A CLI tool and Go library for checking licenses in container images, SBOMs, and filesystems. Works seamlessly with Syft for license investigation and policy enforcement.

• Check licenses in container images, SBOMs, and filesystems
• Categorize licenses by risk level (permissive, weak copyleft, strong copyleft)
• Define and enforce license policies with allow/deny lists
• Works seamlessly with Syft SBOMs
• Multiple output formats (table, JSON) for CI/CD integration

The quickest way to get up and going:

curl -sSfL https://get.anchore.io/grant | sudo sh -s -- -b /usr/local/bin

List licenses within a container image or directory:

# container image
grant list redis:latest

# directory
grant list dir:.

# SBOM document
grant list sbom.spdx.json

Check licenses against a policy:

grant check redis:latest

We encourage users to help make these tools better by submitting issues when you find a bug or want a new feature. Check out our contributing overview and developer-specific documentation if you are interested in providing code contributions.

Grant development is sponsored by Anchore, and is released under the Apache-2.0 License.

For commercial support options, please contact Anchore.