Google Artifact Analysis

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Google Artifact Analysis is ranked #7 of 27 in container image scanning tools on Inferse. It runs on API, Linux, macOS, Web. There is no free plan.

Compared on container image scanning tools

Free plan: Nocloud.google.com
Deployment model: saascloud.google.com

Facts

Purpose: Artifact Analysis provides software composition analysis and metadata storage and retrieval.docs.cloud.google.com · 3 Oct 2026
Container scanning: Automatic vulnerability scanning runs when a new image is pushed to Artifact Registry, and vulnerability information is updated as new vulnerabilities are discovered.docs.cloud.google.com · 3 Oct 2026
Package scanning: Package scanning identifies vulnerabilities, malicious software, secrets, dependencies, and licenses in open-source dependencies of language-based packages.docs.cloud.google.com · 3 Oct 2026
Metadata: Artifact Analysis stores and retrieves structured metadata that can record release activities such as integration tests or vulnerability scans.docs.cloud.google.com · 3 Oct 2026
Integrations: Artifact Analysis detection points are built into Google Cloud products including Artifact Registry and Google Kubernetes Engine.docs.cloud.google.com · 3 Oct 2026
Security Command Center: Security Command Center aggregates Artifact Registry scan findings so users can view image vulnerabilities across projects and export findings to BigQuery.docs.cloud.google.com · 3 Oct 2026
Deployment policies: Artifact Analysis metadata can be used with Binary Authorization to create policies that allow deployments only for compliant images from trusted registries.docs.cloud.google.com · 3 Oct 2026
Supported package types: Automatic package scanning supports Java, Python, and Node.js packages.docs.cloud.google.com · 3 Oct 2026
Supported interfaces: Users can access package vulnerabilities and metadata in the Google Cloud console, with gcloud CLI, or through the Artifact Analysis API, which supports gRPC and REST/JSON.docs.cloud.google.com · 3 Oct 2026
Scanning limit: Artifact Analysis scans packages with 100 or fewer files.docs.cloud.google.com · 3 Oct 2026
Monitoring limit: Scanned images and packages continue to receive metadata updates while pulled within the last 30 days; after that, results become stale.docs.cloud.google.com · 3 Oct 2026
Repository limitation: Vulnerability scanning is not supported in Artifact Registry virtual repositories.docs.cloud.google.com · 3 Oct 2026
Compliance: Google Cloud says it undergoes independent verification and achieves certifications, attestations, and audit reports to help demonstrate compliance.cloud.google.com · 3 Oct 2026