Grype

Grype is a free, open-source vulnerability scanner for container images, filesystems, archives, packages and SBOMs. It suits developers and security teams who want to check dependencies and prioritize known vulnerabilities without adopting a paid scanning service. Its breadth of scan targets and export formats is a strong fit for flexible workflows, though security updates apply only to the latest release.

Overview

Grype scans software artifacts for known vulnerabilities, covering both operating-system packages and language ecosystems such as Java, JavaScript, Python, .NET, Go, PHP, Ruby and Rust. It can also scan an individual package identified by PURL or CPE, making it practical for lightweight dependency checks and compliance scans when a full image or filesystem scan would be unnecessary.

The Apache-2.0 license and self-hosted deployment make Grype a straightforward option for teams that want an open-source scanner in their own environment. The trade-off is a latest-release-only security update policy: organizations that need support or update coverage across older releases should account for that constraint.

Key features

• Broad scan targets: Scan container images, directories, files, archives, SBOMs or individual packages. Docker, OCI and Singularity image formats are supported, so Grype can fit varied container workflows.
• Wide ecosystem coverage: Coverage spans major Linux distributions and package ecosystems including Alpine, Debian, Ubuntu, RHEL, SUSE, Amazon Linux, npm, Maven, Go modules, PyPI, NuGet, RubyGems, Composer, Crates, Swift, Conda, WordPress plugins and GitHub Actions. This is useful for teams assessing mixed stacks, rather than only operating-system packages.
• Prioritization and VEX: EPSS, KEV and risk scoring help sort findings by potential significance. OpenVEX can filter or augment scan results, which helps teams account for vulnerability context rather than treating every finding alike.
• Flexible output: Results can be emitted as a table, JSON, SARIF or a custom Go template. That range supports both readable reviews and integration into tooling that consumes structured results.
• Installation options: A Docker image is provided, with community installation options including Homebrew, MacPorts, Winget, Scoop and Snapcraft. This offers several paths to fit developer environments without changing the scanner’s self-hosted model.

Pricing

Grype — free. The plan is an Apache-2.0-licensed open-source vulnerability scanner. There is no paid tier or seat, scan quota, or trial term described for Grype, so it is the clearest fit for individuals and teams seeking a free scanner they can run themselves. Commercial support options for Grype or Syft are available by contacting Anchore; support is otherwise best effort.

Platforms

Grype supports Linux, macOS and Windows, and can be deployed as self-hosted software. Its Docker image and community package options make it accessible across common developer environments, while self-hosting keeps deployment under the user’s control.

Who it's for

Choose Grype if you need free vulnerability scanning across containers, filesystems, SBOMs or specific dependencies, especially when you want to prioritize results with EPSS, KEV and risk scoring or export them in machine-readable formats. It is less suitable when your team needs security updates for older releases or expects guaranteed support: the project updates only its most recent release, and support is best effort.

Pros and cons

• Pro — Scans more than container images: Directory, archive, SBOM and individual-package scanning make it useful for checks throughout a software workflow.
• Pro — Helps focus remediation: EPSS, KEV, risk scoring and OpenVEX provide ways to prioritize and contextualize findings.
• Pro — Free and permissively licensed: The Apache-2.0 license and zero-price plan suit users who want a self-hosted scanner without a paid subscription.
• Con — Older releases do not receive security updates: Teams maintaining a pinned version must consider the latest-release-only policy.
• Con — Support is best effort: Organizations that require dependable commercial assistance should contact Anchore about its commercial support options.

Alternatives

Trivy is another free, Apache-2.0-licensed scanner for Linux, macOS, self-hosted and Windows environments; choose between the two based on which scanner better fits your workflow.

Google Artifact Analysis is a paid option for users who prefer per-scan pricing: Automatic scanning and On-Demand Scanning are each $0.26, paid once, with subsequent scans of the same image free under Automatic scanning.

Aqua Container Security is a paid alternative with a free trial, suited to readers evaluating a commercial container-security product.

Sonatype Container Scanner is a paid alternative for Linux and Windows.

RapidFort offers a free tier with five curated near-zero-CVE images from a limited catalog, daily rebuilds and patching, and support for Alpine, Debian, UBI and Ubuntu LTS; choose it when that curated image offering is the priority.

Checkmarx Container Security is a paid, web-based alternative.

Alibaba Cloud Container Registry offers free and paid editions for readers considering a web-based registry with container repository and build limits.

Sysdig Secure is a paid alternative with licensing based on the number of hosts in a customer’s environment, or compute instances for CSPM.

For broader comparisons, browse Container Image Scanning Tools, Cloud Vulnerability Scanners, Container Security Software and Software Composition Analysis Software.

Verdict

Grype is a strong choice for developers and security teams seeking a free, self-hosted scanner that can examine containers, filesystems, SBOMs and individual packages, then help prioritize and export its findings. Its main limitation is the latest-release-only security update policy, so teams that need longer release support or assured assistance should consider another option.