Attestd vs Grype

Grype and Attestd solve adjacent problems with different architectures. Grype scans an artifact you already have. Attestd answers a question about an identifier. If you need to scan an image, Grype is the right shape. If you need a yes/no about a package for something to act on, it is not.

Grype requires the artifact. Attestd requires only the name and version.

Grype runs entirely locally: point it at a container image, a directory, or a Syft-generated SBOM, and it matches every package it finds against its vulnerability database. No hosted service, no account, and after the first database download, no network access required. That is a genuine advantage for air-gapped environments and for scanning artifacts you control.

That local-artifact requirement is also the limitation for a different use case. An agent deciding whether to install a dependency it has not pulled yet, or a provisioning script checking a version string read from a config file, has no image or filesystem to hand Grype. It has a name and a version. Attestd's /v1/check takes exactly that: product and version, no artifact, and returns risk_state, actively_exploited, and supply_chain.compromised in one response.

Grype is vulnerability-matching only: known CVEs against known package versions, enriched with EPSS and KEV data for prioritization. It has no equivalent to supply_chain.compromised for confirmed malicious publishes. A compromised package with no CVE returns clean from a CVE-only match.

{
  "matches": [{
    "vulnerability": { "id": "CVE-2024-XXXXX", "severity": "High" },
    "artifact": { "name": "example-package", "version": "1.2.3" }
  }]
}

{
  "risk_state": "high",
  "actively_exploited": false,
  "patch_available": true,
  "fixed_version": "2.1.0",
  "supply_chain": {
    "compromised": false
  }
}

This is not theoretical

Grype matches CPE and PURL strings against CVE databases. It has no supply chain layer. Four incidents in Attestd's public detection ledger had no CVE at the time of compromise. A CVE-only match would have returned clean for every one of them.

• →90+ @mastra packages compromised with no CVEs
• →Two @joyfill packages delivering a RAT with no postinstall hook
• →debug and chalk, an estimated 10% of cloud environments exposed within two hours
• →ViteVenom: six packages using blockchain C2 built to survive takedown

All four return supply_chain.compromised: true from Attestd. None had a CVE or OSV entry at the time of compromise.

What you get from each

Pricing

Grype is free with no tiers. Attestd's free tier is 1,000 calls per month. Solo is $19.99 per month for 10,000 calls. Grype and Attestd are not substitutes at the pricing level. They answer different questions at different points in a pipeline.

When Grype is the right choice

Grype is right when you have an artifact (a container image built in CI, a filesystem, an SBOM) and need every known vulnerability in it enumerated for a build gate, especially in an air-gapped environment with no outbound network access.

When attestd is the right choice

• →You have a package name and version, not a built artifact, and need an answer before you build or install anything
• →You need supply chain compromise detection, which vulnerability matching alone does not cover
• →You are building an agent or automation that checks dependencies one at a time, not a CI job scanning a finished image

Try it in 30 seconds

Get a free API key at the developer portal, then connect Attestd to your coding assistant via the setup docs.

curl "https://api.attestd.io/v1/check?product=nginx&version=1.20.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"