anchore/syft

Health v2 · maintenance only

Adoption not part of the score

9462 stars · 936 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Syft is a CLI tool and Go library that generates Software Bill of Materials (SBOM) documents from container images, filesystems, and archives. It supports dozens of package ecosystems and outputs standards like SPDX and CycloneDX, pairing with Grype for vulnerability scanning.

Use cases

• generate an SBOM for a docker image
• inventory packages in a container image
• create SPDX or CycloneDX SBOMs for compliance
• scan a filesystem directory for installed packages
• convert an SBOM between formats
• prepare SBOMs for vulnerability scanning with Grype
• audit software dependencies in OCI images

When to choose

• you need standards-compliant SBOMs (SPDX, CycloneDX) from images or filesystems
• you want broad package-ecosystem coverage in one tool
• you plan to feed results into a vulnerability scanner like Grype
• you need a Go library for SBOM generation embedded in your own tooling

When to avoid

• you need runtime vulnerability scanning alone without SBOM generation (use Grype directly)
• you need dynamic analysis of running processes rather than static package inventory
• you need SBOMs for non-container, non-filesystem sources like source repos only

Facets

cli-tool · maturity active

developer-tools security cli static-site-generator security developer-tools windows go cli sbom spdx cyclonedx container-images supply-chain-security vulnerability-scanning oci containers devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="anchore/syft")