Kubescape
Apache-2.0 CNCF Kubernetes security — manifest and cluster scans, image CVEs, auto-fix, admission policies, MCP server
DevOps / Infrastructure · Apache-2.0 · 11.8k
Reviewed 2026-10-07 · last push 2026-10-16 · repo checked 2026-10-19
What's Good
Apache-2.0 (kubescape/kubescape), a CNCF incubating project. Free path: brew install kubescape, kubectl krew install kubescape, or the install script, then kubescape scan against your current context, a manifests folder or a Git URL. --compliance-threshold turns it into a CI gate. kubescape fix patches manifests, kubescape patch uses Copacetic to patch vulnerable images, and kubescape vap manages Validating Admission Policies. The operator adds eBPF runtime detection through Inspektor Gadget, and kubescape mcpserver exposes results to AI assistants. Offline download for air-gapped clusters. ★~11.8k.
The Catch
Created and still driven by ARMO, which sells a commercial platform on top, so expect docs and links to point there. Full-framework scans are noisy on a first run; pick one framework or a namespace scope before wiring it into CI. Image scanning wraps Grype, so it overlaps with Trivy if you already run that. The runtime operator is a real in-cluster footprint, not just a CLI.
Verdict
Free, broad Kubernetes posture scanning that fits in CI with one command — start with a single framework to tame the noise, and skip it if you have no Kubernetes.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/kubescape)
HTML
<a href="https://stackgems.com/gems/kubescape"><img src="https://stackgems.com/badge/kubescape.svg" alt="Kubescape reviewed on Stack Gems" height="20"></a>