Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs Sandworm Audit
Sandworm Audit
5.7#49 in software composition analysis softwareFree planFree planLinux
VisitWhat both publish
| Fact | Grype | Sandworm Audit |
|---|---|---|
| Intended users | The project documentation describes individual package scanning as useful for lightweight vulnerability checks and compliance scanning of specific dependencies. | The homepage describes it for auditing JavaScript and PHP dependencies, with CLI use in terminal, CI, and Git hook workflows. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Sandworm Audit scans a project and its dependencies for vulnerabilities, license issues, and metadata issues. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
Sandworm Audit plans
- Sandworm AuditFree
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick Sandworm Audit if…
You want what its maker publishes above — check its page for the details.