Grype

Some of this article's listed sources may not be reliable. Please help improve this article by looking for better, more reliable sources. Unreliable citations may be challenged and removed. (June 2026) (Learn how and when to remove this message)

Grype is an open-source vulnerability scanner. It is developed and maintained by Anchore, and distributed as a command-line interface (CLI) tool.

Grype is designed to identify known security vulnerabilities in container images, filesystems, and software artifacts, by scanning for installed packages and then comparing them against vulnerability databases. It can scan container images stored locally or in remote registries, as well as extracted file systems and software bill of materials (SBOMs).

Grype has scanning support for multiple Linux distributions, including Alpine, Debian, Ubuntu, Red Hat Enterprise Linux (RHEL), and Amazon Linux; as well as language-specific ecosystems such as Java, Python, JavaScript, Ruby, Go, and Rust.

History

Grype was originally released in October 2020 as an open-source vulnerability scanning tool by Anchore as part of its broader container security tooling ecosystem. It replaced the now-deprecated Anchore Inline Scanning script, which reached end-of-life in 2022. It was developed alongside Syft, an open-source software bill of materials (SBOM) generation tool, with the goal of improving visibility into software dependencies and associated vulnerabilities in containerized environments.

References

External links

• grype on GitHub