# Trivy / Grype

Vulnerability scans you run. Trivy is Apache-2.0; Grype is Apache-2.0 — Snyk without the seat.

**Replaces:** Snyk

**Tier:** Easy

## Problem

Snyk sells vulnerability and fix-PR Seats as a subscription. You wanted a scanner in CI you run. Trivy is Apache-2.0 (aquasecurity/trivy). Grype is Apache-2.0 (anchore/grype) if you want that image/filesystem scanner. This is not Snyk's every IDE, reachability, or fix-bot SKU. Code quality stays on /replace/sonarcloud.

## Stack

- [Trivy](https://trivy.dev) — Apache-2.0 scanner for containers, repos, misconfig, and secrets
- [Grype](https://github.com/anchore/grype) — Apache-2.0 vulnerability scanner for images and filesystems

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| Snyk (small team) | $1,200 | Trivy or Grype in CI |

**About $1,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

These are CLI/CI jobs, not a hosted app. Run Trivy or Grype in the pipeline that already builds the image. Start on Railway only if you also want a registry to scan — that stack is /stacks/harbor-registry. No one-click scanner template in this repo.

[Start on Railway](https://c17.io/go/railway/trivy-scan?from=%2Fstacks%2Ftrivy-scan.md)

[Harbor if this is the registry that holds the images you scan](https://c17.io/stacks/harbor-registry)

## AGENT_PROMPT

```
Replace Snyk with Trivy (preferred) or Grype.

- Add a CI step that scans the image or lockfile you already build. Fail the job on CRITICAL if that is policy.
- Do not claim Snyk fix-PRs or every reachability graph. Write AGENT_PROMPT.md.
- Images you host belong on /stacks/harbor-registry.
```

## FAQ

### Trivy or Grype?

Trivy if you want one CLI for images, repos, misconfig, and secrets. Grype if you want Anchore's image/filesystem scanner. You can run both; start with one.

### Is this SonarCloud?

No. SonarCloud is code quality — /replace/sonarcloud. Snyk is vulns in deps and images.

### Can I deploy this on Railway?

The scanner is a CI job. Railway is useful for the registry you scan, not for Trivy itself.

Source: https://c17.io/stacks/trivy-scan