# Syft

> Apache-2.0 SBOM CLI for images and filesystems (pairs with Grype)

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://github.com/anchore/syft  
**GitHub:** https://github.com/anchore/syft  
**Added:** 2026-09-12

---

## The Hook

Syft is the SBOM generator when Grype/Trivy need a bill of materials and “what is in this image?” is the question.

## What's Good

Apache-2.0. anchore/syft. CLI + Go library that builds Software Bills of Materials from container images, filesystems, and archives (SPDX/CycloneDX and friends). Designed to feed scanners like Grype. Active Anchore releases. Source github.com/anchore/syft.

## The Catch

Vs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.

## Verdict

Apache-2.0 SBOM CLI. Free forever; generate the bill, then let Grype/Trivy argue about CVEs.