Grype is a free, open-source vulnerability scanner from Anchore for container images, filesystems, and SBOMs, with EPSS and KEV-based prioritization.
Category
Security
Pricing
Free
Verified
Not yet
Last updated
July 17, 2026
Free Plan
What is Grype?
Grype is an open-source vulnerability scanner sponsored by Anchore that identifies security issues in container images, filesystems, and Software Bills of Materials. It covers major OS package ecosystems as well as language-specific packages across Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust.
Grype is released under the Apache-2.0 license and can be installed via curl, Homebrew, Docker, Chocolatey, or MacPorts. It supports risk-based prioritization using EPSS and CISA's Known Exploited Vulnerabilities data.
Who Grype is for
Grype is for developers, DevOps engineers, and security teams who need to assess container images, filesystems, and SBOMs for known vulnerabilities as part of security reviews or CI/CD pipelines.
Key Features
Broad OS ecosystem coverage — Scans packages from Alpine, Debian, Ubuntu, RHEL, Oracle Linux, and Amazon Linux.
Language package support — Detects vulnerabilities in Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust dependencies.
Multiple image format support — Works with Docker, OCI, and Singularity image formats.
SBOM input scanning — Scans pre-generated SBOM files directly, including those produced by Syft.
Risk-based prioritization — Uses EPSS scores, CISA KEV data, and risk scoring to help prioritize which vulnerabilities to fix first.
OpenVEX support — Filters and enhances scan results using VEX (Vulnerability Exploitability eXchange) data.
Pros & Cons
Pros
Free and open source under Apache-2.0
Broad ecosystem support across OS packages and multiple programming languages
Vulnerability prioritization via EPSS and KEV reduces noise
Multiple install methods, including curl, Homebrew, Docker, Chocolatey, and MacPorts
Active GitHub community with 12.6k+ stars
Cons
Command-line tool with no built-in graphical dashboard
Some workflows require pairing with a separate SBOM tool like Syft
No official managed or hosted service documented
Pricing
Open Source Free
Frequently Asked Questions
Is Grype free?
Yes, Grype is open source under the Apache-2.0 license, sponsored by Anchore.
What can Grype scan?
Grype scans container images, filesystems, and SBOM files for known vulnerabilities.
Does Grype support SBOM files?
Yes, Grype can scan SBOM files directly, including CycloneDX and SPDX formats.
How is Grype installed?
Grype can be installed via a curl script, Homebrew, Docker, Chocolatey, or MacPorts.
Does Grype prioritize vulnerabilities?
Yes, it uses EPSS scores, CISA's Known Exploited Vulnerabilities list, and risk scoring to help prioritize remediation.