Grype is a vulnerability scanner for container images and filesystems.
Grype addresses the need to identify known vulnerabilities in software artifacts before deployment. It scans container images, filesystems, and software bill of materials (SBOMs) by analyzing the packages present and cross-referencing them against vulnerability databases. The tool supports a broad range of package ecosystems, including major Linux distributions such as Alpine, Debian, Ubuntu, and RHEL, as well as language-specific package managers covering Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust. It can work with Docker, OCI, and Singularity image formats, and incorporates threat prioritization through EPSS scoring, KEV data, and risk scoring to help teams focus on the most critical issues. The tool also supports OpenVEX for filtering and augmenting scan results.
Teams should choose Grype when they need a straightforward, fast vulnerability scanner that works across multiple package ecosystems and image formats. It is well-suited for CI/CD pipelines where scanning container images or analyzing SBOMs for rapid vulnerability detection is required. The tool's support for SBOM scanning makes it particularly valuable for organizations that have already generated software bills of materials and want to avoid re-analyzing artifacts. The README does not position Grype against specific alternatives, so no comparative guidance can be offered.
The project maintains active continuous integration with static analysis, unit, and integration testing. The tool is developed in Go and distributed across multiple installation channels including package managers and container images. Community engagement is supported through dedicated discussion forums and social media presence.
