{"data":{"slug":"syft","name":"Syft","tagline":"Apache-2.0 SBOM CLI for images and filesystems (pairs with Grype)","category":"devops","categoryName":"DevOps","url":"https://github.com/anchore/syft","github":"https://github.com/anchore/syft","pricing":"open-source","hook":"Syft is the SBOM generator when Grype/Trivy need a bill of materials and “what is in this image?” is the question.","whatsGood":"Apache-2.0. anchore/syft. CLI + Go library that builds Software Bills of Materials from container images, filesystems, and archives (SPDX/CycloneDX and friends). Designed to feed scanners like Grype. Active Anchore releases. Source github.com/anchore/syft.","theCatch":"Vs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.","verdict":"Apache-2.0 SBOM CLI. Free forever; generate the bill, then let Grype/Trivy argue about CVEs.","addedAt":"2026-09-12","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Security","tags":["cli","self-host","permissive","security","active"],"capabilities":["cli"],"surfaces":["CLI","Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":9697,"starsPerWeek":29,"access":"free","archived":false,"repo":{"createdAt":"2020-05-07","pushedAt":"2026-10-16","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"github-actions","name":"GitHub Actions","tagline":"CI/CD that lives where your code does"},{"slug":"docker","name":"Docker","tagline":"Container runtime that changed deployment"},{"slug":"kubernetes","name":"Kubernetes","tagline":"Container orchestration at scale"},{"slug":"pulumi","name":"Pulumi","tagline":"Infrastructure as code in real languages"},{"slug":"fly-io","name":"Fly.io","tagline":"Deploy apps to VMs close to your users"}],"links":{"self":"/api/gems/syft","html":"/gems/syft","markdown":"/gems/syft.md","category":"/api/gems?category=devops","categoryPage":"/stacks/devops"}}