Use Grype, our CLI tool, to generate a list of known vulnerabilities from containers, source code project directories, and filesystems.
Scan OS and language-specific packages
Grype is a CLI tool that scans container images, local directories, and filesystems for known vulnerabilities. It supports major OS package ecosystems (including Alpine, Debian, Ubuntu, and RHEL) alongside language-specific dependencies (such as Java, JavaScript, Python, Go, and Rust). Grype runs entirely locally without requiring external services. You can execute a scan simply by pointing the CLI at a target, such as a container image (grype alpine:latest) or a project directory (grype ./my-project). Findings are output as a human-readable table or as a JSON report for further processing.
View prioritized results across vulnerability sources
Grype goes beyond basic severity scoring by incorporating risk-based signals to help teams focus on what matters most. In addition to CVSS, Grype’s risk-based prioritization engine incorporates EPSS (Exploit Prediction Scoring System) and data from CISA’s Known Exploited Vulnerabilities (KEV) catalog into its report generation, to highlight the vulnerabilities in your system that carry the highest risk. This helps reduce noise and prioritize remediation efforts based on real-world risk, not just severity. To further assist with triage, use the “explain” functionality of Grype to gain insight into why a specific vulnerability was flagged. It outputs identifiers and locations of the vulnerable software, references to relevant security advisories, and details about the match criteria that was used to surface the finding.
Automate scans in your CI/CD pipeline
Grype is built for automation, making it straightforward to embed vulnerability scanning into CI/CD workflows. You can integrate Grype into your CI/CD automated build processes using the CLI directly, or by using the Anchore Container Scan Action if you use GitHub Actions, to automatically scan code or container images on every commit. Pipelines can be configured to fail automatically based on specific severity thresholds, preventing insecure software from progressing.
Combine with Syft for separate SBOM generation
Syft and Grype are designed to work together for more efficient, ongoing vulnerability scanning. Syft first generates an SBOM, creating a complete inventory of all packages in containers, source code project directories, and filesystems. With an SBOM that represents a static set of software, Grype can then perform its entire security scanning pass without the need to re-analyze the original material, using only the SBOM as input. In addition to Syft’s native output, Grype natively supports scanning standard SBOM formats like SPDX and CycloneDX, providing flexibility when consuming vendor-supplied SBOMs.
Is Grype safe to use? 
