Today we allow for the syft JSON document as an SBOM input. It would be ideal to additionally interop with tools that produce SPDX documents and allow that as input into grype for vulnerability scanning.