Grype: Vulnerability scanner for container images and filesystems
Detect vulnerabilities in container images and filesystems.
Learn more about Grype
Grype is a command-line vulnerability scanner written in Go that analyzes container images and filesystem contents to detect security vulnerabilities. It works by identifying installed packages across multiple package managers and operating systems, then cross-referencing them against vulnerability databases. The tool supports a wide range of package ecosystems including Alpine, Debian, Ubuntu, and language-specific managers like npm, pip, and Maven. Grype is commonly deployed in CI/CD pipelines, container registries, and local development environments to identify vulnerabilities before deployment.
Multi-ecosystem support
Detects vulnerabilities across 12+ operating system distributions and 7+ language-specific package managers in a single scan, providing comprehensive coverage for heterogeneous container environments.
OpenVEX integration
Supports OpenVEX format for filtering and augmenting scan results, allowing teams to incorporate vulnerability attestations and custom metadata into scanning workflows.
Filesystem and image scanning
Analyzes both extracted container images and local filesystems without requiring Docker daemon access, enabling vulnerability assessment in restricted environments and CI/CD systems.
package main
import (
"github.com/anchore/grype/grype"
"github.com/anchore/grype/grype/presenter/models"
)
func scanImage() {
results, err := grype.ScanImage("alpine:latest")
if err != nil {
panic(err)
}
for _, match := range results.Matches {
println(match.Vulnerability.ID, match.Artifact.Name)
}
}Adds context cancellation support during vulnerability matching operations.
- –support context cancellation while finding vuln matches
Adds SecureOS distro support, Erlang/Elixir hex matcher, and fixes VEX document registry matching.
- –Add secureos distro
- –add hex matcher for Erlang/Elixir ecosystem
- –disable version fallback in EOL query
- –VEX documents with docker.io registry reference not matching, require index.docker.io instead
Adds EOL distro warnings, configurable epoch handling, and Scientific Linux support.
- –warn about packages from EOL distros
- –make it configurable what grype assumes when incoming package to grype is missing dpkg/RPM epoch
- –RHEL EUS: `--only-fixed` should filter out matches are not fixed in the current EUS version
- –support scientific linux
Related Repositories
Discover similar tools and frameworks used by developers
PentestGPT
AI-assisted Python framework for automated security testing.
Ghidra
NSA's open-source tool for analyzing compiled binaries.
Nuclei
Template-based multi-protocol security scanner for CI/CD pipelines.
WhatWeb
Ruby web scanner that identifies technologies and frameworks using 1800+ detection plugins.
Gitleaks
Regex-based secret scanner for git repositories.
Related Reading
Guides and comparisons from the Greptile content library
How to Evaluate Code Review Tools: The 4 Step Framework
A 4-step framework for evaluating code review tools on large teams with complex codebases: define what you need, build a shortlist, run a live test, and get developer feedback. Plus a shortlist of tools and how to future-proof your review process.
Best CodeRabbit Alternatives for Smarter AI Code Reviews in 2026
7 powerful CodeRabbit alternatives ranked by real dev teams. Feature comparison, pricing analysis, and honest reviews to find your perfect AI code reviewer.
Flaky Tests: What Is a Flaky Test and How Do You Manage Them?
What flaky tests are, what causes them, how to detect them, and 12 ways to fix them. Plus why end-to-end tests are more prone to flakiness, and how seeing what actually happened during a run helps you tell a test problem from a code problem.
Automated Code Review: How It Works & Best Tools [2026]
What automated code review is, how it differs from traditional and AI code review, the six types of code review automation tools, and why linters and SAST alone are no longer enough as agentic coding grows.