# anchore/syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Repository: https://github.com/anchore/syft
Canonical: https://ross.abutalabs.com/products/syft
Language: Go
License: Apache-2.0
License Family: permissive
Topics: containers, docker, go, golang, static-analysis, tool, oci, sbom, spdx, cyclonedx, hacktoberfest
Last push: 2026-08-21T21:36:48+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 97, longevity 100
- inputs: {"age_days": 2309, "days_push": 12, "days_rel": 23, "gap_med": 11, "n_releases_24m": 56}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 9462, forks 936 (observed 2026-08-28T04:10:31.230842+00:00)

## What it is
Syft is a CLI tool and Go library that generates Software Bill of Materials (SBOM) documents from container images, filesystems, and archives. It supports dozens of package ecosystems and outputs standards like SPDX and CycloneDX, pairing with Grype for vulnerability scanning.

## Use cases
- generate an SBOM for a docker image
- inventory packages in a container image
- create SPDX or CycloneDX SBOMs for compliance
- scan a filesystem directory for installed packages
- convert an SBOM between formats
- prepare SBOMs for vulnerability scanning with Grype
- audit software dependencies in OCI images

## When to choose
- you need standards-compliant SBOMs (SPDX, CycloneDX) from images or filesystems
- you want broad package-ecosystem coverage in one tool
- you plan to feed results into a vulnerability scanner like Grype
- you need a Go library for SBOM generation embedded in your own tooling

## When to avoid
- you need runtime vulnerability scanning alone without SBOM generation (use Grype directly)
- you need dynamic analysis of running processes rather than static package inventory
- you need SBOMs for non-container, non-filesystem sources like source repos only

## Facets
- artifact type: cli-tool
- maturity: active
- function: developer-tools, security, cli, static-site-generator
- domain: security, developer-tools
- platform: windows, go, cli
- tags: sbom, spdx, cyclonedx, container-images, supply-chain-security, vulnerability-scanning, oci, containers, devops, linux, macos, docker

## Member repositories
- anchore/syft (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:31.230842+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:22:05.969521+00:00, confidence not recorded.
  - readme: https://github.com/anchore/syft (fetched 2026-08-28T04:10:31.230842+00:00, sha 66f9719b8791)
- Data as of 2026-08-30T08:39:29.467469+00:00.