> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/internal-scanners/grype.md).

# Grype integration

<figure><img src="/files/AYNHPfcJgu5OGkt6kJiM" alt="Grype" width="140"><figcaption></figcaption></figure>

Grype is the Anchore vulnerability scanner. It does not expose a hosted API to write findings into; instead, it reads a `.grype.yaml` policy file at scan time. The Seal CLI writes ignore entries to that file for the vulnerabilities Seal has sealed, and Grype suppresses them on the next scan.

The Grype integration is meaningful only in **Local** fix mode, where the Seal CLI already writes into the repository checkout (`.seal-actions.yml`). In **Remote** or **all** mode the CLI does not modify your repository, so there is no natural place to land the policy-file edit.

## Before you start

The Seal CLI step that drives the integration must have write access to the repository checkout in CI.

## Enabling policy-file generation

There are two ways to enable Grype policy-file generation:

* **Through the UI.** Under **Settings > Preferences**, enable the **Grype policy file update** toggle. With this on, every automatic PR that updates `.seal-actions.yml` also writes the matching `.grype.yaml` entries.
* **From the CLI.** Invoke the Seal CLI with the explicit flags:

```bash
seal scan --generate-actions-file --generate-grype-policy
```

The CLI generates or updates `.grype.yaml` at the project root with ignore entries for each vulnerability Seal sealed in this run.

The same `Settings > Preferences` pane carries the matching toggle for [Snyk policy-file updates](/integrations/internal-scanners/snyk.md#policy-file-edits-local-mode).

## Committing the file

`.grype.yaml` is part of your repository. Commit it like any other source-controlled config. Grype reads the version of the file present in the branch being scanned.

## Ecosystem coverage

The Grype integration maps Seal-sealed packages onto Grype's package-type identifiers. The mapping covers npm, pip, Go modules, Maven, and NuGet. Packages from ecosystems outside that set are not added to `.grype.yaml`; Grype's other coverage is unaffected, but Seal does not write entries for those packages.

## Verify

After a `seal fix` run with the integration configured, inspect the generated `.grype.yaml`. It should contain an `ignore:` block with one entry per vulnerability Seal sealed, identifying the vulnerability, the package, and the version. Re-running Grype against the checkout should no longer report those vulnerabilities.

## Related

* [How CLI-driven sync works](/integrations/internal-scanners/how-cli-sync-works.md)
* [Snyk integration](/integrations/internal-scanners/snyk.md): the other policy-file-edit path, sharing the same UI toggle pattern.
* [External scanner support](/integrations/external-scanners.md): for Grype scans that run outside your organization, where you cannot write a policy file into the scanned checkout.