cargo-audit
5.9#41 in software composition analysis softwareFree planFree planLinuxmacOS
Visitcargo-audit vs Grype
Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitWhat both publish
| Fact | cargo-audit | Grype |
|---|---|---|
| Installation | Install it as a Cargo subcommand with `cargo install cargo-audit`. | Official binaries and source archives are provided for Linux, macOS and Windows, with installer-script, Docker and package-manager options. |
| License | The cargo-audit crates are licensed under either Apache License 2.0 or MIT, at the user's option. | The project is released under the Apache-2.0 License. |
| Purpose | Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database. | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. |
cargo-audit plans
- cargo-auditFree
Grype plans
- GrypeFree
- Grype open-source scannerFree
Pick cargo-audit if…
You want what its maker publishes above — check its page for the details.
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.