ToolPalo Alto Networks (Bridgecrew)/10 trustVerified
Checkov
IaC security scanner — Terraform, CloudFormation, K8s, and more.
About
Checkov (bridgecrewio/checkov, Apache-2.0, ~9k stars) scans infrastructure-as-code for misconfigurations: Terraform, CloudFormation, Kubernetes, Dockerfiles, and CI pipelines.
Very actively maintained (62 releases/12mo). The 'shift left' standard for IaC — catch the open S3 bucket before it deploys.
What it can do
- Terraform/CloudFormation/K8s
- Dockerfile scanning
- CI integration
- Custom policies
- Apache-2.0 open source
Setup
pip install checkov.checkov -d .in your IaC repo.- Add to CI; fail builds on critical findings.
Prerequisites
Python; IaC files.
Use cases
codeautomation
Works with
Generic APIAny agent (.md)
Trust score — 8/10
/10 trustVerified
Scored 8/10 (verified tier). ~9k stars, Apache-2.0, very active (62 releases/12mo). The IaC scanning standard. Verified tier.
★ 9,067 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.5/10
- Maintenance · recency, releases, issue load
- 9.1/10
- Openness · license + docs
- 9.4/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · 9,067 GitHub stars (log-scaled vs catalog peers)
- · last push 1d ago; 62 releases/12mo; 194 open issues
- · manual review: IaC scanner (Palo Alto); very active; Terraform/CloudFormation/etc.; license: Apache-2.0
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.