Vex Python Packages

cyclonedx-python-lib

Functionality and DataModels of OWASP CycloneDX for Python

lib4vex

Library to ingest and generate VEX documents

csaf-tool

CSAF generator and validator

owasp-depscan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

ds-analysis-lib

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

ds-xbom-lib

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

ds-reporting-lib

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

secobserve-mcp

MCP server for SecObserve: triage vulnerability findings, manage products and rules, import scan reports and SBOMs, generate VEX documents

vexcalibur

General-purpose VEX toolkit for SBOM-driven vulnerability exploitability workflows.

pixi-sbom

pixi-sbom is a Pixi extension that generates Software Bills of Materials (SBOMs) from Pixi manifests and lock files, supporting dependency visibility, reproducibility, and supply-chain security workflows.

appthreat-depscan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

gangmu-sbom

Generate a CycloneDX or SPDX SBOM for embedded C/C++ firmware from the build's compile database and linker map.

secure-sdlc-evidence-collector

CLI-first tool to collect, normalize, evaluate and bundle Secure SDLC evidence per release.

cyclonedx-conan

Creates CycloneDX Software Bill of Materials (SBOM) documents for C/C++ projects using Conan

cra24

CRA Article 14 dossiers from an embedded Linux build tree. Scan Yocto or Buildroot, decide affectedness with the evidence shown, emit CSAF, OpenVEX and SRP with the statutory clock running. Zero runtime dependencies, offline-capable.

capa-language

A capability-typed language that emits machine-verifiable supply-chain SBOMs by construction: per-function CycloneDX, SPDX, VEX and SLSA artefacts that match the code, not a scanner's guess.

vexy

Generate VEX (Vulnerability Exploitability Exchange) CycloneDX documents

art14

Which SBOM vulnerabilities trigger an EU Cyber Resilience Act Article 14 reporting decision and why.

ds-server-lib

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

bogrod

Manage SBOM and VEX like source code

vuln-prioritizer-workbench

Local-first workbench for explainable CVE prioritization from scanner, SBOM, VEX, and asset evidence.

flashalpha-quantconnect

FlashAlpha options-flow & dealer-positioning data as QuantConnect LEAN custom-data bars (C# + Python)

dtrack-mcp

Read-mostly MCP server for Dependency-Track: AI-powered vulnerability triage with alias dedup, cross-project duplicate discovery, diff + carry-over between versions, and broadcast triage.

csaf-check

Python API and CLI for CSAF 2.0 and VEX validation using Secvisogram's validator, with CI-friendly unavailable-validator handling.