Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs Semgrep Supply Chain
Semgrep Supply Chain
7.0#10 in software composition analysis softwareFrom $30 a monthFree planWebAPILinuxmacOS
VisitWhat both publish
| Fact | Grype | Semgrep Supply Chain |
|---|---|---|
| Founded | 2016 | 2017 |
| Headquarters | Santa Barbara, California, United States | San Francisco, California, United States |
| Integrations | The installation documentation provides a Docker image and lists community installation options including Homebrew, MacPorts, Winget, Scoop, and Snapcraft. | Semgrep lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among its CI integrations, with Slack, email, webhooks, VS Code, and IntelliJ also listed. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
Semgrep Supply Chain plans
- Free EditionFree
- Teams — Supply Chain$30 a month
- EnterprisePriced on request
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick Semgrep Supply Chain if…
Semgrep Supply Chain suits development teams seeking dependency vulnerability and malware checks across supported ecosystems. Its free tier may fit smaller teams within the repository and contributor limits; larger limits require a paid or custom plan.