Syft is Anchore’s open-source SBOM generation tool that catalogs all software components in container images and filesystems. With 8.4k GitHub stars and 219 contributors, it is one of the most widely used SCA tools for generating Software Bills of Materials in SPDX and CycloneDX formats. The demand for SBOM tooling grew sharply after Executive Order 14028 mandated SBOMs for federal software suppliers.
The current version is 1.42.0 (released February 10, 2026). Syft operates entirely offline with no cloud services or external API calls. Point it at a container image or directory, and it returns a complete SBOM in seconds.
What is Syft?
Syft scans container images, directory trees, and archive files to identify all software packages and their versions. It detects packages installed via system package managers (apk, dpkg, rpm) and language-specific dependency managers (npm, pip, Maven, Go modules, and more).
The tool generates SBOMs in SPDX and CycloneDX formats, the two industry-standard schemas. These machine-readable inventories list every component in your software, including direct dependencies, transitive dependencies, and operating system packages.
Key features
| Feature | Details |
|---|---|
| Current version | 1.42.0 (February 10, 2026) |
| GitHub stats | 8.4k stars, 219 contributors, 765 forks |
| License | Apache 2.0 |
| Output formats | SPDX JSON, CycloneDX JSON, Syft JSON, text, table |
| Image formats | OCI, Docker, Singularity |
| Installation | curl script, Homebrew, Docker, Scoop, Chocolatey, Nix |
| Attestations | Signed SBOM attestations via in-toto specification |
| Cloud dependencies | None; runs entirely offline |
| Grype integration | Pipe SBOMs directly to Grype for vulnerability scanning |
Container image analysis
Syft scans Docker images, OCI images, and Singularity containers by analyzing each layer. It extracts package manager databases, language dependency manifests (package.json, requirements.txt, pom.xml), and binary metadata.
Scan local images already pulled to your machine, or fetch images directly from remote registries like Docker Hub, ECR, GCR, and private registries. Syft handles authentication and downloads only the necessary layers to minimize bandwidth.
Package ecosystem support
Syft automatically identifies which package managers were used in a project by detecting manifest files. When it finds package.json, it parses npm dependencies. When it finds go.mod, it extracts Go module information. When it finds /var/lib/dpkg/status, it catalogs Debian packages.
This automatic detection means you do not need to configure Syft for specific projects. It adapts to whatever package ecosystems it encounters.
SPDX and CycloneDX output
Generate SBOMs in SPDX format for government compliance (NTIA, Executive Order 14028) or CycloneDX for security-focused workflows. Syft also supports human-readable table and text formats for quick inspection.
SBOM attestations
Syft can create signed SBOM attestations using the in-toto specification. This adds cryptographic proof that the SBOM was generated from a specific source, supporting supply chain verification workflows.
Grype integration
Pair Syft with Grype for complete software composition analysis. Syft generates the SBOM, Grype scans it for known vulnerabilities. This two-tool approach separates inventory generation from vulnerability detection, letting you cache SBOMs and scan them multiple times as new CVEs are disclosed.
# Generate SBOM and pipe to Grype for vulnerability scanning
syft alpine:latest -o cyclonedx-json | grype
Getting started
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin or brew install syft on macOS.syft alpine:latest to generate an SBOM for any container image. Use -o cyclonedx-json for CycloneDX or -o spdx-json for SPDX format.syft ./my-project to catalog all packages in a local directory tree.anchore/sbom-action GitHub Action to generate SBOMs for every build and upload them as workflow artifacts.When to use Syft
Syft is the right choice when you need SBOM generation without vulnerability scanning overhead. It does one thing well: cataloging software components across container images and filesystems.
Pair it with Grype for vulnerability scanning. This separation lets you generate SBOMs once, store them, and scan them repeatedly as new vulnerabilities are disclosed.
The tool runs entirely offline, making it suitable for air-gapped environments and CI/CD pipelines where external API calls are restricted.
Further reading: What is SBOM? | What is SCA? | Container Image Security
