See every service's security posture at a glance.

MeshReader is an open-source Application Security Posture Management (ASPM)tool built specifically for Kubernetes. It answers the question most security tooling leaves unanswered: not just which CVEs exist, but where real risk concentrates across your running services, and what to fix first. By combining live cluster discovery, software composition analysis, and a transparent risk-scoring model, MeshReader turns a noisy stream of vulnerability data into a clear, navigable map of your application security posture.

Live Kubernetes discovery

MeshReader meets your cluster where it is. A lightweight in-cluster agent watches the Kubernetes API for services, deployments, and pods, deriving the service dependency graph from your real workload configuration rather than guesswork. Prefer not to install anything? Connect a read-onlykubeconfig, or work entirely offline by importing a snapshot. Discovery is read-only and privacy-preserving: with the agent, posture data never leaves your control plane.

Real vulnerability scanning with Syft and Grype

For every workload, MeshReader runs Syft to generate a complete software bill of materials (SBOM) and Grype to match those packages against currentCVE data. The result is the real dependency inventory of each container image and the actual vulnerabilities affecting it — not a stale, hardcoded list. Because the finding model isscanner-agnostic, adapters for Trivy, Snyk, or OSV slot into the same schema, so you can standardize on one posture view across many tools and avoid vendor lock-in.

Risk you can actually reason about

A vulnerability count is not a priority list. MeshReader computes a 0–100 risk score per service by decomposing risk into Impact — data sensitivity (PII, PCI) multiplied by finding severity — and Exploitability — whether a service is internet-facing and how it connects to others. The scoring is deterministic and explainable, so an internet-exposed gateway with critical CVEs ranks above an internal cache with the same packages. Risk weights map to your own policy, making MeshReader a practical tool for DevSecOps teams triaging real software supply chainexposure.

One picture, every signal

Everything renders as an interactive service dependency graph, a sortable table, and a per-service detail panel showing risk, violations, dependencies, and classifiers. You see how a critical CVE in one library propagates through the services that depend on it — turning container vulnerability scanning into genuine, cloud-native situational awareness. MeshReader is open source and built on a clean protobuf object model you own, so you can extend the collector, add scanners, or re-weight risk to fit your environment.

Built for the modern cloud-native stack

MeshReader fits naturally into DevSecOps and platform-engineering workflows. It runs anywhere Kubernetes does — managed clusters such as EKS, GKE, and AKS, or local environments like kind and k3d — and its agent uses standard, read-only RBAC, so security reviews are simple. Because the frontend is a static site and the backend is a small Go service, you can self-host MeshReader with minimal overhead and keep full control of your vulnerability data and software supply chain visibility. There is no SaaS to trust with your cluster internals and no proprietary data store to migrate out of later.

Get started in minutes

The fastest way to evaluate MeshReader is schema-import mode: paste a Syft SBOM or a Grype report and the risk graph renders immediately in your browser, with nothing to install. When you're ready for live data, deploy the in-cluster agent and watch your real services, dependencies, and CVEs populate continuously as your cluster changes. Going from a first scan to a prioritized, navigable view of yourKubernetes security posture is a matter of minutes — not a procurement cycle — which makes MeshReader equally useful for a quick audit or as a permanent part of your continuous security monitoring.