JAVV operator docs¶
JAVV finds the container images that run in your Kubernetes clusters. It scans each image with Trivy and with Grype, and it keeps the results of each scanner apart. For each vulnerability, JAVV records each triage decision in an audit log.
These pages are for the people who install and operate JAVV. To learn how to triage findings in JAVV, read Use JAVV. It has a short video for each task.
For AI agents
Look for these boxes. Each box tells an agent what to read, and which rules to obey.
- To read or triage the findings for a user, connect to the MCP server: Use the MCP server.
- To write a script that pushes scan results, read Push from your own script.
- To write a script that sends other requests, read API.
Start here¶
| To do this | Read |
|---|---|
| Install JAVV with docker compose or with Helm | Deploying |
| Run the scanners in the clusters that you scan | Deploying: connect the scanners and the scanner chart |
| Find the scanner and OpenSearch versions that a release supports | Supported versions |
| Change a setting | Configuration |
| Calculate the OpenSearch size for your clusters | Sizing OpenSearch |
| Learn which parts scale, and what occurs when a part fails | Scaling and failures |
| Learn which indices JAVV uses, how long it keeps the data, and what a snapshot holds | Indices and data |
| Upgrade JAVV, or go back to the previous release | Upgrading and the release notes |
| Verify the published images and charts | Deploying: verify the images and charts |
| Connect an AI agent to the MCP server of JAVV | Use the MCP server |
| Send requests to JAVV from a script, or push results from your own tools | API and Push from your own script |
| Report a security problem | Security |
Each JAVV release has its own version of these docs. Select the version in the version menu.