---
id: ca9
version: "0.5.0"
license: MPL-2.0
license_treatment: copyleft
maintenance: active
---

# ca9 — Open source Python package security and evidence-backed SCA triage

License: copyleft · Maintenance: active · Downloads: 77.3K/mo

## What it is and what it does

ca9 is a local-first supply-chain defense tool that reads your Python project's manifests, lockfiles, and SCA reports, then answers a single critical question for each CVE alert: is this vulnerable code actually reachable from your application? It combines three evidence sources—static AST import tracing, dependency graph analysis, and optional runtime coverage data—to classify each vulnerability as reachable, unreachable (static or dynamic), or inconclusive, with an evidence trail and confidence score for each verdict.

Instead of patching every flagged CVE, you get a filtered list of only the vulnerabilities that matter: code your app actually imports and executes. ca9 also provides broader supply-chain vetting (malware advisories, registry trust, artifact hashes, license policy, dependency confusion risk) and runtime preflight enforcement via `ca9 run`, so you can block unsafe packages before they install. It reads native Python manifests, npm lockfiles, and SBOM inputs, and outputs JSON, SARIF, OpenVEX, or Markdown for integration into CI gates and audit workflows.

Use it for:

- Filter CVE alerts from SCA tools to identify which vulnerabilities actually affect your code, reducing alert fatigue.
- Build a normalized package inventory from mixed lockfile formats to audit direct and transitive dependencies.
- Enforce supply-chain policy in CI by blocking untrusted registries, dependency-confusion risks, or missing hashes.
- Combine static import analysis with coverage data to confirm whether a vulnerable function is ever called.
- Generate OpenVEX or SARIF reports for downstream security tools, enriching SCA output with reachability evidence.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

ca9 analyzes Python package supply chains to determine whether flagged CVEs are actually reachable from your application code, combining static import tracing, dependency inventory, and optional runtime coverage to separate actionable vulnerabilities from unreachable alerts.

Yes, if you use Python and want to reduce CVE alert noise with evidence-backed triage. ca9 is actively maintained, has no known vulnerabilities, low install friction, and solves a real problem—most flagged CVEs are unreachable. The MPL-2.0 license is permissive for local use. Start with `ca9 scan` on an existing SCA report to see the impact. Early-stage (Alpha), so expect API evolution, but the core reachability logic is sound.

## Install

pip install ca9
uv add ca9
poetry add ca9

## Installing ca9

Before you install: Low friction: pure Python wheel with only two runtime dependencies (packaging, tomli). Active maintenance—last commit 2026-08-14, released 2026-06-27, only 48 days old. Supports Python 3.10 through 3.13. No known vulnerabilities.

License in practice: MPL-2.0 is copyleft: you may use ca9 freely and modify it, but if you distribute modified versions, you must disclose source and license derivative works under MPL-2.0. For most local security tooling use, this poses no practical barrier.

Quickstart:

pip install ca9[cli]
ca9 scan --repo . --coverage coverage.json
ca9 inventory --repo . -f json

Requires Python 3.10 or later. For full functionality, your project should have a recognized lockfile or SCA report to analyze.

Verify before relying:

- Whether static import tracing and coverage analysis work reliably on complex dependency graphs with dynamic imports.
- Performance characteristics on large monorepos or projects with hundreds of transitive dependencies.
- Completeness of vulnerable API detection rules and how often they require manual tuning.
- Reliability of reachability verdicts across different Python packaging patterns and import styles.

## Package facts

- License: MPL-2.0 (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 77.3K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

cve reachability analysis, supply chain security python, vulnerability triage automation, sca report filtering, package dependency vetting, static import analysis, open source risk assessment, supply-chain-security, cve-triage, reachability-analysis

[View on SkillFed](https://skillfed.io/packages/ca9) · [View on PyPI](https://pypi.org/project/ca9/)