Syft
Apache-2.0 SBOM CLI for images and filesystems (pairs with Grype)
DevOps / Infrastructure · Apache-2.0 · 9.7k
Reviewed 2026-09-12 · last push 2026-10-16 · repo checked 2026-10-19
What's Good
Apache-2.0. anchore/syft. CLI + Go library that builds Software Bills of Materials from container images, filesystems, and archives (SPDX/CycloneDX and friends). Designed to feed scanners like Grype. Active Anchore releases. Source github.com/anchore/syft.
The Catch
Vs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.
Verdict
Apache-2.0 SBOM CLI. Free forever; generate the bill, then let Grype/Trivy argue about CVEs.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/syft)
HTML
<a href="https://stackgems.com/gems/syft"><img src="https://stackgems.com/badge/syft.svg" alt="Syft reviewed on Stack Gems" height="20"></a>
Related
DevOps →- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
- CosignApache-2.0 Sigstore keyless container/artifact signing CLI
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik