestation.

It keeps watching

Trivy scans when you run it. CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs, and security teams can triage findings and route them to the team that owns the fix. Vendor SBOMs are monitored alongside your own builds. CRACI's policy gates can block a build; threshold alerts are on the roadmap.

An inventory of what is deployed where

CRACI's inventory view shows exactly which software versions are deployed to which products, globally. When a new vulnerability lands, you can see which products run the affected version instead of piecing it together from release notes and spreadsheets.

Moving from Trivy

On CRACI there is no SBOM to generate and no dependency scan to maintain for the builds you ship. The runner records the SBOM while the build runs, and CRACI keeps checking it for new vulnerabilities after the build has finished.

Be clear about what CRACI does not do. It does not scan infrastructure as code, Kubernetes clusters or virtual machine images, it does not look for secrets or misconfigurations, and it does not scan images or software you did not build. Threshold alerts are on the roadmap. It runs GitHub Actions only today, with GitLab CI and Jenkins on the roadmap. If you rely on Trivy for any of that, keep it for that.

For the Cyber Resilience Act

The CRA asks manufacturers to document the components in each product, including an SBOM, and to handle and report vulnerabilities in what they ship. Trivy helps by finding vulnerabilities and misconfigurations and by producing SBOMs, and the evidence trail from release to SBOM is yours to build. CRACI records the SBOM per build, ties it to the artifact, exports SBOMs as CycloneDX or SPDX, and submits the CRA vulnerability notifications on your behalf. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. See what the CRA is and build-time SBOM generation.

CRACI vs Trivy: common questions

Free options, the March 2026 compromise, and what CRACI replaces

What is the best Trivy alternative?

It depends on which Trivy job you are replacing. For SBOMs and dependency vulnerabilities in software you build with GitHub Actions, CRACI records the SBOM from the build and keeps tracking it. For scanning container images, Grype is a close open-source match. For infrastructure as code, Checkov and KICS are open-source options. For secrets, Gitleaks. No single tool replaces all of Trivy.

Is there a free alternative to Trivy?

Yes. Grype (images, filesystems and SBOMs), Checkov and KICS (infrastructure as code) are open source under Apache-2.0, and Gitleaks (secrets) is open source under MIT. CRACI is a paid product, billed per build minute with no monthly fee.

Is Trivy still safe to use after the March 2026 compromise?

Aqua Security's advisory (CVE-2026-33634) describes a malicious Trivy v0.69.4 release and poisoned trivy-action and setup-trivy tags on March 19, 2026, and malicious Docker Hub images on March 22. Aqua lists safe versions and recommends rotating secrets that may have been exposed and pinning GitHub Actions to full commit SHAs. Check the advisory for the versions you run.

What is the difference between Trivy and Grype?

Both are open-source scanners under Apache-2.0. Grype focuses on vulnerabilities in container images, filesystems and SBOMs, and pairs with Syft for SBOM generation. Trivy covers more targets and scanners in one binary, including infrastructure as code, secrets, licenses, virtual machine images and Kubernetes.

Can CRACI replace Trivy?

For the SBOM and dependency vulnerabilities of the software you build on GitHub Actions, yes: CRACI records the SBOM while the build runs and keeps re-evaluating it against vulnerability data. CRACI does not scan infrastructure as code, Kubernetes clusters, virtual machine images, secrets, misconfigurations or images you did not build. Keep Trivy, or another scanner, for those.

Does CRACI scan Terraform or other infrastructure as code?

No. CRACI records what your builds fetch and tracks vulnerabilities in what you ship. For Terraform and other infrastructure as code, use Trivy's misconfiguration scanner or a dedicated tool such as Checkov or KICS.