---
id: safety
version: "3.8.1"
license: MIT
license_treatment: permissive
maintenance: active
---

# safety — Scan dependencies for known vulnerabilities and licenses.

License: permissive · Maintenance: active · Downloads: 5.8M/mo

## What it is and what it does

Safety CLI is a command-line tool that scans Python project dependencies against a vulnerability database to identify packages with known security issues and detect malicious packages. It integrates into development workflows, CI/CD pipelines, and production systems to catch supply chain risks early. The tool can output findings in multiple formats (JSON, SBOM, HTML, text) and optionally apply automated fixes to update vulnerable dependencies to secure versions.

The package depends on a suite of common Python libraries—httpx for HTTP requests, pydantic for data validation, typer for CLI structure, and others—to deliver scanning, authentication, and reporting. It requires Python >=3.9 and is actively maintained with recent releases. A free tier is available after an initial trial period, though access to the full vulnerability database requires a paid subscription.

Use it for:

- Scan a local project directory before committing code to detect vulnerable dependencies early in development
- Integrate into GitHub Actions or other CI/CD pipelines to block builds when high-severity vulnerabilities are found
- Automatically remediate vulnerable dependencies by running `safety scan --apply-fixes` to update requirements files
- Generate SBOM or JSON reports for compliance audits and supply chain transparency documentation
- Monitor system-wide dependencies on developer machines to detect risks in installed tools and runtimes

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Safety CLI scans Python project dependencies for known vulnerabilities and malicious packages, then reports findings and can automatically update vulnerable dependencies to secure versions.

Yes, if you need Python dependency vulnerability scanning. Safety CLI is actively maintained, has low install friction, and integrates well into CI/CD workflows. The free tier is limited but available; commercial use and comprehensive coverage require a paid plan. No known vulnerabilities in the package itself as of the fact sheet date.

## Install

pip install safety
uv add safety
poetry add safety

## Installing safety

Before you install: Low install friction with a pure-Python wheel distribution. The package is actively maintained with recent releases and carries 19 runtime dependencies including httpx, pydantic, and click—a moderate but manageable dependency footprint for a security scanning tool.

License in practice: Released under the MIT License (permissive), so you can use it freely in commercial and private projects. A free tier is available after a 7-day trial, though the full vulnerability database requires a paid plan.

Quickstart:

pip install safety
safety auth
safety scan

Requires Python >=3.9. Authentication is required to run scans; the tool will prompt for account creation or login on first use.

Verify before relying:

- Whether the free plan's vulnerability database coverage is sufficient for your project's security requirements
- How the tool's remediation suggestions align with your dependency management workflow
- Performance characteristics when scanning large monorepos or projects with many dependencies

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 5.8M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

python dependency vulnerability scanner, check python packages for vulnerabilities, supply chain security scanning, python security scanning cli, detect malicious python packages, vulnerability remediation tool, python dependency audit, supply-chain-security, cli-tool, dependency-audit

[View on SkillFed](https://skillfed.io/packages/safety) · [View on PyPI](https://pypi.org/project/safety/)