Use Syft, a CLI tool and Go library, to generate SBOMs for container images, source code projects, filesystems, and archives. Build efficient and exceptional vulnerability scanning pipelines by providing Syft generated SBOMs directly to vulnerability scanners like Grype.
Catalogs your software down to the file level
Syft deeply inspects anything you throw at it – container images, source code projects, local directories, archives and more – to build a comprehensive inventory of your software. By analyzing your software down to the file level, it catalogs every component to ensure complete visibility into the applications and libraries present in your environment.
Generates standardized SBOMs in your CI/CD pipeline
Integrate Syft directly into your build pipelines to ensure that every build produces a standardized SBOM without slowing down release cycles. This automated pipeline integration enables continuous compliance, seamless artifact signing, and simplified vulnerability tracking.
- Integrations: Deploy using the GitHub Action or use the Syft CLI for seamless integration into your CI platform of choice (Jenkins, Gitlab, and more).
- Supported Formats: Output standardized SBOMs in formats including SPDX, CycloneDX, or Syft JSON.
Discovers direct and transitive dependencies
Modern application source code projects declare a set of direct dependencies, but by the time they are prepared for deployment the final build contains a lot more transitive and supporting dependencies. Syft’s “if it’s there, we’ll tell you about it” approach to software analysis ensures that your SBOM will contain a comprehensive list of Java, Python, Go, NPM, and other software artifacts that have been discovered, and how they relate to each other and your application.
Used by Grype for vulnerability scanning
Syft and Grype are designed to work together for more efficient, ongoing vulnerability scanning. Syft first generates an SBOM, creating a complete inventory of all packages in containers, source code project directories, and filesystems.
With an SBOM that represents a static set of software, Grype can then perform its entire security scanning pass without the need to re-analyze the original material, using only the SBOM as input. This “scan once, reuse many times” approach not only speeds up scans in CI/CD pipelines but also enables continuous re-evaluation of risk as vulnerability data changes without the need to perform the expensive operation of re-scanning the original software material.
What is a Syft scan? 
