---
id: pyre-check
version: "0.10.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# pyre-check — A performant type checker and security-focused static analyzer for Python

License: permissive · Maintenance: active · Downloads: 238.4K/mo

## What it is and what it does

Pysa is a security-focused static analyzer built on top of Pyrefly, Meta's Python type checker. It works by tracking how untrusted data (sources) flows through your code to dangerous operations (sinks), flagging paths that could lead to security vulnerabilities. The tool is designed to scale to large codebases and uses configurable models to identify sources and sinks relevant to your application.

You run Pysa after Pyrefly has successfully type-checked your code. It produces a report of potential security and privacy issues without executing your code. The tool ships as part of the pyre-check package and relies on a chain of dependencies including libcst for code parsing, click for CLI, and several typing utilities.

Use it for:

- Scan a web application for user input reaching SQL queries or shell commands.
- Identify privacy violations where sensitive data flows to external APIs or logs.
- Integrate security scanning into CI/CD pipelines via the GitHub Action.
- Analyze large Python codebases for data exfiltration or injection vulnerabilities.
- Enforce security policies by configuring custom taint sources and sinks for your domain.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Pysa is a static analysis tool that tracks data flows through Python code to identify security and privacy vulnerabilities like SQL injection and remote code execution, scaling to codebases with millions of lines.

Yes, if you need automated security scanning for Python. Pysa is actively maintained, has no known vulnerabilities, and scales to large codebases. Install it when your team wants continuous data-flow analysis without manual code review. Requires Python 3.9+, Pyrefly setup, and willingness to configure models for your specific threats.

## Install

pip install pyre-check
uv add pyre-check
poetry add pyre-check

## Installing pyre-check

Before you install: Medium install friction due to 12 runtime dependencies and platform-specific wheels (macOS ARM64, Linux x86_64). Active maintenance with recent release (8 days old) and ongoing repository activity supports reliability.

License in practice: MIT license is permissive; you can use, modify, and distribute Pysa with minimal restrictions, making it suitable for both open-source and commercial projects.

Quickstart:

pip install pyre-check
pyrefly check
pyre analyze

Requires Python 3.9 or later; Pyrefly must successfully type-check your code before Pysa can analyze it.

Verify before relying:

- Whether Pysa's taint models cover your specific security concerns or require custom model writing.
- Performance characteristics when analyzing your specific codebase size and complexity.
- Integration workflow with existing CI/CD pipelines beyond the GitHub Action mentioned.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 238.4K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

python security static analysis, data flow taint analysis, sql injection detection, python vulnerability scanner, security code analysis tool, python source sink analysis, code security linter, security-analysis, static-analysis, taint-tracking

[View on SkillFed](https://skillfed.io/packages/pyre-check) · [View on PyPI](https://pypi.org/project/pyre-check/)