Best SBOM generators for container images

Combined ranking

1. 1
   SyftGrade ↗Visit ↗—20 pts

   GPT #1Claude #1Gemini #1Grok #1

   Best all-around container specialist: fast local/offline scans, broad OS and language-package detection, Docker/Podman/containerd/registry support, layer controls, and mature SPDX and CycloneDX output.

   + model takes & fixes− hide details

   GPT Best all-around container specialist: fast local/offline scans, broad OS and language-package detection, Docker/Podman/containerd/registry support, layer controls, and mature SPDX and CycloneDX output.

   Claude The de facto open-source standard for container-image SBOMs — deep multi-ecosystem cataloging (OS packages across apk/dpkg/rpm plus language deps for Go, Java, npm, Python, Ruby, Rust, etc.), reads images directly from registries/tar/OCI layout without a running daemon, and emits both SPDX and CycloneDX cleanly; pairs natively with Grype for scanning. Broad adoption means format output is battle-tested against downstream consumers.

   Gemini Purpose-built for container images and filesystems with deep multi-layer inspection, high OS and language package cataloging accuracy, and native support for SPDX and CycloneDX formats.

   Grok Highest component and license detection rates in independent 2026 container-image CycloneDX shootouts; broadest reliable coverage of OS packages plus language ecosystems inside images; produces high-quality CycloneDX and SPDX with rich metadata; purpose-built dedicated generator that pairs cleanly with Grype; actively maintained and battle-tested for CI and compliance workflows

   Where it falls short

   per GPT It generates inventory only; vulnerability, policy, and VEX workflows require Grype or another tool.

   per Claude It catalogs what's present in layers, so it can miss vendored/statically-linked or renamed binaries and produces noisy results on unusual base images; it's a generator only — no policy, storage, or attestation lifecycle on its own.

   per Gemini Focuses strictly on inventory generation without integrated vulnerability scanning, requiring pairing with tools like Grype for risk assessment.

   per Grok No built-in vulnerability matching (requires a separate scanner) and moderately slower than pure all-in-one tools on large images

2. 2
   TrivyGrade ↗Visit ↗—16 pts

   GPT #2Claude #2Gemini #2Grok #2

   Near-tie with Syft for practitioners wanting one tool for SBOMs, vulnerabilities, licenses, secrets, and misconfigurations; simple CI integration and solid SPDX/CycloneDX support.

   + model takes & fixes− hide details

   GPT Near-tie with Syft for practitioners wanting one tool for SBOMs, vulnerabilities, licenses, secrets, and misconfigurations; simple CI integration and solid SPDX/CycloneDX support.

   Claude One binary that does SBOM generation (CycloneDX and SPDX) plus vuln/secret/misconfig scanning, so teams get an all-in-one supply-chain tool with excellent CI ergonomics and strong OS+language coverage; can generate an SBOM and scan an existing SBOM, fitting both build-time and audit workflows. Widely embedded in registries and platforms.

   Gemini Combines fast, accurate container image SBOM generation in CycloneDX and SPDX formats with built-in vulnerability scanning; near-tie with Syft for overall practitioner value due to single-tool convenience.

   Grok Extremely fast single-binary SBOM generation from container images with solid component coverage close behind Syft; excellent CI/CD integration and multi-format (CycloneDX/SPDX) output as a side-effect of its scanner; zero-config convenience for the typical practitioner already scanning images

   Where it falls short

   per GPT Its SBOMs contain Trivy-specific metadata needed for its most accurate downstream scanning, weakening cross-tool portability.

   per Claude SBOM fidelity is generally a notch below Syft's pure-cataloging depth for edge ecosystems, and the tool's breadth means SBOM is one feature among many rather than its sole focus.

   per Gemini Granular control over custom cataloging logic and advanced SBOM metadata tuning is less flexible than dedicated engines like Syft.

   per Grok Major March 2026 supply-chain compromise (malicious release + poisoned Actions) that enabled credential theft and downstream breaches permanently reduced trust for a security tool

3. 3
   cdxgenGrade ↗Visit ↗—9 pts

   GPT #3Claude —Gemini #3Grok #3

   Exceptionally rich CycloneDX-first output, strong multi-language dependency coverage, container/rootfs inputs, dependency relationships, evidence, validation, signing, audit, and SPDX 3 export.

   + model takes & fixes− hide details

   GPT Exceptionally rich CycloneDX-first output, strong multi-language dependency coverage, container/rootfs inputs, dependency relationships, evidence, validation, signing, audit, and SPDX 3 export.

   Gemini Excels at deep application-level dependency tree extraction and polyglot runtime inspection within container images, producing rich CycloneDX specifications with dependency graph context.

   Grok Native, high-fidelity CycloneDX generation with reachability evidence, multiple BOM types, and signing; strong container-image support alongside source analysis; OWASP-backed and effective for teams standardizing on the CycloneDX ecosystem

   Where it falls short

   per GPT Its sprawling runtime, helper, and configuration surface is heavier and less predictable than a focused single-binary image scanner.

   per Gemini Slower scan speeds on large container images and less mature SPDX output compared to container-native CLI generators.

   per Grok CycloneDX-only (no native SPDX) and can emit noisy low-value file-level components that dilute usefulness for vulnerability or license consumers

4. 4
   Docker ScoutGrade ↗Visit ↗—6 pts

   GPT #4Claude #3Gemini —Grok #5

   Deeply integrated into the Docker/BuildKit build path, so it can capture provenance and a more accurate SBOM at build time (including build-arg and multi-stage context) rather than reconstructing from finished layers; strong UX for developers already in Docker Desktop/Hub, with policy and remediation guidance layered on.

   + model takes & fixes− hide details

   Claude Deeply integrated into the Docker/BuildKit build path, so it can capture provenance and a more accurate SBOM at build time (including build-arg and multi-stage context) rather than reconstructing from finished layers; strong UX for developers already in Docker Desktop/Hub, with policy and remediation guidance layered on.

   GPT Excellent Docker-native experience with local, registry, archive, and OCI inputs; produces SPDX or CycloneDX and integrates cleanly with BuildKit attestations, vulnerability analysis, VEX, and policy.

   Grok Seamless native generation and continuous re-evaluation of SBOMs inside the Docker CLI/Desktop/Hub workflow; practical recommendations and policy evaluation on top of the inventory; low-friction for teams already living in the Docker ecosystem

   Where it falls short

   per GPT It is less compelling outside Docker-centric workflows, and hosted analysis has repository, image-size, timeout, and Linux-image constraints.

   per Claude Best value is tied to the Docker ecosystem and its commercial tiers for full features; less appealing if you build with non-Docker tooling (Podman, Bazel, Kaniko) or want a vendor-neutral standalone generator.

   per Grok SBOM quality and standards validity are secondary to its analysis features (independent tests have shown invalid CycloneDX in places) and richer capabilities push users toward Docker subscription lock-in

5. 5
   TTernGrade ↗—5 pts

   GPT —Claude #5Gemini #4Grok #4

   Delivers meticulous layer-by-layer OCI/Docker image inspection to map software provenance back to exact image layers for precise license and software compliance auditing.

   + model takes & fixes− hide details

   Gemini Delivers meticulous layer-by-layer OCI/Docker image inspection to map software provenance back to exact image layers for precise license and software compliance auditing.

   Grok Deepest container-native layer-by-layer analysis with superior license attribution and OS-package metadata (especially Debian/Ubuntu/RHEL derivatives); still actively maintained in 2026 and purpose-built for image and Dockerfile inspection

   Claude Purpose-built for container images with a distinctive layer-by-layer analysis that attributes packages to the Dockerfile instructions that introduced them, giving unusually good provenance and license insight for images built from Dockerfiles; emits SPDX and CycloneDX.

   Where it falls short

   per Claude Slower, heavier (often needs to run/inspect layers), narrower maintenance and ecosystem breadth than Syft/Trivy, and weaker on non-Dockerfile or scratch/distroless images — a specialist tool, not a general default.

   per Gemini Execution time is significantly slower on complex, multi-stage images, making it poorly suited for fast CI/CD build gates.

   per Grok Dramatically slower (often ~10×) than peers and narrower language-ecosystem coverage, making it impractical for high-frequency pipelines

6. 6
   Microsoft SBOM ToolGrade ↗Visit ↗—2 pts

   GPT —Claude #4Gemini —Grok —

   Produces well-formed SPDX with a focus on compliance-grade completeness and provenance, backed by Microsoft's internal supply-chain requirements; a credible choice for organizations that specifically need SPDX for regulatory/EO 14028-style attestation and want a stable, enterprise-maintained generator.

   + model takes & fixes− hide details

   Claude Produces well-formed SPDX with a focus on compliance-grade completeness and provenance, backed by Microsoft's internal supply-chain requirements; a credible choice for organizations that specifically need SPDX for regulatory/EO 14028-style attestation and want a stable, enterprise-maintained generator.

   Where it falls short

   per Claude Narrower ecosystem detection and SPDX-only orientation make it less versatile than Syft/Trivy for polyglot container images; more oriented to build/artifact manifests than deep live-image layer cataloging.

7. 7
   BbomGrade ↗▲11 pts

   GPT —Claude —Gemini #5Grok —

   Kubernetes SIG-maintained CLI optimized for generating SPDX SBOMs for container images, multi-architecture image indexes, and cloud-native release artifacts.

   + model takes & fixes− hide details

   Gemini Kubernetes SIG-maintained CLI optimized for generating SPDX SBOMs for container images, multi-architecture image indexes, and cloud-native release artifacts.

   Where it falls short

   per Gemini Rigidly centered on SPDX output with minimal support for alternative formats like CycloneDX or non-standard container layouts.

8. 8
   SScanCode.ioGrade ↗▼11 pts

   GPT #5Claude —Gemini —Grok —

   Deep file-, package-, license-, provenance-, and all-layer analysis with SPDX/CycloneDX export, review workflows, enrichment, and strong air-gapped compliance value.

   + model takes & fixes− hide details

   GPT Deep file-, package-, license-, provenance-, and all-layer analysis with SPDX/CycloneDX export, review workflows, enrichment, and strong air-gapped compliance value.

   Where it falls short

   per GPT Its multi-service deployment and substantial CPU/memory demands are excessive for routine per-build SBOM generation.

Rank history

Just missed the top 5

By model

Common questions

Tracked by ModelsAgree · rank 1 = 5 pts … rank 5 = 1 pt · re-polled on demand