Shoalcheck, Kubescape, Popeye and Trivy
All four read a Kubernetes cluster and tell you what is wrong with it, and they answer different questions. Shoalcheck is a read-only audit across reliability, security and cost: it prices what it finds and checks a drain, a lost zone or an upgrade before you make the change. The other three are free and open source, and each of them does something Shoalcheck does not.
What this page says about the other tools comes from each project's own README, read on 11 November 2026. Projects move; where a line here has gone stale, the README is right and this page is wrong.
Four tools, seven questions
| Question | Shoalcheck | Kubescape | Popeye | Trivy |
|---|---|---|---|---|
| What it is | A read-only audit of a running cluster: reliability, security and cost | Security posture and compliance scanning; created by ARMO, a CNCF incubating project | A linter for a live cluster's deployed resources | A security scanner for images, code, infrastructure as code and clusters, by Aqua Security |
| Where it runs | Your laptop or CI. Nothing is installed in the cluster | A CLI, or an operator installed in the cluster | A CLI against the live cluster | A CLI, or the Trivy Operator installed in the cluster |
| Changes to the cluster | None: get and list only, and every reading counts its own object writes (0) | The CLI is agentless; node-level host checks, admission control and runtime monitoring need components in the cluster | None; its README says it "does not alter any of your Kubernetes resources". An optional mode runs it as a CronJob in the cluster | trivy k8s uses your kubeconfig but by default runs a node-collector Job in the cluster; the operator scans from inside and writes its reports there |
| Image vulnerabilities | Not scanned | Yes, with Grype | Not scanned | Yes |
| Cost | In dollars, from your cloud's list prices, and from measured usage when the cluster's Prometheus is reachable | Not among its listed features | Over- and under-allocation, when the cluster runs metrics-server; no dollar figure | Not among its listed features |
| Before a change | Preflight for a drain, a lost zone or an upgrade, with an exit code a script can act on | No drain, zone-loss or upgrade-blocker check found; it flags an outdated Kubernetes version | Lints a missing PDB, deprecated API groups and an old Kubernetes version; no per-node drain or zone check | Flags deprecated and removed APIs; no drain or zone-loss check |
| Licence and price | Preflight and the size of any reading are free. Every finding with its evidence is from $59 a month. The code that touches the cluster is Apache-2.0 | Apache-2.0, free | Apache-2.0, free | Apache-2.0, free |
Sources: the READMEs of kubescape/kubescape, derailed/popeye, aquasecurity/trivy and aquasecurity/trivy-operator on GitHub, read on 11 November 2026, and their licence files. A longer matrix with a quote behind every cell, covering Kubecost, Komodor and Chkk as well, is on the home page.
Wider on security, and it runs inside the cluster
Where Kubescape is stronger
- Checks against NSA-CISA, MITRE ATT&CK and CIS Benchmarks
- Scans YAML files and Helm charts as well as clusters
- Finds CVEs in images with Grype and patches them with Copacetic
- Admission control with Validating Admission Policies, and eBPF runtime monitoring
- Free, open source, and a CNCF incubating project
Where Shoalcheck differs
- Reliability and cost in the same reading as security, with the cost in dollars
- Preflight for a drain, a lost zone or an upgrade
- Nothing runs in the cluster, at any point
- No admission control, runtime monitoring or image scanning
Teams that want policy enforcement and runtime detection have it in Kubescape. Shoalcheck answers a different question: what a change will strand, and what the cluster costs.
The closest in spirit: read-only, live cluster, free
Where Popeye is stronger
- Free and open source, with nothing to buy
- Quick to run, with a report you can dump to HTML
- Read-only, like Shoalcheck
- Flags over- and under-allocation when metrics-server is present
Where Shoalcheck differs
- Cost in dollars, from list prices and from measured usage
- Preflight for a drain, a lost zone or an upgrade
- A history of readings, and a comparison of two
- A CI gate with SARIF, and findings filed in Jira or Linear
- Each finding names the object it rests on, with its evidence
If Popeye already answers your questions, keep it. Shoalcheck is for the questions that need a dollar figure or a yes-or-no before a change.
Almost no overlap: what is in your images, against how the cluster runs them
Where Trivy is stronger
- Known vulnerabilities in images and dependencies, and SBOMs
- Secrets and licences in code, and infrastructure-as-code misconfigurations
- CIS, NSA and Pod Security Standards compliance reports
- Many targets beyond Kubernetes
- Free and open source
Where Shoalcheck differs
- It does not scan images or code at all
- It reads the running cluster's configuration for reliability, cost and security
- It never requests Secrets, ConfigMaps or logs
- Nothing is installed in the cluster
Most teams that run Trivy would run Shoalcheck beside it, not instead of it.
What it is, and what it is not
89 detection rules and 15 stack analyzers across reliability, security and cost, and each finding names the object it rests on. It asks with get and list only, installs nothing, and leaves nothing running after the command exits. Every reading counts its own requests and object writes.
It never requests Secrets, ConfigMaps or logs. Run it under the ClusterRole it ships with, and your API server refuses them too — what it reads, line by line.
Preflight answers a drain, a lost zone or an upgrade before you make it: exit 0 when nothing it checks stops the change, 2 when something does, 1 when a read it needed was refused. Around the reading: a CI gate with SARIF, tickets in Jira or Linear, a desktop app, and a document you can hand to someone.
It does not scan images, enforce admission policies, monitor between readings, or change anything in the cluster. Preflight and the size of any reading are free; every finding with its evidence and fix is Pro at $59 a month, and Team and Business cover more clusters — plans and prices.
Something here out of date? The rows about other tools quote their READMEs as of 11 November 2026. When a project changes, its README is the source.