anchore/grype

Health v2 · maintenance only

Adoption not part of the score

12789 stars · 868 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Grype is an open-source vulnerability scanner for container images, filesystems, and SBOMs, written in Go by Anchore. It identifies known CVEs across OS and language package ecosystems and supports risk prioritization via EPSS, KEV, and OpenVEX filtering.

Use cases

• scan docker images for known vulnerabilities
• find CVEs in a container image before deploying
• scan a filesystem or SBOM for vulnerable packages
• check if my dependencies have security vulnerabilities
• prioritize vulnerabilities with EPSS and KEV data
• integrate vulnerability scanning into CI/CD pipeline
• generate vulnerability reports for OCI images

When to choose

• you need fast, local vulnerability scanning of container images or filesystems
• you want SBOM-based scanning with CycloneDX or Syft integration
• you need OpenVEX support for filtering false positives
• you want a free CLI alternative to commercial container scanners

When to avoid

• you need full runtime container security monitoring rather than static scanning
• you require a managed scanning service with a dashboard and policy enforcement
• you need binary-level analysis of proprietary executables without package metadata

Facets

cli-tool · maturity active

vulnerability-scanning security cli developer-tools security developer-tools windows cli go sbom cve container-security openvex cyclonedx static-analysis anchore containers devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="anchore/grype")