Grype review
A focused, free scanner for container, filesystem, package, and SBOM vulnerabilities.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Grype is an open-source command-line vulnerability scanner from Anchore for teams that need focused analysis of container images, filesystems, packages, and software bills of materials. It runs locally on Linux, macOS, and Windows, and can be deployed in a self-hosted environment. Direct target scans use Syft internally to generate an SBOM before matching packages against known vulnerabilities, while existing Syft JSON, SPDX, and CycloneDX files can also be scanned.
Its strongest fit is breadth across scan inputs and package ecosystems without a paid plan structure. Grype can inspect images from Docker, Podman, Containerd, registries, and OCI sources, along with directories, files, archives, and individual packages identified through PURL or CPE identifiers. Matching strategies include ecosystem-specific, distribution-specific, and CPE approaches. Supported ecosystems include Alpine APK, Debian DPKG, RPM, Python, JavaScript, Java, Go, PHP, .NET, Dart, Ruby, Rust, Swift, GitHub Actions, and Bitnami. JSON, table, and other formatted outputs support different reporting workflows, and OpenVEX can filter or augment vulnerability results.
The trade-off is a narrow SCA scope. Grype does not provide reachability analysis, pull-request scanning, license analysis, or a broader policy workflow, so it is less suitable for teams seeking application-level prioritization or governance features in one platform. It is a sensible choice for engineers who want a free, open-source scanner that can run across container and SBOM workflows, especially where self-hosted operation and command-line output fit existing processes. Teams needing deeper dependency analysis, pull-request controls, or license governance should choose a broader SCA product instead.
Grype pros and cons
- Where it wins
- Scans containers, filesystems, archives, packages, and SBOMs
- Supports Syft JSON, SPDX, CycloneDX, and OpenVEX workflows
- Matches vulnerabilities across operating-system and language ecosystems
- Where it doesn't
- No reachability analysis
- No pull-request scanning
- No license analysis or broader policy workflow
Grype fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update