Skip to content
SPECIFICTION
Get listed

Grype

github.com

Free plan Open source WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.7 #4 of 65 in Software Composition Analysis Software

What it is

Grype is a free, Apache-2.0-licensed scanner for known vulnerabilities in container images, filesystems, and software bills of materials (SBOMs). It can also scan directories, individual files, archives, and packages identified by PURL or CPE. Coverage includes major operating-system package ecosystems and language packages such as Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust; supported image formats include Docker, OCI, and Singularity. Grype uses EPSS, KEV, and risk scoring to help prioritize findings. OpenVEX can filter results or add context. Reports can be emitted as a table, JSON, SARIF, or a custom Go template. The project supports SBOM generation and runs on Linux, macOS, Windows, or in a self-hosted setup. Installation options include a Docker image and community packages such as Homebrew, MacPorts, Winget, Scoop, and Snapcraft. Individual package scanning is described as useful for lightweight vulnerability checks and compliance scanning of specific dependencies. Security updates are applied only to the most recent release, and vulnerability-report support is described as best effort.

Spec sheet

What it does
Grype scans container images, source directories, filesystems, archives, SBOMs and individual packages for known vulnerabilities.Read 15 Oct 2026 · oss.anchore.com
Purpose
Grype scans container images, filesystems, and SBOMs for known vulnerabilities.Read 4 Oct 2026 · github.com
Intended users
The project documentation describes individual package scanning as useful for lightweight vulnerability checks and compliance scanning of specific dependencies.Read 4 Oct 2026 · oss.anchore.com
Platforms
Official source archives and binary builds are published for Linux, macOS, and Windows.Read 4 Oct 2026 · oss.anchore.com
Integrations
The installation documentation provides a Docker image and lists community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft.Read 4 Oct 2026 · oss.anchore.com
Support
Commercial support is offered through Anchore, while community help is routed through issues, contribution documentation and community meetings.Read 15 Oct 2026 · github.com
License
The project is released under the Apache-2.0 License.Read 4 Oct 2026 · github.com
Headquarters
Santa Barbara, California, United StatesRead 28 Sep 2026 · github.com
Founded
2016Read 28 Sep 2026 · github.com
API and SDKs
Grype is documented as a command-line tool and Go project; the cited documentation does not describe a hosted REST API or official SDK.Read 15 Oct 2026 · github.com
CI/CD integration
Grype can run directly in build pipelines or through Anchore's Container Scan GitHub Action, with pipelines able to fail on severity thresholds.Read 15 Oct 2026 · anchore.com
Company founded
Anchore says Saïd Ziouani and Daniel Nurmi opened the company in 2016.Read 15 Oct 2026 · anchore.com
Company headquarters
Anchore is headquartered in Santa Barbara, California.Read 15 Oct 2026 · anchore.com
Company legal name
Crunchbase identifies the maker as Anchore Inc., an active privately held company.Read 15 Oct 2026 · crunchbase.com
Company size
LinkedIn lists Anchore at 51–200 employees.Read 15 Oct 2026 · linkedin.com
Container support
It can scan images from local daemons or remote registries, including Docker and OCI workflows.Read 15 Oct 2026 · github.com
Database
Grype uses a locally cached vulnerability database assembled from multiple feeds and published online without charge.Read 15 Oct 2026 · oss.anchore.com
Database commands
The CLI provides commands to check, update, delete, import, diff, search and inspect database status.Read 15 Oct 2026 · oss.anchore.com
Database freshness limit
Scans fail automatically when the local vulnerability database is more than five days old unless age validation is changed.Read 15 Oct 2026 · oss.anchore.com
Documentation
Anchore publishes getting-started material, installation instructions, scan-target guidance, configuration reference, CLI reference and architecture documentation.Read 15 Oct 2026 · oss.anchore.com
Extensibility
The public Go codebase exposes library packages, including database read/write utilities used by the Grype DB command.Read 15 Oct 2026 · oss.anchore.com
Funding
Anchore announced a $20 million Series A led by SignalFire on January 22, 2020; VentureBeat reported that this brought total funding to about $30 million.Read 15 Oct 2026 · venturebeat.com
Image formats
The README lists Docker, OCI, and Singularity image format support.Read 4 Oct 2026 · github.com
Independent ecosystem evidence
Ecosyste.ms lists Grype as Apache-2.0 licensed, with more than 200 published versions and public Go documentation.Read 15 Oct 2026 · summary.ecosyste.ms
Installation
Official binaries and source archives are provided for Linux, macOS and Windows, with installer-script, Docker and package-manager options.Read 15 Oct 2026 · oss.anchore.com
Language packages
The scanner supports language ecosystems including Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust.Read 15 Oct 2026 · github.com
Licence
Grype is released under the permissive Apache-2.0 licence; its logo uses CC BY 4.0.Read 15 Oct 2026 · github.com
Limit: pre-1.0 compatibility
The independent review warns that Grype remains below version 1.0, so minor upgrades may introduce behavior changes and should be pinned in CI.Read 15 Oct 2026 · hysenlabs.com
Limit: SBOM dependency
TechRadar reports that scanning the same image with Syft versus Trivy-generated SBOMs changed Grype's output by 66%, showing dependence on upstream metadata quality.Read 15 Oct 2026 · techradar.com
Limit: scanner disagreement
TechRadar reports an experiment where Grype found 852 CVEs and Trivy 3,719 in the same Red Hat 8 image, illustrating substantial matching-policy divergence.Read 15 Oct 2026 · techradar.com
Notable news
Anchore announced a $4.6 million U.S. Air Force Platform One Phase III SBIR contract on September 1, 2021.Read 15 Oct 2026 · anchore.com
OpenVEX
The project supports OpenVEX for filtering or augmenting vulnerability results.Read 15 Oct 2026 · github.com
Operating-system packages
Supported package ecosystems include distributions such as Alpine, Debian, Ubuntu, RHEL, Amazon Linux and others.Read 15 Oct 2026 · github.com
Output formats
Configuration supports table, template, JSON and CycloneDX vulnerability-report outputs.Read 15 Oct 2026 · oss.anchore.com
Package coverage
It supports major operating system package ecosystems and language packages including Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust.Read 4 Oct 2026 · github.com
Praise: local operation
Anchore's product page emphasizes that scanning operates locally and does not require an online service after needed data is downloaded.Read 15 Oct 2026 · anchore.com
Praise: release activity
An independent project review records Grype releases v0.118.0 on August 27, v0.119.0 on September 17 and v0.120.0 on October 2, 2026.Read 15 Oct 2026 · hysenlabs.com
Risk prioritization
Results can be sorted by severity, EPSS, KEV and risk scoring.Read 15 Oct 2026 · oss.anchore.com
SBOM formats
Grype accepts Syft JSON, SPDX JSON/XML/tag-value and CycloneDX JSON/XML SBOMs.Read 15 Oct 2026 · oss.anchore.com
Scan targets
It supports container images, directories, files, archives, SBOMs, and individual packages identified by PURL or CPE.Read 4 Oct 2026 · oss.anchore.com
Security incident
GitHub lists a high-severity credential-disclosure vulnerability affecting Grype JSON output, published November 24, 2025.Read 15 Oct 2026 · github.com
Security policy
Only the newest release receives security updates, and vulnerability reports are requested by email on a best-effort basis.Read 15 Oct 2026 · github.com
Security updates
Security updates are applied only to the most recent release.Read 4 Oct 2026 · github.com
Self-hosting
Grype runs locally and can continue scanning offline after downloading its database and scan inputs.Read 15 Oct 2026 · anchore.com
VEX support
OpenVEX can be used to filter and augment scan results.Read 4 Oct 2026 · github.com
Vulnerability reporting
The security policy asks reporters to email [email protected] with issue details and states that support is best effort.Read 4 Oct 2026 · github.com

Plans and prices

Grype Free Apache-2.0 licensed open-source vulnerability scanner Read 4 Oct 2026 · github.com
Grype open-source scanner Free No cost CLI tool · locally run · vulnerability database published at no cost Read 15 Oct 2026 · oss.anchore.com

Every Grype plan and price →

Strong points and limits

Strong points

  • Scans images, filesystems, SBOMs, and packages
  • Supports Docker, OCI, and Singularity images
  • Uses EPSS, KEV, and risk scoring
  • Outputs table, JSON, SARIF, or Go templates
  • Released under the Apache-2.0 License

Limits

  • Security updates apply only to the latest release
  • Vulnerability-report support is best effort

Who it suits

Grype suits developers and security teams scanning images, filesystems, SBOMs, or individual dependencies. Its individual-package scanning is also aimed at lightweight vulnerability checks and dependency compliance scanning.

Verdict

Grype offers broad scan-target and output coverage in a free, open-source package. Keep its latest-release-only security updates and best-effort reporting support in view.

Where Specifiction places it

Alternatives to GrypeAll alternatives →