Grype
Apache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
DevOps / Security · Apache-2.0 · 13.1k
Reviewed 2026-09-04 · last push 2026-10-19 · repo checked 2026-10-21
What's Good
Apache-2.0. Scan images, dirs, or SBOMs; pairs with Syft (generate once, rescan often). Offline DB after download. Transparent matching logic. No feature gate on the CLI.
The Catch
Vuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.
Verdict
Apache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/grype)
HTML
<a href="https://stackgems.com/gems/grype"><img src="https://stackgems.com/badge/grype.svg" alt="Grype reviewed on Stack Gems" height="20"></a>
Related
DevOps →- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
- CosignApache-2.0 Sigstore keyless container/artifact signing CLI
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik
- direnvMIT per-directory env loader for any shell