cpe
CPE: Common Platform Enumeration for Python
Decision gist · record as of 2026-08-14
Yes, with conditions. Install if you need CPE parsing and matching for security or asset management workflows and can accept the LGPLv3 copyleft constraint. The package is stable and dependency-free, but verify Python version compatibility before use—classifiers suggest Python 2.7 only, which is unmaintained. The high install friction and aging maintenance status mean you should confirm the package still works with your target Python version and CPE specification version before committing to it.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Classifiers indicate Python 2.7 support; modern Python version compatibility is unspecified and may require verification.
- High install friction due to source distribution.
- Package is aging but repository remains active with recent commits; classifiers indicate Python 2.7 support, suggesting limited modern Python version coverage.
License · maintenance · safety
LGPLv3 (copyleft) — LGPLv3 copyleft license requires derivative works to be licensed under compatible terms and source code to be made available; suitable for internal tools and open-source projects but restrictive for proprietary software.
last release 2024-10-02 (681 days) · last repo commit 2025-09-23 · 96 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 232,645 downloads/mo, #9,060 on PyPI
Alternatives
Verify before relying
pip install cpe
from cpe.cpe import CPE
cpe_obj = CPE('cpe:/a:vendor:product:1.0')
print(cpe_obj)- Whether the package supports Python 3.x versions beyond what classifiers suggest (2.7 listed, but 3.4 mentioned in description).
- Current state of Python 2.7 support given its end-of-life status and the package's aging maintenance window.
- Whether WFN, URI, and FS format support is complete and tested against current CPE 2.3 specification.
What it is and what it does
CPE is a Python implementation of the Common Platform Enumeration standard developed by MITRE and maintained by NIST. It provides tools to parse, compare, and evaluate CPE identifiers—standardized names for applications, operating systems, and hardware devices used in enterprise asset management and vulnerability tracking. The package handles three CPE formats (WFN, URI, and FS) and supports rich comparison operations and cross-version conversion between CPE versions 1.1, 2.2, and 2.3.
The package has no runtime dependencies, making it lightweight for integration into security tools, asset inventory systems, and vulnerability scanners. However, it requires installation from source (high friction), and its maintenance status is aging. The LGPLv3 license is copyleft, meaning any derivative work must also be open-source and GPL-compatible.
Use it for
- Parse and normalize CPE identifiers in vulnerability databases or asset management systems.
- Compare CPE strings to match software and hardware across different naming conventions.
- Evaluate CPE matching logic in security scanning tools that need to identify affected assets.
- Convert between CPE format versions (1.1, 2.2, 2.3) when integrating legacy and modern systems.
- Build asset classification and inventory tools that rely on standardized platform enumeration.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Install if you need CPE parsing and matching for security or asset management workflows and can accept the LGPLv3 copyleft constraint. The package is stable and dependency-free, but verify Python version compatibility before use—classifiers suggest Python 2.7 only, which is unmaintained. The high install friction and aging maintenance status mean you should confirm the package still works with your target Python version and CPE specification version before committing to it.
Install
cpe on PyPI
Before you install
High install friction due to source distribution. Package is aging but repository remains active with recent commits; classifiers indicate Python 2.7 support, suggesting limited modern Python version coverage.
Classifiers indicate Python 2.7 support; modern Python version compatibility is unspecified and may require verification.
License in practice
LGPLv3 copyleft license requires derivative works to be licensed under compatible terms and source code to be made available; suitable for internal tools and open-source projects but restrictive for proprietary software.
Quickstart
pip install cpe
from cpe.cpe import CPE
cpe_obj = CPE('cpe:/a:vendor:product:1.0')
print(cpe_obj)Verify before relying
- Whether the package supports Python 3.x versions beyond what classifiers suggest (2.7 listed, but 3.4 mentioned in description).
- Current state of Python 2.7 support given its end-of-life status and the package's aging maintenance window.
- Whether WFN, URI, and FS format support is complete and tested against current CPE 2.3 specification.
Package facts
| License | LGPLv3 copyleft |
| Python support | Not specified |
| Install friction | High. Source build required |
| Runtime dependencies | None |
| Maintenance | Aging 681 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 232,645 / month, #9,060 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: Information TechnologyIntended Audience :: System AdministratorsLicense :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)Natural Language :: EnglishOperating System :: OS IndependentProgramming Language :: Python :: 2.7 |
Evidence: cpe-1.3.1.tar.gz
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “CPE parsing and matching”
- cpeParses, compares, and evaluates Common Platform Enumeration (CPE)…
- nvdlibWrapper library for the NIST National Vulnerability Database API that…
- python-flirtParse, compile, and match FLIRT signatures (Fast Library…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also nvdlib · cwe2 · ff3 · threatwire · parse-type · pylspci · python-stdnum · uritools · lazr.uri · prowler