Syft
Claim this toolGenerate Software Bill of Materials (SBOMs) from container images and filesystems.
Free, no paid tier Visit Website Free Visit Website
Tracked since 2026
The Bottom Line
- Price
- Free, no paid tier. Compare plans
Key facts
- Generates Software Bill of Materials (SBOMs) from various software artifacts.
- Supports a wide range of packaging ecosystems and container image formats.
- Integrates seamlessly with vulnerability scanners like Grype for enhanced security.
Pros
- Comprehensive SBOM generation for diverse software components
- Broad support for packaging ecosystems and image formats
- Seamless integration with vulnerability scanning tools like Grype
- Multiple output formats and SBOM conversion capabilities
- Enhances software supply chain security with signed attestations
Cons
- Primarily a CLI tool, which might require command-line familiarity
- Requires integration with other tools (like Grype) for full vulnerability detection
What is Syft?
Syft is a powerful CLI tool and Go library designed for generating Software Bill of Materials (SBOMs) from various sources, including container images, filesystems, and archives. It helps developers and security teams gain transparency into the components of their software, which is crucial for identifying potential vulnerabilities and ensuring compliance.
This tool supports a wide array of packaging ecosystems, such as Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET, among many others. It also works with popular image formats like OCI, Docker, and Singularity. Syft is particularly valuable when integrated with vulnerability scanners like Grype, enabling comprehensive security analysis of software artifacts.
Syft is ideal for developers, DevOps engineers, security professionals, and anyone involved in software supply chain security. It provides multiple output formats, including CycloneDX, SPDX, and Syft JSON, and can even convert between SBOM formats. Its ability to create signed SBOM attestations using the in-toto specification further enhances trust and integrity in the software supply chain.
Available on: Windows, macOS, Linux
Data compiled by Toolradar Pricing checked · How we evaluate
Source github.com Preview
Key Features
- Generates SBOMs for container images, filesystems, and archives
- Supports dozens of packaging ecosystems (e.g., Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET)
- Supports OCI, Docker, and Singularity image formats
- Works seamlessly with Grype for vulnerability scanning
- Provides multiple output formats (CycloneDX, SPDX, Syft JSON, and more)
- Ability to convert between SBOM formats
- Creates signed SBOM attestations using the in-toto specification
Pricing Plans
Pricing checked Oct 17, 2026. Source: github.com/anchore/syft, read Oct 17, 2026
| Plan | Price | Details |
|---|---|---|
| Open Source | Free |
+1 more Show less
|
Is Syft worth the price?
Great value
Syft's pricing is exceptionally generous, offering a fully-featured open-source solution for free.
This makes it an outstanding value compared to proprietary SBOM generation tools. It's best for individual developers, small teams, and organizations prioritizing cost-efficiency and open-source principles.
Reviews
$99 Free with your review
Write a review Review Syft, get a free AI guide
Share your experience and we will send you Improve Your Thinking Patterns Using ChatGPT, free.
Best Syft Alternatives
Top alternatives based on features, pricing, and user needs.
Still deciding?
Most buyers shortlist 2 or 3 tools before committing. Pull a side-by-side comparison or browse the full alternatives shortlist below.
Explore More
Syft FAQ
What types of scan targets does Syft support for generating SBOMs?
Syft can generate Software Bill of Materials (SBOMs) for various scan targets, including container images, filesystems, and archives. The documentation provides a comprehensive list of all supported targets.
Which packaging ecosystems are supported by Syft for dependency analysis?
Syft supports a wide range of packaging ecosystems, such as Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET. This broad support allows for detailed dependency analysis across diverse projects.
How does Syft integrate with Grype for vulnerability detection?
Syft works seamlessly with Grype, a vulnerability scanner, to enhance security analysis. After generating an SBOM with Syft, the output can be fed into Grype for effective vulnerability detection.
What output formats are available for the SBOMs generated by Syft?
Syft supports multiple output formats for SBOMs, including CycloneDX, SPDX, and its own Syft JSON format. It also offers the capability to convert between different SBOM formats.
Can Syft create signed SBOM attestations?
Yes, Syft can create signed SBOM attestations. This functionality is achieved by utilizing the in-toto specification, providing a verifiable record of the SBOM's integrity.
What image formats can Syft process when generating SBOMs from container images?
Syft is compatible with several popular image formats, including OCI, Docker, and Singularity. This ensures broad applicability when analyzing containerized applications.
Source: github.com