Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs Insignary Clarity
Insignary Clarity
6.0#38 in software composition analysis software$200 one-timeWebSelf-hosted
VisitWhat both publish
| Fact | Grype | Insignary Clarity |
|---|---|---|
| Founded | 2016 | 2016 |
| Headquarters | Santa Barbara, California, United States | Toronto, Ontario, Canada |
| Intended users | The project documentation describes individual package scanning as useful for lightweight vulnerability checks and compliance scanning of specific dependencies. | Insignary describes Clarity as supporting development, security, and operations teams managing software supply-chain risk. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Insignary Clarity is a software composition analysis solution that identifies security and license risks in third-party software. |
| SBOM formats | Grype accepts Syft JSON, SPDX JSON/XML/tag-value and CycloneDX JSON/XML SBOMs. | Clarity can import SBOMs in custom formats and standardized formats including SPDX and CycloneDX. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
Insignary Clarity plans
- Clarity On-Demand — 100MB$200, paid once
- Clarity On-Demand — 500MB$950, paid once
- Clarity On-Demand — 1GB$1,800, paid once
- Clarity On-Demand — 2GB$3,400, paid once
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick Insignary Clarity if…
You want what its maker publishes above — check its page for the details.