Syft

Open source

Open-source CLI for generating SBOMs from container images and filesystems.

Pricing: free
Free tier: true
License: open-source
Open source: Yes

Editorial review

Syft has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): SBOM, container security, CycloneDX, SPDX, supply chain, CLIVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hostedVerification pending

Pricing · Licensing

Free plan(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerification pending
Source repository(HTTPS URL): https://github.com/anchore/syftVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): SBOM generation for container images, filesystems and archives, Support for dozens of packaging ecosystems (apk, dpkg, RPM, Go, Python, Java, JavaScript and more), OCI, Docker and Singularity image format support, Multiple output formats (CycloneDX, SPDX, Syft JSON) with conversion between formats, Signed SBOM attestations using the in-toto specification, Works seamlessly with Grype for vulnerability scanningVerification pending

Api · Integrations · Ecosystem

CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Developers generating SBOMs for container images and filesystems in SPDX or CycloneDX formats from the CLI or CI.Verification pending
Primary use cases(build;monitor;automate): Container image SBOM generation, Filesystem and package inventory, SBOM format conversion, Feeding vulnerability scanning with GrypeVerification pending
Skill level(beginner;intermediate;advanced;specialist): advancedVerified

Lifecycle · Versioning

Current version(1.12.3): 1.55.0Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerification pending

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): communityVerified

User reviews

Review policy

No published reviews yet.