Syft Review, Pricing & Features

Syft is a free, open-source tool from Anchore that generates SBOMs from container images and filesystems in CycloneDX, SPDX, and Syft JSON formats.

Category
Security
Pricing
Free
Verified
Not yet
Last updated
July 17, 2026
Free Plan

What is Syft?

Syft is an open-source CLI tool and Go library, sponsored by Anchore, that generates Software Bills of Materials from container images and filesystems. It supports dozens of package ecosystems, including Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET.

Syft outputs SBOMs in industry-standard formats such as CycloneDX and SPDX, as well as its own Syft JSON format, and can create signed SBOM attestations using the in-toto specification. It is released under the Apache-2.0 license and written in Go.

Who Syft is for

Syft is for developers and security teams who need to catalog software dependencies in containerized applications and projects, typically as a precursor to vulnerability scanning with a tool such as Grype.

Key Features

Pros & Cons

Pros

  • Free and open source under Apache-2.0
  • Wide package ecosystem coverage across OS and language-specific dependencies
  • Supports industry-standard SBOM formats, including CycloneDX and SPDX
  • Designed to pair directly with Grype for vulnerability scanning
  • Multiple install options, including Homebrew, Docker, Scoop, Chocolatey, and Nix

Cons

  • Command-line tool without a built-in graphical interface
  • Best used alongside a separate scanner such as Grype for vulnerability detection, adding a setup step
  • No official managed or hosted service documented

Pricing

Frequently Asked Questions

Is Syft free?

Yes, Syft is open source under Apache-2.0, sponsored by Anchore.

What formats does Syft output?

Syft can output SBOMs in CycloneDX, SPDX, and its own Syft JSON format.

Does Syft work with Grype?

Yes, Syft is designed to generate SBOMs that Grype can then scan for vulnerabilities.

Can Syft sign SBOMs?

Yes, Syft can create signed SBOM attestations using the in-toto specification.

What is Syft written in?

Syft is written in Go.

Comparisons

Related Tools