Commands

JSON output by default (for scripts); --format table for humans.

Supported formats

CycloneDX JSON (1.4 to 1.6), SPDX 2.3 JSON, Syft JSON, Trivy JSON (vulnerabilities, packages, secrets), Grype JSON, OSV-Scanner JSON (with call analysis), SARIF 2.1.0, GitLab reports (dependency, container and secret detection), Trivy Operator, Harbor, Amazon ECR / Inspector, Gitleaks JSON and govulncheck JSON. The format is detected automatically.

inspect

checkops inspect trivy.json --format table

Reads the file locally without sending anything: format, tool, components, vulnerabilities by severity, secrets.

push

checkops push trivy.json --product acme-api --version 1.4.0 [--app shop] [--wait [--fail-on high] [--ignore-policy]]

Option	Purpose
--product	Short product id (lowercase, digits, -, _), created on first upload
--version	Shipped version (number or Git tag)
--app	Product’s application, created if needed (CHECKOPS_APP)
--wait	Wait for the comparison with OSV, KEV and EUVD, then print the result
--fail-on	With --wait: exit 1 when an open vulnerability reaches this level (low, medium, high, critical)
--ignore-policy	With --wait: skip the product’s CI policy
--timeout	Maximum wait in seconds (default 180)

With --wait, exploited vulnerabilities always block, and “not affected” and “fixed” VEX decisions are honoured. A vulnerability whose vulnerable function is never called (govulncheck, OSV-Scanner) does not block on the threshold. The product’s CI policy, set in the portal (exploited, CVSS threshold, licenses, secrets), also applies.

Secrets never leave the machine: their value and code excerpts are removed from the file before upload.

gate

checkops gate trivy.json --fail-on critical [--fail-on-secrets]

Local check, nothing is sent: exit 1 when a vulnerability reaches the level, or when a secret is found with --fail-on-secrets.

diff

checkops diff main.trivy.json mr.trivy.json --format table --fail-on-new high

Compares two files (main branch and merge request): components added, removed or updated, vulnerabilities introduced or gone. --fail-on-new exits 1 when an introduced vulnerability reaches the level.

auth

auth login, auth status, auth logout: see Authentication.

scaleway sync

Scans recently pushed Scaleway Container Registry images with Trivy and sends them. See Scaleway registry.

harbor sync

Scans recently pushed images of a Harbor without a scanner (OVHcloud S plan) with Trivy and sends them. See Harbor and OVHcloud.

cloud scan, cloud import

Audits a Scaleway or OVHcloud account with your own read-only keys, or sends a Prowler report (AWS, Azure, GCP). Only results are sent. See Cloud audit.