Discover / Security

Syft

Name: Syft
Author: anchore

by anchoreGo

CLI tool and library for generating software bill of materials from container images.

Toolstable

Maturity: stable because 6y old, v1.50.0 released 6d ago. Derived from release and commit history, not a rating.

Stars: 9.3k
Forks: 916
Downloads / mo: —
Last commit: 2026-07-31
License: Apache-2.0
Open issues: 604

Market and trust evidence

Edition not yet matched

No exact skills.sh identity match is available for this repository. Repository adoption and freshness remain visible above; install momentum is not inferred.

Trust analysis is a screening signal, not a security warranty. Read the ranking and trust methodology.

In practice

Written by AI from this repository’s README · high confidence

A team cannot say exactly which packages are inside a built image or directory, so vulnerability and license review stalls.

Use it when

Use it when you need an SBOM in CycloneDX, SPDX or Syft JSON for an image or project, especially before scanning with Grype.

Not the right pick when

Not a vulnerability scanner itself, it produces the inventory and leaves detection to a scanner like Grype.

Capabilities

SBOM generation for container images, filesystems and archives
dozens of packaging ecosystems supported
OCI, Docker and Singularity image formats
CycloneDX, SPDX and Syft JSON output
conversion between SBOM formats
signed SBOM attestations using in-toto

Cost: Free and open source

Compare Repository ↗

Video walkthroughs

Syft and Grype demo- SBOM and container vulnerability scanning

OtherDevOpsGene · 2K views · ≈Aug 2023

Tool Review - Anchore Tools [ Part 1 ] | Syft

LearnSBOM · 1K views · ≈Aug 2023

Easy SBOM & Vuln Scanning with Syft & Grype (Getting Started Tutorial)

Anchore · 13K views · ≈Aug 2023

Third-party YouTube uploads matched to this tool by title, channel and repository name on 2026-08-03. Not made, reviewed or endorsed by SkillPilot. View counts and publish months are as of the match date and the month is approximate. Nothing loads from YouTube until you press play.

What the repository ships

Has testsHas examplesDocker imageSecurity policyCI configured

Detected from the actual files in the repository root.

Latest release v1.50.0

Published 2026-07-28

Added Features

Add bun binary classifier PR [#5103 @rezmoss]

Bug Fixes

Fix Cargo PURLs for local workspace packages PR [#5105 @3nesdeniz]
Decode golang symbols PR [#5089 @wagoodman]
CPE vendor field incorrectly includes publisher URL for SUSE RPM packages Issue [#5073] PR [#5081 @Eljees]
apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB Issue [#5094] PR [#5100 @cyphercodes]

Additional Changes

package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) Issue [#5101] PR [#5108 @Eljees]
consider vendored golang packages in module attribution PR [#5093 @kzantow]
Fix inverted bounds check dropping every Erlang string with a backslash PR [#5110 @arpitjain099]

Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

<summary>Updated (14 packages)</summary>

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
modernc.org/cc/v4 v4.28.4 → v4.29.0
modernc.org/ccgo/v4 v4.34.4 → v4.34.6
modernc.org/gc/v3 v3.1.3 → v3.1.4
modernc.org/libc v1.73.4 → v1.74.1
modernc.org/sqlite v1.53.0 → v1.54.0

</details>

(Full Changelog)

README

Syft

A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like Grype.

syft-demo

Features

Generates SBOMs for container images, filesystems, archives (see the docs for a full list of supported scan targets)
Supports dozens of packaging ecosystems (e.g. Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and many more)
Supports OCI, Docker, Singularity, and more image formats
Works seamlessly with Grype for vulnerability scanning
Multiple output formats (CycloneDX, SPDX, Syft JSON, and more) including the ability to convert between SBOM formats
Create signed SBOM attestations using the in-toto specification

[!TIP]

New to Syft? Check out the Getting Started guide for a walkthrough!

Installation

The quickest way to get up and going:


curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

[!TIP]

See Installation docs for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!

The basics

See the packages within a container image or directory:


# container image
syft alpine:latest

# directory
syft ./my-project

To get an SBOM, specify one or more output formats:


# SBOM to stdout
syft <image> -o cyclonedx-json

# Multiple SBOMs to files
syft <image> -o spdx-json=./spdx.json -o cyclonedx-json=./cdx.json

[!TIP]

Check out the Getting Started guide to explore all of the capabilities and features.

Want to know all of the ins-and-outs of Syft? Check out the CLI docs, configuration docs, and JSON schema.

Contributing

We encourage users to help make these tools better by submitting issues when you find a bug or want a new feature.

Check out our contributing overview and developer-specific documentation if you are interested in providing code contributions.

Syft development is sponsored by <a href="https://anchore.com/">Anchore</a>, and is released under the <a href="https://github.com/anchore/syft?tab=Apache-2.0-1-ov-file">Apache-2.0 License</a>.

The <a property="dct:title" rel="cc:attributionURL" href="https://anchore.com/wp-content/uploads/2024/11/syft-logo.svg">Syft logo</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://anchore.com/">Anchore</a> is licensed under <a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg" alt=""><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg" alt=""></a>

For commercial support options with Syft or Grype, please contact Anchore.

Come talk to us!

The Syft Team holds regular community meetings online. All are welcome to join to bring topics for discussion.

Check the calendar for the next meeting date.
Add items to the agenda (join this group for write access to the agenda)
See you there!

Syft

Market and trust evidence

In practice

Use it when

Not the right pick when

Capabilities

Video walkthroughs

Syft and Grype demo- SBOM and container vulnerability scanning

Tool Review - Anchore Tools [ Part 1 ] | Syft

Easy SBOM & Vuln Scanning with Syft & Grype (Getting Started Tutorial)

What the repository ships

Latest release v1.50.0

Added Features

Bug Fixes

Additional Changes

Dependencies

Tags

README

Syft

Features

Installation

The basics

Contributing

Come talk to us!

Related tools