Grype

Grype is a free, Apache-2.0-licensed scanner for known vulnerabilities in software artifacts. It is a strong fit for developers and security teams that want to scan images, filesystems, SBOMs, or individual dependencies in their own environment. Its flexible inputs and prioritization options are useful; the latest-release-only security updates and best-effort support call for operational planning.

Overview

Grype checks container images, directories, files, archives, SBOMs, and individual packages identified by PURL or CPE. That range makes it practical for both broad artifact scans and lightweight checks of a particular dependency, including compliance scanning. It supports major operating-system package ecosystems and a wide selection of language packages, so teams can apply one scanner across varied software components.

Self-hosted deployment and an Apache-2.0 license suit teams that want to run vulnerability scanning under their own control without a paid plan. The trade-off is maintenance responsibility: security updates apply only to the newest release, while vulnerability-report support is best effort.

Key features

• Multiple scan targets: Grype handles images, directories, files, archives, SBOMs, and individual packages. Docker, OCI, and Singularity image support helps accommodate different container formats; individual-package scanning is useful when a full artifact scan is unnecessary.
• Broad ecosystem coverage: Supported ecosystems include Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, PyPI, npm, Maven, Go modules, Composer, NuGet, Pub, RubyGems, Crates, Swift, GitHub Actions, Bitnami, Conda, and WordPress plugins. This breadth is valuable for mixed stacks, though it does not remove the need to keep the scanner itself current.
• Prioritization and VEX: EPSS, KEV, and risk scoring help teams sort findings, while OpenVEX can filter or augment scan results. These options can focus review on more consequential issues rather than treating every finding alike.
• Flexible output: Results can be emitted as a table, JSON, SARIF, or a custom Go template, giving teams choices for human review and integration into their own processes.
• Installation options: A Docker image is provided, alongside community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft.
• SBOM generation: Grype supports SBOM generation, complementing its ability to scan SBOMs as input.

Pricing

Grype — free. The free plan is an Apache-2.0-licensed open-source vulnerability scanner. There is no paid tier or seat or scan quota to weigh in this plan; teams can use it self-hosted. The cost advantage comes with an operational caveat: security updates are applied only to the most recent release, and support is best effort. Commercial support options for Syft or Grype are available by contacting Anchore.

Platforms

Grype supports Linux, macOS, and Windows, and can be deployed self-hosted. The Docker image and community installation options provide additional ways to fit it into development or security environments.

Who it's for

Grype is best suited to developers and security teams that need a no-cost scanner across container images, filesystems, SBOMs, and individual packages. Its package-level checks fit lightweight vulnerability and compliance reviews, while risk prioritization and multiple output formats suit teams that need to sort and route findings. It is less suitable for organizations that require security updates for older releases or dependable support for vulnerability reports.

Pros and cons

• Pro: Broad inputs and package ecosystems let teams scan both complete artifacts and individual dependencies.
• Pro: EPSS, KEV, risk scoring, and OpenVEX provide ways to focus and refine findings.
• Pro: Free, Apache-2.0 licensing and self-hosted deployment suit teams seeking control without a paid scanner plan.
• Con: Security updates go only to the latest release, which constrains teams that need coverage for older versions.
• Con: Vulnerability-report support is best effort, so organizations needing assured assistance should consider commercial support options.

Alternatives

Trivy is another free, Apache-2.0-licensed scanner for readers comparing open-source options. Consider Intruder if its freemium plan, free trial, and infrastructure-target scanning better match your needs. Mondoo CSPM offers free open-source tools spanning cloud, Kubernetes, OS, SaaS, and API scanning, making it worth considering for that broader scope. Kubescape is a free, self-hosted Apache 2.0 option with a CLI and Kubernetes operator.

Prowler Cloud offers a free trial and an open-source plan for readers comparing cloud-focused choices. Cy5 Cloud-Native Vulnerability Management is another alternative to consider. Qualys TotalCloud has a free license with limited API calls for control evaluation, alongside a cloud platform subscription. RapidFort may suit readers seeking curated container images and patching, with its free plan limited to five images from a limited catalog. For category-level comparisons, see cloud vulnerability scanners, container image scanning tools, container security software, and software composition analysis software.

Verdict

Choose Grype if you want a free, self-hosted scanner that can cover varied artifacts and dependencies, then help prioritize and export its findings. Look elsewhere if your team depends on security updates for older releases or needs more than best-effort vulnerability-report support.