Anchore Grype Integration Guide

Integrate Grype with Vulnetix. Scan container images, directories, and SBOMs for known vulnerabilities.

Install & scan

$ go install github.com/anchore/grype/cmd/grype@latest
$ grype dir:. -o sarif --file grype.sarif

Run Anchore Grype in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Grype
  run: |
    curl -sSfL https://get.anchore.io/grype | sh -s -- -b /usr/local/bin
- name: Run Grype
  run: grype dir:. -o sarif --file grype.sarif --fail-on high
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: grype
    path: grype.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Anchore Grype's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Anchore Grype. Keep running it. Vulnetix sits on top of Anchore Grype (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Anchore Grype is strongest at its core category and also carries features in Container & Image Scanning, SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Anchore Grype does well

• Fast, free (Apache-2.0) vulnerability matching across container images, filesystems and SBOMs, with wide OS-distro coverage (Alpine, Debian, Ubuntu, RHEL, Amazon, Oracle) plus language ecosystems
• Pairs cleanly with Syft: scans a pre-built SBOM (CycloneDX/SPDX/Syft JSON) so you catalogue once and scan repeatedly without re-analysis
• Built-in risk prioritisation combining CVSS impact, EPSS probability and CISA KEV status into a single 0-10 score, with KEV overriding to max threat
• OpenVEX support to filter/augment findings, and simple CI-friendly single-binary distribution

Where Vulnetix adds to it: Grype is an excellent open-source matching engine that Vulnetix can sit alongside: Vulnetix ingests Grype's SBOM-driven CVE findings and unifies them with SAST, IaC, secrets, cloud and other scanners into one deduplicated, prioritised queue. Beyond Grype's per-scan EPSS/KEV/risk score, Vulnetix adds cross-scanner dedup, Coalition ESS/CWSS/LEV scoring, reachability (tree-sitter + CVEAffected), immutable versioned VEX with audit trail, EOL and SSVC policy, and Safe Harbour autofix, turning a single-shot CLI result into a governed, remediated program.

No migration, no rip-and-replace. Anchore Grype keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Anchore Grype results in Vulnetix

Upload Anchore Grype SARIF, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Anchore Grype documentation ↗  ·  Source repository ↗

Wire Anchore Grype into your CI/CD pipeline →