---
id: grafeas
version: "1.24.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# grafeas — Grafeas API client library

License: permissive · Maintenance: active · Downloads: 432.0K/mo

## What it is and what it does

Grafeas is Google's official Python client for the Grafeas API, an implementation that stores and enables querying of critical metadata about software artifacts. It wraps the Container Analysis service on Google Cloud Platform, allowing developers to programmatically access, query, and retrieve artifact metadata. The library is built on standard Google Cloud infrastructure (google-api-core, google-auth, grpcio, proto-plus, protobuf) and integrates with gRPC for communication.

The package is intended for developers working with Google Cloud who need to interact with artifact metadata at scale—for example, querying vulnerability data, build provenance, or deployment information about container images and other software artifacts. It requires Python 3.10 or later and assumes the user has a Google Cloud project with Container Analysis enabled and proper authentication configured.

Use it for:

- Query vulnerability and security metadata for container images stored in Google Cloud.
- Retrieve build provenance and deployment information about software artifacts.
- Integrate artifact metadata queries into CI/CD pipelines for compliance and auditing.
- Programmatically access critical metadata about all software artifacts in a project.
- Build custom dashboards or tools that analyze artifact metadata from Container Analysis.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Python client library for the Grafeas API, enabling querying and retrieval of software artifact metadata stored in Google Cloud's Container Analysis service.

Yes, if you are working with Google Cloud Container Analysis. The library is actively maintained, has low install friction, carries a permissive Apache-2.0 license, and has no known vulnerabilities. It is the official client for the Grafeas API and is necessary to interact with Container Analysis metadata from Python. Not relevant if you are not using Google Cloud or Container Analysis.

## Install

pip install grafeas
uv add grafeas
poetry add grafeas

## Installing grafeas

Before you install: Low install friction with a pure-wheel distribution. Actively maintained with a release 8 days old and recent commits. Depends on standard Google Cloud libraries (google-api-core, google-auth, grpcio, proto-plus, protobuf).

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for most projects.

Quickstart:

pip install grafeas

from google.cloud import grafeas_v1

client = grafeas_v1.GrafeasClient()
# Query metadata from Container Analysis

Requires Python >= 3.10 and Google Cloud authentication credentials configured (via GOOGLE_APPLICATION_CREDENTIALS or Application Default Credentials).

Verify before relying:

- Whether the library supports offline use or requires active Google Cloud connectivity for all operations.
- Performance characteristics when querying large volumes of artifact metadata.
- Whether Container Analysis API must be explicitly enabled in a Google Cloud project before use.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 432.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

grafeas api client, container analysis metadata, software artifact metadata query, google cloud grafeas, artifact metadata storage, container metadata retrieval, grafeas python client, google-cloud, artifact-metadata, container-analysis

[View on SkillFed](https://skillfed.io/packages/grafeas) · [View on PyPI](https://pypi.org/project/grafeas/)