CheckOps home

Tools directory

S

CheckOps

Syft

Syft is Anchore's Apache-2.0 CLI and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems and archives, in CycloneDX, SPDX and other formats.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Syft is a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images, filesystems and archives. Its README says it is exceptional for vulnerability detection when used with a scanner such as Grype.

The source code is at anchore/syft on GitHub under the Apache-2.0 licence, with about 9,900 stars; the most recent commit was on 9 November 2026.

Features

  1. SBOM generation: Images, filesystems and archives.
  2. Formats: CycloneDX, SPDX and Syft JSON, among others.
  3. Many ecosystems: OS and language packages.
  4. Attestations: Create signed SBOM attestations; see docs.
  5. Library: Embed in Go programs.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 9,900 GitHub stars.

Cons

  1. Inventory only: Pair with a scanner for vulnerabilities.
  2. Accuracy depends on metadata: Some packages are hard to detect.
syft alpine:latest -o cyclonedx-json > sbom.json

Resources:

Pricing

Syft is free and open source under the Apache-2.0 licence.

  1. Teams with SBOM requirements.
  2. Supply-chain pipelines feeding Dependency-Track or Grype.
  3. Not a fit as a standalone vulnerability scanner.

Conclusion

Syft is a reliable, widely used SBOM generator.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Syft side by side.