# anchore/grype

A vulnerability scanner for container images and filesystems

Repository: https://github.com/anchore/grype
Canonical: https://ross.abutalabs.com/products/grype
Language: Go
License: Apache-2.0
License Family: permissive
Topics: containers, security, vulnerability, docker, golang, go, static-analysis, container-image, tool, oci, cyclonedx, vulnerabilities, hacktoberfest, openvex, vex
Last push: 2026-08-26T19:39:34+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 97, longevity 100
- inputs: {"age_days": 2290, "days_push": 7, "days_rel": 23, "gap_med": 9, "n_releases_24m": 60}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 12789, forks 868 (observed 2026-08-28T04:10:59.812320+00:00)

## What it is
Grype is an open-source vulnerability scanner for container images, filesystems, and SBOMs, written in Go by Anchore. It identifies known CVEs across OS and language package ecosystems and supports risk prioritization via EPSS, KEV, and OpenVEX filtering.

## Use cases
- scan docker images for known vulnerabilities
- find CVEs in a container image before deploying
- scan a filesystem or SBOM for vulnerable packages
- check if my dependencies have security vulnerabilities
- prioritize vulnerabilities with EPSS and KEV data
- integrate vulnerability scanning into CI/CD pipeline
- generate vulnerability reports for OCI images

## When to choose
- you need fast, local vulnerability scanning of container images or filesystems
- you want SBOM-based scanning with CycloneDX or Syft integration
- you need OpenVEX support for filtering false positives
- you want a free CLI alternative to commercial container scanners

## When to avoid
- you need full runtime container security monitoring rather than static scanning
- you require a managed scanning service with a dashboard and policy enforcement
- you need binary-level analysis of proprietary executables without package metadata

## Facets
- artifact type: cli-tool
- maturity: active
- function: vulnerability-scanning, security, cli, developer-tools
- domain: security, developer-tools
- platform: windows, cli, go
- tags: sbom, cve, container-security, openvex, cyclonedx, static-analysis, anchore, containers, devops, linux, macos, docker

## Member repositories
- anchore/grype (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:59.812320+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:13:47.305141+00:00, confidence not recorded.
  - readme: https://github.com/anchore/grype (fetched 2026-08-28T04:10:59.812320+00:00, sha d9b2254206a9)
- Data as of 2026-08-30T08:39:29.467469+00:00.