Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs pip-audit
What both publish
| Fact | Grype | pip-audit |
|---|---|---|
| Installation | Official binaries and source archives are provided for Linux, macOS and Windows, with installer-script, Docker and package-manager options. | The project says pip-audit requires Python 3.10 or newer and can be installed with pip; it also lists conda-forge as an installation option. |
| Integrations | The installation documentation provides a Docker image and lists community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft. | The project provides an official GitHub Action and supports pre-commit. |
| License | The project is released under the Apache-2.0 License. | pip-audit is licensed under Apache 2.0. |
| Output formats | Configuration supports table, template, JSON and CycloneDX vulnerability-report outputs. | Audit results can be emitted as columns, Markdown, JSON, CycloneDX JSON, or CycloneDX XML. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Audits Python environments, requirements files, and dependency trees for known security vulnerabilities. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
pip-audit plans
- pip-auditFree
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick pip-audit if…
You want what its maker publishes above — check its page for the details.