socketdev

What it is and what it does

The Socket.dev Python SDK is a lightweight wrapper around the Socket.dev REST API that lets you query package metadata, security scores, and license information directly from Python. It handles authentication, request formatting, and response parsing so you don't have to build HTTP calls manually. The SDK supports querying packages by PURL (Package URL), running full scans on manifest files, and exporting SBOMs in multiple formats (CycloneDX, SPDX, OpenVEX).

You initialize it with an API token and optional timeout, then call methods like `purl.post()` to look up package details, `fullscans.post()` to analyze a set of manifest files, or `export.cdx_bom()` to convert scan results into standard SBOM formats. It depends only on requests for HTTP calls and typing-extensions for type hints, making it straightforward to integrate into existing Python projects.

Use it for:

• Query package metadata and security scores for dependencies in your codebase by PURL.
• Automate full scans of manifest files (package.json, requirements.txt, etc.) as part of CI/CD pipelines.
• Export SBOMs in CycloneDX or SPDX format for compliance and supply-chain visibility.
• Retrieve vulnerability and license alerts for a set of components to inform security decisions.
• Integrate Socket.dev security checks into custom tooling or dashboards.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A Python SDK that wraps the Socket.dev REST API, enabling programmatic access to package security analysis, SBOM export, and full-scan operations from Python code.

Yes. The SDK is actively maintained, has no known vulnerabilities, installs with minimal friction, and is licensed permissively under MIT. Install it if you need programmatic access to Socket.dev's package security API from Python; skip it if you only need one-off lookups via the web UI.

Install

socketdev on PyPI

pip install socketdev

uv add socketdev

poetry add socketdev

Installing socketdev

Before you install

Low friction: pure Python wheel with only two runtime dependencies (requests and typing-extensions). Active maintenance with a release 8 days ago; repo shows recent commits and is not archived.

License in practice

MIT License permits free use, modification, and distribution with minimal restrictions—suitable for commercial and open-source projects alike.

Quickstart

pip install socketdev

from socketdev import socketdev
socket = socketdev(token="YOUR_API_KEY")
result = socket.purl.post("true", [{"purl": "pkg:pypi/requests"}])

Requires a valid Socket.dev API token; unauthenticated calls will fail.

Verify before relying

• Whether the SDK supports all current Socket.dev API endpoints or only a subset of v0.
• Rate limiting behavior and retry logic when making API calls.
• Whether SSL verification can be disabled safely in production contexts beyond testing.

Package facts

Evidence: socketdev-3.5.0-py3-none-any.whl

Keywords: oss, sca, sdk, security, socket.dev, socketsecurity

Tags

More Security packages