Syft
Syft, from Anchore, catalogs software packages inside container images, filesystems, archives, and language project directories, emitting SBOMs in SPDX, CycloneDX, and its own JSON format. It is open source under the Apache-2.0 license. It runs on Linux, macOS, and Windows.
Updated
- Pricing
- Open Source
- License
- Apache-2.0
- Platforms
- Linux, macOS, Windows
What Is Syft?
Syft, from Anchore, catalogs software packages inside container images, filesystems, archives, and language project directories, emitting SBOMs in SPDX, CycloneDX, and its own JSON format. Catalogers cover OS packages plus the major language ecosystems, and pairing Syft with Grype turns any SBOM into a vulnerability report. The official sbom-action runs it in GitHub workflows.
Use Cases
Generating SBOMs in CI so every build has a machine-readable inventory of its components.
Strengths and Limitations
Strengths
- +Catalogers for dozens of packaging ecosystems.
- +First-class SPDX and CycloneDX support.
- +Composes with Grype for scanning and other SBOM tooling.
Limitations
- -Inventories packages; it does not assess vulnerability or policy.
- -Dynamic or interpreted dependencies can evade static cataloging.
Defensive Use
Producing the component inventories that vulnerability, license, and compliance processes consume.
Syft Alternatives
3 tools| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Grype Vulnerability scanner for container images and filesystems that identifies CVEs in packages, dependencies, and operating system distributions. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| OSV-Scanner Google's open-source software composition analyzer that maps project dependencies to vulnerabilities via the OSV database and to license risks via deps.dev. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Trivy Security scanner for container images, file systems, Git repositories, and Kubernetes configurations to detect CVEs. | Apache-2.0 | Linux, macOS, Windows, FreeBSD | Free / Commercial |
Frequently Asked Questions
What is Syft?→
Syft, from Anchore, catalogs software packages inside container images, filesystems, archives, and language project directories, emitting SBOMs in SPDX, CycloneDX, and its own JSON format. Catalogers cover OS packages plus the major language ecosystems, and pairing Syft with Grype turns any SBOM into a vulnerability report. The official sbom-action runs it in GitHub workflows.
What is Syft used for?→
Generating SBOMs in CI so every build has a machine-readable inventory of its components.
What are the strengths of Syft?→
- +Catalogers for dozens of packaging ecosystems.
- +First-class SPDX and CycloneDX support.
- +Composes with Grype for scanning and other SBOM tooling.
What are the limitations of Syft?→
- +Inventories packages; it does not assess vulnerability or policy.
- +Dynamic or interpreted dependencies can evade static cataloging.
How is Syft used defensively?→
Producing the component inventories that vulnerability, license, and compliance processes consume.