Container Image Vulnerability Scanner

Container image vulnerability scanner for CI and agents

Scan a public Docker or OCI container image for known vulnerabilities without installing or maintaining a scanner. AV-405 resolves the requested tag to an immutable image digest, analyzes the image with Grype 0.104.1, and returns structured vulnerability evidence plus an optional deterministic PASS/BLOCK policy decision.

Use it before deployment, before an autonomous agent executes a third-party container, or anywhere a CI/CD pipeline needs a machine-readable container security gate.

Quick start

Input one public image reference and, optionally, the severity threshold that should block it:

{
  "image": "alpine:3.20.0",
  "block_if": "high"
}

block_if can be low, medium, high, or critical. If omitted, AV-405 returns evidence only and leaves the policy decision unset.

A completed BLOCK result is still a successfully completed scan. It means one or more known vulnerabilities met or exceeded your requested threshold; it does not mean the Actor failed.

What you get

Each successful scan returns:

• the requested image reference;
• the immutable image digest actually scanned;
• Grype version and vulnerability-database provenance;
• vulnerability counts by severity;
• fix availability where reported by Grype;
• optional PASS/BLOCK decision and blocking count;
• native structured Grype findings for downstream automation;
• runtime and image-size metadata.

The target container is never executed. AV-405 reads image layers for analysis only.

Common use cases

CI/CD container security gate

Call AV-405 before deployment and reject an image automatically when the returned policy decision is BLOCK.

Agent and tool procurement checks

An autonomous agent can inspect a third-party image before selecting or executing it, using the exact immutable digest and structured vulnerability evidence rather than a human-facing report.

Dependency and supplier verification

Use AV-405 as a lightweight independent check when a workflow pulls images from public container registries.

API and automation

AV-405 is designed for machine use through normal Apify Actor runs and APIs. The input and output are structured JSON, making the Actor suitable for CI jobs, orchestration tools and agent workflows.

Example input:

{
  "image": "nginx:1.27",
  "block_if": "critical"
}

A successful response includes requestedImage, scannedImage, imageDigest, engine, summary, policy, and the native Grype result object.

Pricing

$0.49 per successfully completed scan.

AV-405 uses pay-per-event pricing. The billable event is completed-scan, charged once only after a successful scan result is persisted. Invalid inputs and failed scans do not trigger the completed-scan event.

Current scope and limits

AV-405 deliberately keeps V0 narrow:

• public registries only;
• Linux amd64 images;
• no private registry credentials;
• no container execution;
• no remediation service, dashboard, SBOM hosting or continuous monitoring;
• registry preflight is bounded;
• scanner runtime is capped at 240 seconds;
• compressed image-layer processing is bounded;
• output is bounded at 25 MB.

Very large vulnerability result sets can exceed the current output or platform dataset-item limits. In that case the run fails and no completed-scan charge is triggered.

PASS means no known finding met the selected blocking threshold in that scan. It is not a security certification or a guarantee that the image is vulnerability-free. Vulnerability databases change over time, so results can also change even when the image digest does not.

Reproducibility and trust

AV-405 records the immutable image digest, scanner version and vulnerability-database metadata with each successful result. The scanner is pinned to Grype 0.104.1 for this release, and the source release has been regression-tested and benchmarked on the Apify platform.

The service is operated by SMG NextGen Ventures Ltd as part of the Autonomous Ventures programme.