https://github.com/anchore/grype
A vulnerability scanner for container images and filesystems
https://github.com/anchore/grype
container-image containers cyclonedx docker go golang hacktoberfest oci openvex security static-analysis tool vex vulnerabilities vulnerability
Last synced: 18 days ago
JSON representation
A vulnerability scanner for container images and filesystems
- Host: GitHub
- URL: https://github.com/anchore/grype
- Owner: anchore
- License: apache-2.0
- Created: 2020-05-26T13:44:38.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2025-05-05T16:43:37.000Z (9 months ago)
- Last Synced: 2025-05-05T16:49:43.921Z (9 months ago)
- Topics: container-image, containers, cyclonedx, docker, go, golang, hacktoberfest, oci, openvex, security, static-analysis, tool, vex, vulnerabilities, vulnerability
- Language: Go
- Homepage:
- Size: 6.19 MB
- Stars: 9,798
- Watchers: 81
- Forks: 630
- Open Issues: 305
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
- awesome-go - anchore/grype
- DevSecOps - https://github.com/anchore/grype - the-badge) | (Containers)
- awesome-cloud-security - Grype
- awesome-software-supply-chain-security - anchore/grype: A vulnerability scanner for container images and filesystems
- awesome-docker - Grype
- awesome-devsecops - Anchore Grype - Vulnerability scanner (Container & Kubernetes Security / Container Scanning)
- awesome-platform-engineering - grype - A vulnerability scanner for container images and filesystems (Containers / Threat modelling)
- awesome-cybersecurity-for-developers - Grype
- awesome-containerized-security - grype
- awesome-docker - Grype
- awesome-docker-security - GitHub
- awesome-hacking-lists - anchore/grype - A vulnerability scanner for container images and filesystems (Go)
- awesome-devsecops-russia - grype
- awesome-starred - anchore/grype - A vulnerability scanner for container images and filesystems (Go)
- awesome-repositories - anchore/grype - A vulnerability scanner for container images and filesystems (Go)
- awesome-golang-repositories - grype
- fucking-static-analysis - Grype
- dereks-awesome-list - Grype - A vulnerability scanner for container images and filesystems. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems. (Security / Software Supply Chain Security)
- static-analysis - Grype
- awesome-docker-security - grype - An open source project from Anchore to perform a vulnerability scanning for container images and filesystems. (Tools / Container Scanning)
- awesomeness - Grype - A vulnerability scanner for container images and filesystems. (🔒 Security / ☸️ Kubernetes)
- awesome-cloud-native - grype - A vulnerability scanner for container images and filesystems. (Security & Compliance)
README
# Grype
**A vulnerability scanner for container images and filesystems.**
## Features
- Scan **container images**, **filesystems**, and **SBOMs** for known vulnerabilities (see the docs for a full list of [supported scan targets](https://oss.anchore.com/docs/guides/vulnerability/scan-targets/))
- Supports major OS package ecosystems (Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon Linux, and [more](https://oss.anchore.com/docs/capabilities/all-os/))
- Supports language-specific packages (Ruby, Java, JavaScript, Python, .NET, Go, PHP, Rust, and [more](https://oss.anchore.com/docs/capabilities/all-packages/))
- Supports Docker, OCI, and [Singularity](https://github.com/sylabs/singularity) image formats
- Threat & risk prioritization with **EPSS**, **KEV**, and **risk scoring** (see [interpreting the results docs](https://oss.anchore.com/docs/guides/vulnerability/interpreting-results/))
- [OpenVEX](https://github.com/openvex) support for filtering and augmenting scan results
> [!TIP]
> New to Grype? Check out the [Getting Started guide](https://oss.anchore.com/docs/guides/vulnerability/getting-started/) for a walkthrough!
## Installation
The quickest way to get up and going:
```bash
curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin
```
> [!TIP]
> See [Installation docs](https://oss.anchore.com/docs/installation/grype/) for more ways to get Grype, including Homebrew, Docker, Chocolatey, MacPorts, and more!
## The basics
Scan a container image or directory for vulnerabilities:
```bash
# container image
grype alpine:latest
# directory
grype ./my-project
```
Scan an SBOM for even faster vulnerability detection:
```bash
# scan a Syft SBOM
grype sbom:./sbom.json
# pipe an SBOM into Grype
cat ./sbom.json | grype
```
> [!TIP]
> Check out the [Getting Started guide](https://oss.anchore.com/docs/guides/vulnerability/getting-started/) to explore all of the capabilities and features.
>
> Want to know all of the ins-and-outs of Grype? Check out the [CLI docs](https://oss.anchore.com/docs/reference/grype/cli/) and [configuration docs](https://oss.anchore.com/docs/reference/grype/configuration/).
## Contributing
We encourage users to help make these tools better by [submitting issues](https://github.com/anchore/grype/issues) when you find a bug or want a new feature.
Check out our [contributing overview](https://oss.anchore.com/docs/contributing/) and [developer-specific documentation](https://oss.anchore.com/docs/contributing/grype/) if you are interested in providing code contributions.
Grype development is sponsored by Anchore, and is released under the Apache-2.0 License.
The Grype logo by Anchore is licensed under CC BY 4.0
For commercial support options with Syft or Grype, please [contact Anchore](https://get.anchore.com/contact/).
## Come talk to us!
The Grype Team holds regular community meetings online. All are welcome to join to bring topics for discussion.
- Check the [calendar](https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t) for the next meeting date.
- Add items to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing) (join [this group](https://groups.google.com/g/anchore-oss-community) for write access to the [agenda](https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing))
- See you there!
