anchore/grype
Grype
Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security.
The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sources, allowing for consistent vulnerability matching and offline scanning capabilities.
The scanner supports automated security workflows by generating structured vulnerability reports in formats such as JSON and CycloneDX. These outputs facilitate integration with external security pipelines, visualization dashboards, and automated oversight systems for tracking and remediating risks across software infrastructure.
Features
- Container Security Scanners - Scans container images and filesystems to identify known vulnerabilities in installed packages and software dependencies.
- Container Security - Identifies known vulnerabilities in container images to prevent security risks from reaching production environments.
- Software Composition Analysis Tools - Analyzes project manifests and container layers to detect security flaws in open-source libraries and application components.
- Vulnerability Scanning - Scans container images, filesystems, and manifests to identify known security flaws in installed packages and dependencies.
- Software Supply Chain Security - Analyzes project dependencies and software manifests to detect security flaws within the components used to build and deploy applications.
- Automated Security Scanners - Automates vulnerability detection within CI/CD pipelines to prevent insecure software from reaching production environments.
- Image Layer Analyzers - Parses and decomposes container image layers to reconstruct the final filesystem state for accurate vulnerability identification.
- Container Security - Vulnerability scanner for container images and filesystems.
- Infrastructure and Configuration - Vulnerability scanner for container images and filesystems.
- Infrastructure as Code Analysis - Vulnerability scanner for container images and filesystems.
- Application Security - Scans container images and filesystems for vulnerabilities.
- Container and Cluster Security - Vulnerability scanner for container images and filesystems.
- Image Scanning and SBOM - Vulnerability scanner for images and filesystems.
- Security and Compliance - Vulnerability scanner for container images.
- Pipeline Security - Facilitates automated security checks and oversight by exporting scan results for integration into continuous integration workflows.
- Static Analysis Signatures - Identifies installed software packages by matching filesystem contents against known vulnerability signatures and version constraints.
- Scan Result Exporters - Generates structured vulnerability reports in formats like JSON and CycloneDX for integration with external security pipelines.
- Security Reporting Tools - Exports security scan results into structured formats to facilitate integration with visualization dashboards and automated oversight systems.
- Security Vulnerability Reporting - Generates detailed reports on identified security flaws to help teams track, prioritize, and remediate risks across software infrastructure.
- Vulnerability Dependency Graphs - Provides a unified dependency graph representation to enable consistent vulnerability matching across diverse package formats.
- Synchronization Utilities - Maintains a local cache of security advisories synchronized from upstream sources to enable consistent offline vulnerability matching.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
