Alternatives to Grype

Find known vulnerabilities in container images and filesystems. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Grype.

  • Trivy

    Scan software and infrastructure for known security issues.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Trivy scans containers and filesystems for known vulnerabilities like Grype, and also adds configuration checks for infrastructure, under the same Apache-2.0 license.

  • OSV-Scanner

    Check project dependencies against the OSV vulnerability database.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    OSV-Scanner checks project dependencies against the OSV vulnerability database across many ecosystems, focusing on dependency files rather than container images.

  • Dependency-Check

    OWASP scanner that finds known vulnerabilities in a project's dependencies.

    FreeOpen sourceWindowsmacOSLinuxCommand line

    Dependency-Check is an OWASP scanner that matches dependencies to CPE identifiers, integrates with Maven, Gradle and Jenkins, and needs an NVD API key and large initial download.

Also worth comparing

These listings name Grype as their own alternative, so the relationship runs both ways.

  • Clair

    A self-hosted service that statically analyses container images for known vulnerabilities.

    FreeOpen sourceSelf-hosted

    Grype finds known vulnerabilities in container images and filesystems and can scan SBOMs from the command line rather than running as a service.

  • Vuls

    Assess known vulnerabilities on Linux and FreeBSD systems.

    FreeOpen sourceLinuxCommand line

    Grype finds known vulnerabilities in container images and filesystems and can read SBOMs, focusing on packages rather than whole-system assessment of servers.

Similar software

Related functionality, not a direct replacement.