CheckOps home

Tools directory

G

CheckOps

Grype

Grype is Anchore's Apache-2.0 vulnerability scanner for container images, filesystems and SBOMs, covering major OS package ecosystems and language packages.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Grype is a vulnerability scanner for container images and filesystems from Anchore. It scans container images, filesystems and SBOMs for known vulnerabilities, supporting major OS package ecosystems (Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon Linux and more) plus language packages. It pairs naturally with Syft for SBOM generation.

The source code is at anchore/grype on GitHub under the Apache-2.0 licence, with about 13,200 stars; the most recent commit was on 9 November 2026.

Features

  1. Image, filesystem and SBOM scanning: Several targets.
  2. OS and language packages: Broad ecosystem coverage.
  3. Severity filters: --fail-on to gate CI.
  4. Output formats: Table, JSON, SARIF, CycloneDX and more.
  5. Syft integration: Scan Syft SBOMs.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 13,200 GitHub stars.

Cons

  1. Known CVEs only: No SAST or misconfiguration checks.
  2. Database updates: Requires vulnerability DB downloads.
grype alpine:latest --fail-on high
grype sbom:./sbom.json

Resources:

Pricing

Grype is free and open source under the Apache-2.0 licence.

  1. Container teams gating images in CI.
  2. SBOM-driven workflows with Syft.
  3. Not a fit for IaC or secrets scanning.

Conclusion

Grype is a fast, focused container and SBOM vulnerability scanner.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Grype side by side.