{"data":{"slug":"kubescape","name":"Kubescape","tagline":"Apache-2.0 CNCF Kubernetes security — manifest and cluster scans, image CVEs, auto-fix, admission policies, MCP server","category":"devops","categoryName":"DevOps","url":"https://kubescape.io","github":"https://github.com/kubescape/kubescape","pricing":"open-source","hook":"Kubescape is a CLI and optional in-cluster operator that scans Kubernetes clusters, YAML, Helm charts and Kustomize dirs against NSA-CISA, MITRE ATT&CK and CIS benchmarks, scans images for CVEs, and can rewrite manifests to fix what it finds.","whatsGood":"Apache-2.0 (kubescape/kubescape), a CNCF incubating project. Free path: brew install kubescape, kubectl krew install kubescape, or the install script, then kubescape scan against your current context, a manifests folder or a Git URL. --compliance-threshold turns it into a CI gate. kubescape fix patches manifests, kubescape patch uses Copacetic to patch vulnerable images, and kubescape vap manages Validating Admission Policies. The operator adds eBPF runtime detection through Inspektor Gadget, and kubescape mcpserver exposes results to AI assistants. Offline download for air-gapped clusters. ★~11.8k.","theCatch":"Created and still driven by ARMO, which sells a commercial platform on top, so expect docs and links to point there. Full-framework scans are noisy on a first run; pick one framework or a namespace scope before wiring it into CI. Image scanning wraps Grype, so it overlaps with Trivy if you already run that. The runtime operator is a real in-cluster footprint, not just a CLI.","verdict":"Free, broad Kubernetes posture scanning that fits in CI with one command — start with a single framework to tame the noise, and skip it if you have no Kubernetes.","addedAt":"2026-10-07","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Kubernetes","tags":["mcp","cli","self-host","local-first","permissive","security","kubernetes","active"],"capabilities":["mcp","cli"],"surfaces":["MCP","CLI","Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":11811,"starsPerWeek":44,"access":"free","archived":false,"repo":{"createdAt":"2021-08-12","pushedAt":"2026-10-16","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"github-actions","name":"GitHub Actions","tagline":"CI/CD that lives where your code does"},{"slug":"docker","name":"Docker","tagline":"Container runtime that changed deployment"},{"slug":"kubernetes","name":"Kubernetes","tagline":"Container orchestration at scale"},{"slug":"pulumi","name":"Pulumi","tagline":"Infrastructure as code in real languages"},{"slug":"fly-io","name":"Fly.io","tagline":"Deploy apps to VMs close to your users"}],"links":{"self":"/api/gems/kubescape","html":"/gems/kubescape","markdown":"/gems/kubescape.md","category":"/api/gems?category=devops","categoryPage":"/stacks/devops"}}