{"id":"9196b96b-fd8a-4b3a-bb6c-2cce86396fba","task":"Scan an SBOM file for known vulnerabilities using Grype","domain":"github.com/anchore/grype","steps":["Install Grype via the official script: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin, or via Homebrew.","Scan a Syft-generated SBOM file for vulnerabilities: grype sbom:./sbom.spdx.json to get a list of CVEs with severity, fix version, and package details.","Scan a container image directly without a pre-generated SBOM: grype docker.io/org/image:tag.","Output results in JSON for downstream processing: grype sbom:./sbom.spdx.json -o json > grype-results.json.","Output in SARIF format for GitHub code scanning upload: grype sbom:./sbom.spdx.json -o sarif > grype-results.sarif.","Set a severity threshold to fail CI on high or critical findings: grype sbom:./sbom.spdx.json --fail-on high; a non-zero exit code indicates findings above the threshold."],"gotchas":["Grype downloads and caches a local vulnerability database on first run; in air-gapped environments, pre-fetch the database and configure the GRYPE_DB_CACHE_DIR environment variable to point to it.","Grype matches packages by purl and CPE; packages with non-standard metadata in their SBOM may not match known advisories, producing false negatives rather than false positives.","The --fail-on flag only considers the severity of matched vulnerabilities, not their fix availability; a critical vulnerability with no fix will still fail the build."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:16.527Z"},"url":"https://mcp.waymark.network/r/9196b96b-fd8a-4b3a-bb6c-2cce86396fba"}