grafeas/grafeas

Health v2 · maintenance only

Adoption not part of the score

1572 stars · 307 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Grafeas is an open-source artifact metadata API and reference server (written in Go) that defines a uniform spec for storing, querying, and auditing metadata about software resources such as container images, VM images, JARs, and scripts. It organizes metadata into notes and occurrences to support software supply chain auditing, governance, and compliance across build, security, and deployment pipelines.

Use cases

• track which container images are affected by a CVE
• generate a software bill of materials (SBOM) for an image
• audit software supply chain metadata across build and deploy pipelines
• store vulnerability scan results centrally for multiple teams
• query all artifacts built from a compromised builder or commit
• enforce compliance policies using CIS benchmark metadata
• aggregate metadata from different security and build tools in one place

When to choose

• you need a central source of truth for artifact metadata across many teams and pipelines
• you want a standardized API spec (with client libraries in Go, Java, Python, Ruby) for supply chain metadata
• you need fine-grained access control over different metadata types via the notes/occurrences model
• you are building compliance, auditing, or vulnerability management tooling

When to avoid

• you only need simple SBOM generation without a metadata server
• you want a turnkey product with UI rather than an API and reference implementation
• your metadata needs fall outside the Grafeas note/occurrence model and would require heavy extension

Facets

service · maturity maintenance

api-framework database search-engine security monitoring security developer-tools apis self-hosted go self-hosted cross-platform software-supply-chain artifact-metadata sbom vulnerability-metadata compliance notes-and-occurrences api-spec devops containers linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="grafeas/grafeas")