Overview

Grype is an open source vulnerability scanner for container images and filesystems, built and maintained by Anchore as part of its free, open source security toolchain. It answers one narrow but urgent question — “which known vulnerabilities are actually present in this image I am about to ship?” — using a single self-contained Go binary that needs no agent, no daemon and no server.

Grype works from a Software Bill of Materials. It either inspects the target itself with its sibling project Syft, or reads an SBOM you already have (Syft JSON, CycloneDX or SPDX), and then matches every package it finds against a continuously updated vulnerability database covering the major Linux distributions and language ecosystems. Because cataloguing a directory or an image is the expensive part and matching is cheap, that SBOM-first design is what lets Grype run inside a CI pipeline, an admission controller or a registry scanner without slowing the build down.

The project lives at github.com/anchore/grype, is distributed under Apache-2.0, and is released frequently — the current line is v0.120.x (October 2026), with roughly 13,000 GitHub stars and an active community around Anchore’s OSS documentation site.

Key Features

• Multiple scan targets — container images (Docker, OCI and Singularity formats), local directories and filesystems, and SBOM files. An SBOM on disk or piped over stdin (cat sbom.json | grype) can be scanned with no image pull at all.
• Broad package coverage — OS packages from Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon Linux, SUSE, Wolfi and more, plus language packages for Ruby, Java, JavaScript, Python, .NET, Go, PHP and Rust.
• Risk-aware prioritisation — results can be ordered and filtered by severity, by EPSS score (likelihood of exploitation) and by CISA KEV (vulnerabilities known to be exploited in the wild), so the findings worth fixing first are not buried under hundreds of low-severity entries.
• OpenVEX support — VEX statements can filter or annotate results, letting a triaged or not-affected CVE be suppressed with evidence rather than simply ignored.
• Automation-friendly output — table, JSON, CycloneDX, SARIF and Go-template formats, with --fail-on thresholds that turn a scan into a CI gate via a non-zero exit code.
• Local containers-storage scanning — on Linux, images sitting in a Buildah or Podman store can be scanned explicitly with --from containers-storage, including rootless stores via podman unshare.
• Deployable anywhere — a static binary with no runtime dependencies; the vulnerability database can be pre-downloaded and imported so scans work in air-gapped or rate-limited networks.

Why Use Grype?

Grype sits in the same neighbourhood as other open source container scanners, and the honest summary is that they overlap heavily: both find CVEs in OS and language packages, both are Apache-2.0, both integrate with CI. Grype’s distinguishing trait is how tightly it is built around the SBOM workflow. It is the read side of the same pair as Syft, the SBOM generator, so if you already produce Syft or CycloneDX artefacts during a build, vulnerability scanning becomes a cheap second pass over a file rather than a second inspection of the image.

Its second strength is triage. Rather than handing back a flat list sorted by CVSS, Grype can factor in EPSS probability and CISA KEV membership, which is the difference between a report that gets read and a report that gets ignored. It is also a genuinely small tool: one binary, a straightforward configuration file, and no account, licence key or cloud service required to scan.

Use Cases

• CI/CD quality gate — scan the built image on every pipeline run and fail the build above a chosen severity or fixability threshold.
• Registry and admission control — scan images as they are pushed, or evaluate the SBOM before a workload is admitted to a cluster.
• Base-image housekeeping — compare ageing base images to see which ones carry the most high-severity findings, then prioritise the rebuilds.
• SBOM-driven compliance — keep a signed SBOM per release and rescan it later, so vulnerabilities discovered after shipping can still be traced back to affected artefacts.
• Air-gapped and regulated environments — run entirely offline with an imported vulnerability database and no outbound telemetry.

Platforms

Grype is written in Go and ships as a static binary for Linux, macOS and Windows on both x86-64 and Arm64. It is also available as a container image, as .deb and .rpm packages, and through Homebrew, Chocolatey and MacPorts. The containers-storage feature is included in the official Linux release binaries.

Licence

Free and open source — Apache-2.0. Verified from the LICENSE file in the GitHub repository. Anchore also sells a commercial enterprise product built around the same open source engine, but Grype itself is fully functional and maintained under Apache-2.0, with no account or API key needed to use it.

Website

github.com/anchore/grype · documentation & getting-started guide

Related Tools

Grype pairs naturally with an SBOM generator such as Syft, and complements broader scanners including Trivy. Browse the rest of the free and open source security tools in the directory.