install

Additional install commands

macOS

Homebrewverified · 100%

brew install kubescape

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install kubescape

MacPorts ports tree · sysutils/kubescape/Portfile · source: api.github.com

Linux

Nixverified · 92%

nix profile install nixpkgs#kubescape

nixpkgs package indexes · pkgs/by-name/ku/kubescape/package.nix · source: api.github.com

openSUSE zypperverified · 92%

sudo zypper install kubescape

openSUSE Tumbleweed package metadata · kubescape · source: download.opensuse.org

Windows

Scoopverified · 92%

scoop install main/kubescape

Scoop official bucket manifest trees · bucket/kubescape.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id kubescape.kubescape -e

Windows Package Manager source index · kubescape.kubescape · source: cdn.winget.microsoft.com

overview

Package summary

Kubernetes testing according to Hardening Guidance by NSA and CISA

Project links

Commands and aliases

kubescape

history

Project history and usage

Kubescape is an open source Kubernetes security and compliance platform, created by ARMO and hosted as a CNCF project. The CLI scans clusters, Kubernetes YAML, Helm charts, repositories, container registries, and images for misconfigurations, vulnerabilities, and risk.

Project history

Kubescape began as a Kubernetes-focused security scanner and expanded into a broader platform covering posture management, hardening, runtime security, image vulnerability scanning, admission control, and remediation workflows. Its repository describes coverage from development through runtime, including NSA-CISA, MITRE ATT&CK, and CIS benchmark-oriented checks.

The CNCF project page records Kubescape's acceptance into CNCF on December 13, 2022 and its move to Incubating maturity on January 13, 2025.

Adoption history

Kubescape's packaging shows adoption across developer and CI workflows: official docs list Homebrew installation, the project maintains a GitHub Action, and the README lists package-manager paths for Homebrew, Krew, Arch, Ubuntu, Nix, Chocolatey, and Scoop.

How it is used

The CLI is commonly used to scan a running Kubernetes cluster, scan local manifest directories, scan container images, list controls and frameworks, and integrate security checks into pull-request or CI pipelines.

Why package nerds care

Kubescape matters to package maintainers because it sits at the intersection of Kubernetes CLI tooling, security scanning databases, and policy frameworks. It is also an example of a CNCF security project with both a standalone CLI and in-cluster components.

Timeline

2022: Kubescape was accepted to CNCF on December 13.
2025: Kubescape moved to CNCF Incubating maturity on January 13.

Related projects

Related projects and integrations include Kubernetes, Helm, Krew, Grype, Copacetic, Inspektor Gadget, GitHub Actions, and CNCF security/compliance tooling.

Sources

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

infrastructure mutation or orchestration signal

Signals

text:kubernetes

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`kubescape`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version4.0.10

manager updated2026-06-30

local dataok

upstreamnot checked

latest detectednot detected

https://github.com/kubescape/kubescape

infoNo cached GitHub release or tag data was available.https://github.com/kubescape/kubescapenone confidence

install metadata

Package metadata

Package key	brew:kubescape
Version	4.0.10
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/kubescape
Homepage	https://kubescape.io
Repository	https://github.com/kubescape/kubescape
Upstream docs	https://kubescape.io/docs
License	Apache-2.0
Source archive	https://github.com/kubescape/kubescape.git
Last updated	2026-06-30T08:36:04Z
Pulse	updated
Build dependencies	go
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	kubescape
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

kubescape

nix profile install nixpkgs#kubescape

normalized package name match
Matched by: Kubescape

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ku/kubescape/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

zypper95%

kubescape 4.0.9-1.1

Tool providing a multi-cloud K8s single pane of glass

https://github.com/armosec/kubescape

sudo zypper install kubescape

License: Apache-2.0
Category: Unspecified
Architecture: x86_64
Source Package: kubescape
1 dependencies
1 provides
normalized package name match
Matched by: Kubescape

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: kubescape from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

MacPorts95%

kubescape

sudo port install kubescape

normalized package name match
Matched by: Kubescape

MacPorts ports tree · api.github.com · MacPorts ports tree: sysutils/kubescape/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

Scoop95%

main/kubescape

scoop install main/kubescape

normalized package name match
Matched by: Kubescape

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/kubescape.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

winget95%

kubescape.kubescape

winget install --id kubescape.kubescape -e

normalized package name match
Matched by: Kubescape

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: kubescape.kubescape from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/kubescape.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install kubescape with Homebrew, MacPorts, Nix, scoop, winget, zypper