Scan a source with Grype and prefer NVD vulnerability data
Runs the installed Grype executable against a source and selects an NVD CVE ID and CVSS score from Grype's report when available. No Apollo vulnerability data is fetched. Severity is derived from CVSS v3, then v2, then Grype's severity. Only a selected CVSS v3 score is retained in the report.
The source can be an image in the local Docker daemon, a registry image, an image archive, a directory, or another source supported by Grype. Grype must be installed and on PATH.
--output-file writes the normalized report as JSON regardless of the selected CLI output format.
Pass additional Grype flags after --. Grype's output flags (-o, --output, and --file) cannot be passed through because this command requires Grype JSON output. If Grype exits with a nonzero status after producing a valid JSON report (for example, with --fail-on), the report is printed and the command returns an error. A scan failure without a valid report returns an error without printing a report.
Examples: apollo-cli cve grype scan my-image apollo-cli cve grype scan oci-archive:./image.tar --output-file scan.json apollo-cli cve grype scan registry.com/team/image -- --only-fixed --scope all-layers
Copied!1apollo-cli cve grype scan <source> [flags] [-- <grype flags>]
| Flag | Use |
|---|---|
-h, --help | Help for scan |
--output-file | Write the full normalized Grype JSON report to this file |
| Flag | Use |
|---|---|
--apollo-client-id | Client ID to use for generating Bearer Token |
--apollo-client-secret | Client secret to use for generating Bearer Token |
--apollo-token | Bearer Token to use for authenticated endpoints |
--apollo-token-provider | Specifies how the Bearer Token used for authenticated Apollo endpoint calls is provided. Valid values are "auto", "static", "service-user", or "sso" (default "auto"). If "auto" is specified, the mode is picked from what is configured: "static" if "apollo-token" is set, "service-user" if "apollo-client-id" and "apollo-client-secret" are both set, otherwise "sso" (interactive browser login). Errors if both a bearer token AND (client id OR client secret) are set. If "static" is specified, the token provided by "apollo-token" is used. If "service-user" is specified, "apollo-client-id" and "apollo-client-secret" are used to generate a token from Multipass. If "sso" is specified, an interactive browser-based SSO login against Multipass is used (supports hardware keys like YubiKey); the resulting token is cached per profile and refreshed silently. The login flow is triggered automatically the first time a command needs a token and no valid cached token exists. |
--apollo-url | Base URL for Apollo that is used to derive the API endpoints |
--debug | Enable debug level logging |
-e, --environment | Environment ID (including suffix) to use for environment-scoped commands |
--http-timeout | Timeout in minutes for all apollo requests |
-k, --insecure-skip-verify | Skip verification of server certificate |
-o, --output | Output format (json,yaml,pretty) |
--profile | Use a specific profile from your configuration file |
--quiet | Do not print log output to stderr |
--space-id | Space ID to use for certain space-scoped commands |
--sso-callback-port | Local loopback port for the SSO OAuth callback; 0 selects an available ephemeral port |