This article follows the official documentation. We haven’t tested this tool for a hands-on review.
A coding agent with shell access to a repository can use Anchore Syft to list the software packages it detects in the project. Syft creates a Software Bill of Materials, or SBOM: a structured inventory of software components and their metadata. An agent can use that inventory to report detected dependencies before changing code or preparing a release.
Syft scans container images, filesystems, and archives. It then writes the inventory in formats such as SPDX, CycloneDX, or Syft JSON. Syft itself does not look for known vulnerabilities. The Syft README recommends a separate scanner such as Grype for that. The commands below scan a local directory and save an SBOM locally; they do not change a remote service.
Install Syft
The official installation docs start with an install script:
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
The script's -b option sets the install directory, and its -v option verifies the download's signature when cosign is installed. Read a script before you pipe it into sudo sh. The same page lists a Docker image and release downloads. It also lists community builds such as Homebrew. A local directory scan does not require an account or API key. To scan a private container image, you also need access to that image.
Syft checks for a newer version when it starts. The configuration reference documents the SYFT_CHECK_FOR_APP_UPDATE setting. Set it to false to turn that check off.
Scan a local repository
From the repository root, run:
syft dir:. -o spdx-json=/tmp/project.spdx.json
dir:. tells Syft to inspect the current directory as a directory scan target. The -o spdx-json=/tmp/project.spdx.json option selects SPDX JSON output and writes it to that file. The scan reads local files and saves the SBOM outside the repository.
An agent can then read the file and summarize the packages Syft detected. For example, ask it to identify package names and versions relevant to a planned dependency change, and to mark any missing or unclear information rather than guessing. Syft reports the packages it detects. The agent should not assume the report includes every dependency or component.
A suitable prompt is:
Run Syft against the current repository with
dir:.and save an SPDX JSON SBOM under/tmp. Summarize the detected package names and versions that relate to the dependency change I described. Do not edit repository files, and do not infer vulnerability status from the SBOM.
The command writes a local report, but it does not update dependencies, commit code, or submit changes to a service. For vulnerability results, use a vulnerability scanner such as Grype as a separate task.