{
  "id": "grype",
  "name": "Grype",
  "homepage": "https://github.com/anchore/grype",
  "description": "A vulnerability scanner for container images and filesystems.",
  "executables": [
    "grype"
  ],
  "dotfiles": {
    "paths": [
      "~/.grype.yaml",
      "~/.config/grype/config.yaml"
    ],
    "secret": [],
    "side_effect": false
  },
  "commands": {
    "format": 1,
    "label": "Scan for vulnerabilities",
    "description": "Scan a container image, directory or SBOM with Grype. Only the flags quoted in Grype's own source are offered; ignore rules, DB and VEX options are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "source": [
      {
        "id": "src",
        "kind": "help",
        "url": "https://github.com/anchore/grype/blob/main/cmd/grype/cli/options/grype.go",
        "revision": "main 2026-10-27",
        "evidence": "Use:   fmt.Sprintf(\"%s [IMAGE]\", app.ID().Name),\nShort: \"A vulnerability scanner for container images, filesystems, and SBOMs\",\nOutputs []string // -o, <presenter>=<file> the Presenter hint string to use for report formatting and the output file\nFile string // --file, the file to write report output to\nDistro string // --distro, specify a distro to explicitly use\nPlatform string // --platform, override the target platform for a container image\nByCVE bool // --by-cve, indicates if the original match vulnerability IDs should be preserved or the CVE should be used instead\nbad --fail-on severity value\nsame as --name; set the name of the target being analyzed\nsame as --exclude\nthe output format of the vulnerability report (options: table, template, json, cyclonedx)\nupon scanning, if a severity is found at or above the given severity then the return code will be 1\ndefault is unset which will skip this validation (options: negligible, low, medium, high, critical)\ngrype --from containers-storage localhost/myimage:latest\n"
      }
    ],
    "field": [
      {
        "id": "target",
        "label": "Image, directory or SBOM",
        "description": "For example alpine:latest, ./my-project or sbom:./sbom.json. Leave empty to read an SBOM from standard input.",
        "type": "string",
        "position": 0,
        "sources": [
          "src"
        ]
      },
      {
        "id": "output",
        "label": "Output format",
        "type": "string",
        "option": [
          "-o"
        ],
        "suggestions": [
          {
            "value": "table",
            "label": "Table"
          },
          {
            "value": "json",
            "label": "JSON"
          },
          {
            "value": "cyclonedx",
            "label": "CycloneDX"
          },
          {
            "value": "template",
            "label": "Go template"
          }
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "file",
        "label": "Write report to file",
        "type": "path",
        "option": [
          "--file"
        ],
        "path": {
          "kind": "file",
          "role": "output",
          "must_exist": false
        },
        "effect": "overwrite",
        "sources": [
          "src"
        ]
      },
      {
        "id": "fail_on",
        "label": "Fail on severity",
        "description": "Exit non-zero when a vulnerability at or above this severity is found.",
        "type": "enum",
        "option": [
          "--fail-on"
        ],
        "choices": [
          {
            "value": "negligible",
            "label": "Negligible"
          },
          {
            "value": "low",
            "label": "Low"
          },
          {
            "value": "medium",
            "label": "Medium"
          },
          {
            "value": "high",
            "label": "High"
          },
          {
            "value": "critical",
            "label": "Critical"
          }
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "from",
        "label": "Source type",
        "description": "Force how the target is read, for example docker, registry, podman or containers-storage.",
        "type": "string",
        "option": [
          "--from"
        ],
        "suggestions": [
          {
            "value": "docker",
            "label": "Docker"
          },
          {
            "value": "registry",
            "label": "Registry"
          },
          {
            "value": "podman",
            "label": "Podman"
          },
          {
            "value": "containers-storage",
            "label": "containers-storage"
          }
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "platform",
        "label": "Platform",
        "description": "For example linux/arm64.",
        "type": "string",
        "option": [
          "--platform"
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "distro",
        "label": "Distro to match",
        "type": "string",
        "option": [
          "--distro"
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "exclude",
        "label": "Exclude paths (glob)",
        "type": "string",
        "option": [
          "--exclude"
        ],
        "multiple": true,
        "sources": [
          "src"
        ]
      },
      {
        "id": "by_cve",
        "label": "Orient results by CVE",
        "type": "boolean",
        "option": [
          "--by-cve"
        ],
        "sources": [
          "src"
        ]
      },
      {
        "id": "name",
        "label": "Target name",
        "type": "string",
        "option": [
          "--name"
        ],
        "sources": [
          "src"
        ]
      }
    ],
    "task": [
      {
        "id": "scan",
        "label": "Scan a target",
        "fields": [
          "target",
          "output",
          "fail_on"
        ],
        "required": [
          "target"
        ]
      },
      {
        "id": "ci-gate",
        "label": "Fail the build on high severity",
        "set": {
          "fail_on": [
            "high"
          ]
        },
        "fields": [
          "target",
          "fail_on",
          "output",
          "file"
        ],
        "required": [
          "target"
        ]
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "target",
          "output",
          "file",
          "fail_on"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "from",
          "platform",
          "distro",
          "exclude",
          "by_cve",
          "name"
        ]
      }
    ]
  }
}