Devsecops Python Packages

safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

crowdstrike-falconpy

The CrowdStrike Falcon SDK for Python

ggshield

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

lib4sbom

Library to ingest and generate SBOMs

pygitguardian

Python API client library for the GitGuardian API

xonsh

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

distro2sbom

Generates SBOM files from system packaging information

trufflehog

Find, verify, and analyze leaked credentials

skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

lib4vex

Library to ingest and generate VEX documents

csaf-tool

CSAF generator and validator

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

mockssh

Mock an SSH server and define all commands it supports (Python, Twisted)

sbom2doc

Transform SBOM contents into a formatted document including markdown and PDF formats

ochrona

A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs

devsecops-engine-tools

Toolchain for the evaluation of different devsecops practices

skilltotal

Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.

thothctl

A command line interface tool designed for efficient management and automation within your internal developer platform.

sbomdiff

This tool compares two Software Bill of Materials (SBOMs) and reports the differences.

owasp-depscan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.