About Grype
Grype is a command line vulnerability scanner from Anchore. It checks container images, project folders and software bill of materials files for packages with known security issues.
What it does
Grype reads an image, a directory or an SBOM and compares the packages it finds with vulnerability data. It lists which packages are affected and which known issues match them, so teams can decide what to update. It can be run by hand while developing, or as a step in an automated build.
Key features
- Scans container images and file systems
- Reads SBOM files as input
- Checks OS and language-specific packages
- Combines well with Syft for faster scans
- Runs in CI/CD pipelines
Who it's for
Grype suits developers, DevOps engineers and security staff who want a quick scan before software ships. Teams that already generate SBOMs will find it a natural next step.
Pricing and good to know
Grype is open source under the Apache-2.0 license, and its source is on GitHub. It runs from the terminal, so it fits best in scripts and pipelines rather than in a graphical dashboard. Results depend on the vulnerability data available at scan time, so run scans regularly.
Highlights
- Scans container images and filesystems for known vulnerabilities
- Reads SBOM files as input
- Checks OS and language-specific packages
- Works with Syft to speed up scans
- Runs in CI/CD pipelines for automated checks
