StackRadar CLI
Lightweight CLI that scans your live Kubernetes cluster for known-exploited vulnerabilities, no agent required
🔗 Visit StackRadar CLI
Description
Knowing whether the container images actually running in your Kubernetes cluster right now have known vulnerabilities usually means either installing a cluster-side agent or scanning images at build time and hoping nothing drifted since. StackRadar CLI takes a simpler approach: run it from your own machine, and it scans every running pod's images directly, no agent, no account, no cluster changes required.
It deduplicates images by digest before scanning (so you're not re-checking the same image 50 times across pods), matches installed packages against the OSV (Open Source Vulnerabilities) database, and specifically flags anything listed in CISA's Known Exploited Vulnerabilities catalog — the subset of CVEs actually being exploited in the wild, which matters more for prioritization than a raw CVE count. It's a single static Go binary built on the osv-scanner library, works with your existing registry credentials, and outputs to table, JSON, or an interactive HTML report. CLI flags cover scanning the current cluster, a single image, serving an interactive report, or gating CI with a `--fail-on` severity threshold. It's Apache-2.0 licensed and free, though still early — 5 commits and 3 stars at time of review.
💬 Our review
The short version: StackRadar CLI's no-agent, scan-from-your-laptop model is a genuinely lower-friction way to get a CVE snapshot of a live cluster, but it's a very young project competing against established, battle-tested scanners.
Against Trivy or Grype — both mature, widely-adopted vulnerability scanners with broader database coverage and large communities — StackRadar CLI's real differentiator is scanning what's actually running in the cluster (deduplicated by digest) rather than just scanning images at build/registry time, plus the specific focus on CISA's exploited-in-the-wild list for prioritization. The trade-off is maturity: 5 commits and 3 stars means far less real-world battle-testing than Trivy, which has years of production use across thousands of organizations. Worth trying as a quick, no-setup cluster snapshot; don't replace an established scanner like Trivy in your CI pipeline with it yet.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Licence Apache-2.0, gratuit.
Pros
Aucun agent cluster ni compte requis, scan direct depuis sa machine
Déduplication par digest, priorisation via la liste CISA des CVEs activement exploitées
Binaire Go statique unique, rapports table/JSON/HTML interactif
Gratuit, Apache-2.0, seuils de gate CI (--fail-on)
Cons
Projet très jeune (5 commits, 3 stars) face à des scanners établis comme Trivy
Couverture de base de données moins éprouvée que Trivy/Grype
Scan ponctuel depuis un poste, pas de surveillance continue intégrée