Keelix vs Docker Scout
Short answer: run both. Docker Scout is an excellent image-layer security tool built into the Docker platform. Keelix scans the running box outside-in — host config, internet exposure, and the AI agents and MCP servers on it — and rolls everything into one 0–100 posture score, locally, without touching Docker's cloud. They operate on different surfaces.
Different tools, different questions
Docker Scout answers: “What CVEs are inside this container image?” It compiles an SBOM across every image layer, cross-references it against a continuously updated vulnerability database, evaluates the image against your org's security policies, and can alert you automatically when a new CVE affects an image you're already running. It is tightly integrated with Docker Hub, Docker Desktop, and popular CI platforms — and it is very good at its job.
Keelix answers: “Is this deployed box fit to ship — including the AI agents and MCP servers running on it?” It scans from outside the box in, checks what ports are actually reachable from the internet regardless of what your firewall thinks, audits host config against 93 CIS/SOC 2/ISO 27001 controls, and grades every AI agent and MCP server on the machine for auto-approval, plaintext secrets, and the lethal trifecta. The result is a single 0–100 score you can gate CI on — computed entirely on-box.
Neither tool does the other's job. Docker Scout cannot tell you whether your Claude Code config is storing a plaintext Anthropic API key, or whether port 2375 is reachable from the open internet because Docker silently bypassed UFW via iptables. Keelix does not produce CVE-by-CVE image reports or track base image currency over time. Together they cover the whole attack surface.
Side by side
| Keelix | Docker Scout | |
|---|---|---|
| Primary scope | Live box: host config, containers, outside-in exposure, AI-agent/MCP posture | Container images — package CVEs, base image currency, policy evaluation |
| CVE scanning | Host OS packages (via posture checks) | Deep CVE matching across OS + language deps inside an image |
| AI-agent / MCP posture | ✓ Auto-approval, plaintext secrets, unvetted servers, lethal trifecta | ✗ Not scanned |
| Outside-in exposure | ✓ Shows what ports are actually reachable from the internet | ✗ Not scanned |
| Host config checks | ✓ 93 deterministic CIS/SOC 2/ISO 27001-mapped checks | ✗ Not scanned |
| Docker account required | ✗ Runs fully local — no account, no registration | ✓ Requires Docker login (docker login) to use platform analysis |
| Network / cloud dependency | Local-first — nothing leaves your box; posture score computed on-box | Cloud-backed — image data flows through Docker's infrastructure for platform analysis |
| Free tier repo limit | Unlimited — CLI is free and open-source forever | 1 Scout-enabled repository on Docker Personal (free plan) |
| Output | 0–100 posture score + per-finding report, JSON/HTML/scan record | CVE list + severity, SBOM, remediation guidance, policy verdicts |
| CI gate mechanism | Exit code on posture threshold (e.g. score ≥ 80) | Policy evaluation exit codes; Docker Scout CLI |
| Compliance evidence | ✓ SOC 2, ISO 27001, CIS Docker Benchmark — shareable audit records | ✗ Not generated |
| License | Apache-2.0 (CLI) | Proprietary (included in Docker plans) |
| Price | CLI free forever; Keelix Cloud (history, alerts, teams) — see /pricing | Free: 1 repo; Pro: $9–11/mo (2 repos); Team: $15–16/mo (unlimited repos) |
Local-first vs cloud-backed: why it matters for self-hosted stacks
Docker Scout is cloud-backed by design. When you run platform analysis, image metadata flows through Docker's infrastructure. This enables continuous monitoring — Docker Scout can “recalibrate analysis” automatically as new CVEs emerge against images you have already pushed, without you re-running a scan. For most development teams, that is the right trade-off.
For operators running self-hosted workloads on a VPS — especially with AI agents and MCP servers that may hold API keys, database credentials, or sensitive internal context — the question of what leaves the machine is a real one. Docker Scout requires a Docker login to enable platform analysis. The free tier is capped at one repository; a team running multiple services needs a paid Docker plan to get continuous vulnerability monitoring across all of them.
Keelix is local-first by hard design constraint: secrets are redacted at the scan boundary, and nothing — not a config value, not a plaintext API key Keelix detected and flagged — ever leaves your machine. The posture score is computed on-box. There is no account required to run keelix scan. The CLI is Apache-2.0 and free forever.
What Docker Scout cannot see on a deployed server
When Docker Scout finishes an image scan, you know which packages inside that image have CVEs. What you still don't know:
- Whether port 2375 (the Docker API) or your Redis port is actually reachable from the open internet because Docker bypassed UFW via iptables rules when you ran
-p 6379:6379. - Whether an MCP server running on that host auto-approves all tool calls — turning any prompt injection into full agent takeover.
- Whether your Claude Code, Cursor, or Windsurf config file contains a plaintext API key sitting in
.mcp.jsonon the same server. - Whether a deployed AI agent has all three legs of the lethal trifecta — private data access, untrusted input, and an exfiltration channel — simultaneously in play.
- Whether your host SSH configuration, sudoers, or cron jobs meet the controls your SOC 2 or ISO 27001 auditor will check.
None of these are image-layer issues. All of them are deployment-context issues. They appear at runtime, in the config provisioned after the image was built. That is exactly what Keelix scans.
Recommended setup: run both in sequence
A practical pipeline for a self-hosted Docker deployment: Docker Scout runs at build time on your image, catches CVEs and outdated base images, and gates on policy. Keelix runs at deploy-to-staging time, scans the live box for host config, exposure, and AI/MCP posture, and gates on a posture score before promote-to-production.
# Build stage — Docker Scout image scan
- name: Docker Scout CVE scan
uses: docker/scout-action@v1
with:
command: cves
image: myapp:${{ github.sha }}
exit-code: true
only-severities: critical,high
# Deploy-to-staging stage — Keelix posture gate
- name: Keelix posture gate
uses: jakelamon/keelix@v0.1.0
with:
threshold: 80
fail-on: mcp-auto-approval,mcp-secretsDocker Scout catches the CVEs in the image. Keelix catches the misconfigured deployment. Neither finds what the other finds.
Frequently asked
- Does Docker Scout scan the running host or just container images?
- Docker Scout is image-scoped. It analyzes the packages and dependencies inside a container image and cross-references them against vulnerability databases. It does not inspect the live host — it has no visibility into your firewall configuration, open ports, host OS settings, or the AI agents and MCP servers running on the box.
- Does Docker Scout require a Docker account?
- Yes. Docker Scout platform analysis requires you to sign in with a Docker ID (docker login or via Docker Desktop). Analysis is cloud-backed — image metadata flows through Docker's infrastructure. The free Docker Personal plan supports one Scout-enabled repository; unlimited repositories require a paid Docker Team or Business plan. [Docker Scout Docs ↗]
- Can Keelix replace Docker Scout?
- No — and you should not try. Docker Scout is purpose-built for deep image CVE analysis: it compiles an SBOM across all layers, tracks base image currency, and monitors your images continuously as new CVEs emerge. Keelix does not do image-layer CVE scanning at that depth. What Keelix does is scan the deployed box — host config, internet exposure, running containers, and the AI agents on the machine — into a single 0–100 posture score. They are complementary tools that answer different questions.
- Why does it matter that Docker Scout is cloud-backed?
- For most teams, Docker Scout's cloud architecture is fine. For self-hosted workloads where secrets, internal IP layouts, or AI-agent configs are on the box, knowing that scan data leaves the machine matters. Keelix computes the posture score on-box — nothing, including any plaintext secret it detects and flags, is transmitted externally. That local-first guarantee is a hard design constraint, not just a setting.
- What does Keelix catch that Docker Scout cannot?
- Deployment-context risks: whether a port your Redis or Docker socket is bound to is reachable from the open internet (Docker can silently bypass UFW via iptables), whether an MCP server on the host auto-approves all tool calls, whether a Claude Code or Cursor config file stores a plaintext API key, and whether a deployed AI agent has all three legs of the lethal trifecta simultaneously in play. None of these risks live inside an image layer — they appear at runtime, in provisioned config, after the image was built.
Related
Add the box-level gate Docker Scout cannot provide.
Free, local-first, Apache-2.0. No Docker account required. Run it alongside Docker Scout — not instead of it.