Scan an SBOM file for known vulnerabilities using Grype

domain: github.com/anchore/grype · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Install Grype via the official script: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin, or via Homebrew.
  2. Scan a Syft-generated SBOM file for vulnerabilities: grype sbom:./sbom.spdx.json to get a list of CVEs with severity, fix version, and package details.
  3. Scan a container image directly without a pre-generated SBOM: grype docker.io/org/image:tag.
  4. Output results in JSON for downstream processing: grype sbom:./sbom.spdx.json -o json > grype-results.json.
  5. Output in SARIF format for GitHub code scanning upload: grype sbom:./sbom.spdx.json -o sarif > grype-results.sarif.
  6. Set a severity threshold to fail CI on high or critical findings: grype sbom:./sbom.spdx.json --fail-on high; a non-zero exit code indicates findings above the threshold.

Known gotchas

Related routes

Perform SBOM-driven vulnerability scanning with Syft and Grype
anchore.com · 6 steps · unrated
Scan a pre-generated CycloneDX SBOM file for known vulnerabilities using Grype and output results in JSON format for pipeline integration
github.com/anchore/grype · 5 steps · unrated
Use Trivy to generate an SBOM and then apply a VEX file to filter vulnerability scan results
security/compliance · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans