Repolode
Submit
anchore

anchore/grype

A command-line vulnerability scanner that checks container images, filesystems and SBOMs for known security issues.

Open-source alternative to:Snyk Container

View on GitHub
Stars
13,206
Forks
934
Open issues
445
Last commit
18 hours ago

What is it?

Grype is a vulnerability scanner written in Go. Point it at a container image, a directory, or an existing SBOM, and it reports known vulnerabilities in the operating system packages and language-specific dependencies it finds.

It covers major Linux distribution package ecosystems such as Alpine, Debian, Ubuntu, RHEL and Amazon Linux, along with packages for Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust. It accepts Docker, OCI and Singularity image formats, and can read images from a local containers-storage store on Linux when requested explicitly.

Results can be prioritized using EPSS, CISA KEV and risk scoring, and filtered or augmented with OpenVEX statements.

Key features

  • 01Scans container images, filesystems and SBOMs for known vulnerabilities.
  • 02Covers OS packages from Alpine, Debian, Ubuntu, RHEL and more.
  • 03Detects language packages for Python, Java, JavaScript, Go, Rust and others.
  • 04Supports Docker, OCI and Singularity image formats.
  • 05Prioritizes findings with EPSS, KEV and risk scoring.
  • 06Filters and augments results with OpenVEX.

Use cases

  • Checking a container image for vulnerable packages before deploying it.
  • Scanning a project directory during local development or in CI pipelines.
  • Scanning an SBOM generated by Syft to find known issues without re-reading the image.
  • Prioritizing remediation work using exploitability data such as KEV.

Quick start

  1. 1

    Run the official install script from the README

  2. 2

    Scan a container image

    grype alpine:latest
  3. 3

    Scan a directory

    grype ./my-project

In collections

CLI & terminal tools

Topics

#vulnerability-scanner#container-security#sbom#docker#supply-chain-security#devsecops#cli#container-image#containers#cyclonedx

FAQ

What is grype?
A command-line vulnerability scanner that checks container images, filesystems and SBOMs for known security issues. Grype is a vulnerability scanner written in Go. Point it at a container image, a directory, or an existing SBOM, and it reports known vulnerabilities in the operating system packages and language-specific dependencies it finds.
Is grype free to use? What license does it have?
grype is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is grype still maintained?
Actively maintained. The last commit to grype was on Nov 7, 2026.
What can I use grype for?
Checking a container image for vulnerable packages before deploying it. Scanning a project directory during local development or in CI pipelines. Scanning an SBOM generated by Syft to find known issues without re-reading the image. Prioritizing remediation work using exploitability data such as KEV.
How do I install grype?
Run the official install script from the README Scan a container image: grype alpine:latest Scan a directory: grype ./my-project
Where can I get grype?
The source code and installation instructions are on GitHub: https://github.com/anchore/grype

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects