Keelix vs Grype

Grype answers: “Does this image or filesystem contain packages with known CVEs — and how likely are they to be exploited?” It is exceptional at it. Scan a container image and Grype returns every matched CVE with a composite risk score that weighs CVSS severity against EPSS exploitation probability and CISA's KEV catalog. It keeps the vulnerability database in memory for fast repeat scans, supports SARIF and CycloneDX outputs, and is Apache-2.0. It belongs in your build pipeline.

Keelix answers: “Is this deployed box fit to ship — including the AI agents and MCP servers running on it?” It scans from outside the box in, checks what ports are actually reachable from the internet, audits host configuration against 93 CIS/SOC 2/ISO 27001 controls, and grades every AI agent and MCP server on the machine for auto-approval, plaintext secrets, and the lethal trifecta. The result is a single 0–100 score you can gate CI on.

Neither tool does the other's job. Grype cannot tell you whether your Claude Code config stores a plaintext Anthropic API key, or whether port 2375 is reachable from the open internet because Docker silently bypassed UFW. Keelix does not produce CVE-by-CVE reports with EPSS prioritisation. Together they cover the whole attack surface.

Grype has invested heavily in reducing false positives by prioritising ecosystem-specific vulnerability data from sources like the GitHub Advisory Database over the CPE-matching approach that plagued older scanners. Combined with EPSS integration, this means you can filter your CVE output to the vulnerabilities that are actively being exploited in the wild right now — a genuinely useful signal when you have 400 findings and need to decide what to fix in the next sprint.

Grype also produces clean SARIF and CycloneDX SBOM output, which integrates well into GitHub Advanced Security and other downstream compliance workflows. If your primary need is “show me every vulnerable package in this image and rank them by real-world exploitability,” Grype is the right tool.

The Grype README describes it as “a vulnerability scanner for container images and filesystems.” That focus is a strength — it produces quality CVE matching. But it means several classes of deployment risk are completely outside Grype's scope:

• Internet exposure:whether a port is actually reachable from the open internet because Docker's iptables rules punched through your firewall — not a CVE, but a critical deployment misconfiguration.
• Host configuration: whether the Docker daemon socket is exposed, whether unattended upgrades are enabled, whether SSH is hardened — checks Grype has no concept of.
• AI-agent and MCP posture: whether an MCP server running on the host auto-approves all tool calls, whether a .mcp.json file stores a plaintext API key, or whether a deployed agent simultaneously has access to private data, untrusted input, and an exfiltration channel — the lethal trifecta.

None of these are image-layer vulnerabilities. All of them are deployment-context risks that appear at runtime on the box — in config files provisioned after the image was built, in firewall state, in AI agent settings. That is exactly what Keelix scans.

A practical CI pipeline for a self-hosted Docker deployment: Grype scans the image in the build stage for CVEs, prioritises by EPSS risk score, and outputs a CycloneDX SBOM. Keelix runs in the deploy-to-staging stage, scans the live box for host config, internet exposure, and AI/MCP posture, and gates on a posture score below your threshold before promote-to-production.