Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Grype

Free#50 of 65 in Software Composition Analysis SoftwareContainer Security SoftwareContainer Image Scanning ToolsCloud Vulnerability Scanners+1 more

Grype: A focused, free scanner for container, filesystem, package, and SBOM vulnerabilities. Ranked #50 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan; best for teams focused on container and SBOM vulnerability scans.

5.3/10Editor score
Visit Grype
Grype5.3 Visit Grype

At a glance

  • Editor score
    5.3 / 10
  • Pricing
    Free plan
  • Best for
    Teams focused on container and SBOM vulnerability scans
  • Free plan
    Yes
  • Paid from
    Free
  • SBOM generation
    Yes
  • Founded
    2016 · Santa Barbara, California, United States
  • Facts checked
    22 Sep 2026
Grype screenshot

  • Where it wins

    • Scans containers, filesystems, archives, packages, and SBOMs
    • Supports Syft JSON, SPDX, CycloneDX, and OpenVEX workflows
    • Matches vulnerabilities across operating-system and language ecosystems

  • Where it doesn't

    • No reachability analysis
    • No pull-request scanning
    • No license analysis or broader policy workflow

Our verdict on Grype

Grype is an open-source command-line vulnerability scanner from Anchore for teams that need focused analysis of container images, filesystems, packages, and software bills of materials. It runs locally on Linux, macOS, and Windows, and can be deployed in a self-hosted environment. Direct target scans use Syft internally to generate an SBOM before matching packages against known vulnerabilities, while existing Syft JSON, SPDX, and CycloneDX files can also be scanned.

Its strongest fit is breadth across scan inputs and package ecosystems without a paid plan structure. Grype can inspect images from Docker, Podman, Containerd, registries, and OCI sources, along with directories, files, archives, and individual packages identified through PURL or CPE identifiers. Matching strategies include ecosystem-specific, distribution-specific, and CPE approaches. Supported ecosystems include Alpine APK, Debian DPKG, RPM, Python, JavaScript, Java, Go, PHP, .NET, Dart, Ruby, Rust, Swift, GitHub Actions, and Bitnami. JSON, table, and other formatted outputs support different reporting workflows, and OpenVEX can filter or augment vulnerability results.

The trade-off is a narrow SCA scope. Grype does not provide reachability analysis, pull-request scanning, license analysis, or a broader policy workflow, so it is less suitable for teams seeking application-level prioritization or governance features in one platform. It is a sensible choice for engineers who want a free, open-source scanner that can run across container and SBOM workflows, especially where self-hosted operation and command-line output fit existing processes. Teams needing deeper dependency analysis, pull-request controls, or license governance should choose a broader SCA product instead.

Your product? Our editors can test Grype in depth and publish a review, labelled as paid · from $149/mo →

Grype pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on github.com

Grype fact sheet

Free planYes
Paid fromFree
Supported ecosystemsAlpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, WordPress plugins
SBOM generationYes
Reachability analysisNot verified
Pull request scanningNot verified
Monitored projectsNot verified
Deployment optionsSelf_hosted
DeploymentSelf-hosted
PlatformsWindows, macOS, Linux
SupportCommunity, Docs
Built forSmall business, Mid-market, Enterprise (editorial estimate)
Integrations1 integrations: Syft
PricingFree plan
Websitegithub.com
Facts checked22 Sep 2026

Grype integrations

Grype lists 1 integrations on its own site.

  • Syft

Alternatives to Grype

See all Grype alternatives →

Also Ranked In

Grype is ranked in 5 of our directories.

Used Grype? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Grype for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — Grype 5.3/10

Grype is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/grype/"><img src="https://www.itechguides.com/best/badge/grype.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update