kube-score
Static code analysis for Kubernetes definitions with opinionated security and reliability checks.
A fast and lightweight vulnerability scanner for container images and filesystems.
Grype is a specialized vulnerability scanner developed by Anchore, designed to identify software vulnerabilities (CVEs) within container images and filesystems. Built in Go, its technical architecture focuses on speed and accuracy by leveraging a regularly updated internal database that aggregates data from multiple sources, including the NVD, GitHub Advisories, and various Linux distribution security feeds. In the 2026 market, Grype remains a cornerstone of the 'SBOM-first' security movement. It works seamlessly with Syft, its sister tool, to ingest Software Bill of Materials (SBOMs) and perform lookup-only scanning, which significantly reduces compute overhead in CI/CD pipelines. Its design philosophy emphasizes interoperability, supporting various output formats such as SARIF and JSON to integrate with modern security orchestration platforms. Unlike monolithic security suites, Grype is purpose-built for the developer's CLI and automated build environments, offering features like VEX (Vulnerability Exploitability eXchange) support to filter out non-exploitable vulnerabilities, thereby reducing developer fatigue. As organizations move toward mandatory software transparency, Grype serves as the primary engine for continuous compliance and supply chain security validation.
Ability to scan SBOM files (Syft, SPDX, CyclonDX) rather than just raw images, allowing for faster, more portable security checks.
Static code analysis for Kubernetes definitions with opinionated security and reliability checks.
Automated security auditing and remediation for high-integrity Kubernetes clusters.
Automated Kubernetes security compliance auditing against CIS Benchmarks.
The AI Software Engineer for automated code reviews and proactive quality assurance.
Verified feedback from the global deployment network.
Post queries, share implementation strategies, and help other users.
Supports VEX documents to programmatically ignore vulnerabilities that are determined to be non-exploitable in a specific context.
Uses specialized matchers for RHEL, Alpine, Debian, Ubuntu, and language-specific packages (npm, PyPI, Go).
Allows the vulnerability database to be bundled and moved to air-gapped environments.
Uses Go templates to allow users to define exactly how scan results are formatted.
Can scan a local directory or a mounted volume, not just container images.
Uses a versioned schema for its local SQLite DB to ensure compatibility between the binary and the data.
Preventing developers from introducing known vulnerabilities into the main branch.
Registry Updated:2/7/2026
Scanning systems that lack outbound internet access to vulnerability feeds.
Verifying the safety of public images from Docker Hub or Quay.io.