Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs SafeDep vet
SafeDep vet
6.6#17 in software composition analysis softwareFrom $100 a monthFree planLinuxmacOSSelf-hosted
VisitWhat both publish
| Fact | Grype | SafeDep vet |
|---|---|---|
| License | The project is released under the Apache-2.0 License. | The GitHub repository identifies vet as licensed under Apache-2.0. |
| Output formats | Configuration supports table, template, JSON and CycloneDX vulnerability-report outputs. | The CLI can write SARIF from a saved scan, and the project describes SARIF for GitHub code scanning. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | vet finds malicious packages, known vulnerabilities, risky CI workflows, lockfile tampering and fresh dependency versions before they reach production. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
SafeDep vet plans
- FreeFree
- Team$100 a month
- EnterprisePriced on request
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick SafeDep vet if…
You want what its maker publishes above — check its page for the details.