Grype
Santa Barbara, California, United States
What it is
Grype is a free, Apache-2.0-licensed scanner for known vulnerabilities in container images, filesystems, SBOMs, and packages. It can scan directories, files, archives, and individual packages identified by PURL or CPE. Coverage includes major operating-system ecosystems and language packages such as Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust; supported image formats include Docker, OCI, and Singularity.
To help prioritize findings, Grype uses EPSS, KEV, and risk scoring. OpenVEX can filter findings or add context to results. Scan output can be formatted as a table, JSON, SARIF, or a custom Go template, and the project also supports SBOM generation. It runs on Linux, macOS, and Windows, or in a self-hosted setup. Installation options include a Docker image and community packages through Homebrew, MacPorts, Winget, Scoop, and Snapcraft. Security updates are applied only to the most recent release. The project requests vulnerability reports by email and describes support as best effort; commercial support options are available by contacting Anchore.
For and against
For
- Scans images, directories, archives, SBOMs, and packages
- Covers operating-system and language package ecosystems
- Supports EPSS, KEV, risk scoring, and OpenVEX
- Results available as table, JSON, SARIF, or templates
- Free and Apache-2.0 licensed
Against
- Security updates apply only to the most recent release
- Project support is best effort
The verdict
Grype offers broad scan targets and output choices for vulnerability checks, including individual packages and SBOMs. Keep its latest-release-only security update policy and best-effort project support in mind.
Who it suits
Grype suits developers and security teams checking container images, filesystems, SBOMs, or specific dependencies. Its documentation also describes individual package scans as useful for lightweight checks and compliance scanning.
Plans and prices
Grype open-source scanner
CLI tool · locally run · vulnerability database published at no cost
Read 15 Oct 2026 · oss.anchore.com
Grype
Apache-2.0 licensed open-source vulnerability scanner
Read 4 Oct 2026 · github.com
On the record
- API and SDKs
- Grype is documented as a command-line tool and Go project; the cited documentation does not describe a hosted REST API or official SDK.github.com · read 15 Oct 2026
- CI/CD integration
- Grype can run directly in build pipelines or through Anchore's Container Scan GitHub Action, with pipelines able to fail on severity thresholds.anchore.com · read 15 Oct 2026
- Company founded
- Anchore says Saïd Ziouani and Daniel Nurmi opened the company in 2016.anchore.com · read 15 Oct 2026
- Company headquarters
- Anchore is headquartered in Santa Barbara, California.anchore.com · read 15 Oct 2026
- Company legal name
- Crunchbase identifies the maker as Anchore Inc., an active privately held company.crunchbase.com · read 15 Oct 2026
- Company size
- LinkedIn lists Anchore at 51–200 employees.linkedin.com · read 15 Oct 2026
- Container support
- It can scan images from local daemons or remote registries, including Docker and OCI workflows.github.com · read 15 Oct 2026
- Database
- Grype uses a locally cached vulnerability database assembled from multiple feeds and published online without charge.oss.anchore.com · read 15 Oct 2026
- Database commands
- The CLI provides commands to check, update, delete, import, diff, search and inspect database status.oss.anchore.com · read 15 Oct 2026
- Database freshness limit
- Scans fail automatically when the local vulnerability database is more than five days old unless age validation is changed.oss.anchore.com · read 15 Oct 2026
- Documentation
- Anchore publishes getting-started material, installation instructions, scan-target guidance, configuration reference, CLI reference and architecture documentation.oss.anchore.com · read 15 Oct 2026
- Extensibility
- The public Go codebase exposes library packages, including database read/write utilities used by the Grype DB command.oss.anchore.com · read 15 Oct 2026
- Funding
- Anchore announced a $20 million Series A led by SignalFire on January 22, 2020; VentureBeat reported that this brought total funding to about $30 million.venturebeat.com · read 15 Oct 2026
- Image formats
- The README lists Docker, OCI, and Singularity image format support.github.com · read 4 Oct 2026
- Independent ecosystem evidence
- Ecosyste.ms lists Grype as Apache-2.0 licensed, with more than 200 published versions and public Go documentation.summary.ecosyste.ms · read 15 Oct 2026
- Installation
- Official binaries and source archives are provided for Linux, macOS and Windows, with installer-script, Docker and package-manager options.oss.anchore.com · read 15 Oct 2026
- Integrations
- The installation documentation provides a Docker image and lists community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft.oss.anchore.com · read 4 Oct 2026
- Intended users
- The project documentation describes individual package scanning as useful for lightweight vulnerability checks and compliance scanning of specific dependencies.oss.anchore.com · read 4 Oct 2026
